[trotsky]

The truth is that both are happening. When you talk to people who are pragmatic and watch the strategic elements they are often saying things like "or someone operating with chinese cover". There is definitely evidence that other actors are using chinese IPs, working hours and techniques to muddy the water. But at the same time, a preponderance of evidence suggests strongly that a majority of these attacks are from chinese sources. Keep in mind that military and national security investigators - even private sector investigators - have access to a lot more intelligence about these matters than simply what IP launched what. So, yes, while some intrusions from china are undoubtedly the work of non-chinese it still makes sense to focus a lot of your efforts on the dragon in the room.

[dreww]

i totally believe that there is more evidence out there, it is just rarely actually revealed.

so it seems at least possible that there is some collusion, conscious or not, between journalists and cybersecurity spooks to name an enemy in order to get traction in the public mind, vs. saying "well, it's from a lot of different people, lots of stuff from china, and who knows what else."

I even think this might be a good strategy - I guess my point is i'd like to see more real public evidence before we accuse foreign governments of attacking us in the press. not because i don't believe it is happening, but because i feel those assertions should be backed up if they're going to be made.