Uh, you do know SJVN worked for NASA, right?

FreeBSD thought it had scrubbed all GPL code, but a few kernel leftovers remained.

Not quite; one FreeBSD community member who isn't a developer edited the FreeBSD wiki to suggest this, and that was picked up by a variety of tech press sources.

tl;dr: A rogue device plugged into a "trusted" motherboard makes it untrusted.

As the saying goes, "It rather involved being on the other side of this airtight hatchway."

Sigh.

Isn't the point of those trusted environments is that they aren't supposed to be compromised by plugging something into the motherboard? So that you don't have to trust the server hosting company if you trust Intel and can verify that nothing from the hosting side is messing with your software at runtime

something-something I have a bridge to sell you something

/me laughs in legitimate-interest

Steve is in GDPR land, according to his profile page.

Not theft, AFAICS: Creative Commons licensed, with correct attribution given.

And Thunderbird is dead to me

bless you for your correct use of the C-word.

In other words, the threat actors had access to the breached network during the 22-ish months before they were discovered.

DUPE of https://news.ycombinator.com/item?id=41434500