[tptacek]

I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that people understand how hard this is to do, and take that into consideration before adopting tools like these. You can easily make things worse for yourself.

I think this post is a fun technical case study on its own. It only takes on urgency because it literally markets itself as a tool to slip past state adversaries. I think it's important that people understand that it isn't the state itself that's going to take the time to detect something like this; it's some commercial forensics vendor they use automatically.

[rectang]

A while ago I participated in security design for an open source foundation. (Security is not a specialty of mine, but I aspire to be competent enough for my role as a developer working in web dev and open source.) We attempted to design our processes to assure some level of defense against state-level threat actors despite assuming we could not keep them out of our network. The main goal was to ensure an audit trail in the event that our source repositories or release archives were compromised and changed.

[PaulHoule]

My first take is that it is terrible terrible opsec to talk about this sort of thing if you actually want to take it across a border or have any kind of "elevated" encounter with law enforcement or intelligence.

Like if they have good tools for profiling you from your posts they'll totally expect the OP to have some interesting hardware and stories to tell. Contrast that to just being some boring guy who has a cover story that happens to be true or the colorful character who doesn't really have anything to hide but who can keep spooks talking for hours.