4 ms·

Schneier didn't discuss what is IMO the biggest reason for NSA not to report vulnerabilities: it's "pissing into the wind", it's futile. When 10 vulnerabilities

Schneier didn't discuss what is IMO the biggest reason for NSA not to report vulnerabilities: it's "pissing into the wind", it's futile. When 10 vulnerabilities are reported and fixed, 11 new ones are quickly found. The vulnerabilities are overwhelming us. Back around the year 2000 Microsoft was being beaten up for all the vulnerabilities in their software. So in 2002 Bill Gates announced "Trustworthy Computing".[1][2] Microsoft Chairman Bill Gates announced a major strategy shift across all its products, including its flagship Windows software, to emphasize security and privacy over new capabilities. In 2014 Microsoft finally threw in the last towel, folding the group they formed into other units. They gave up. Microsoft lost not because they were incompetent, but because the problem is too big to attack in a conventional manner. I don't know what the answer is, but we need to approach things very differently. To quote Dr. Peter Venkman: "the usual stuff isn't working". [1] http://www.foxnews.com/story/2002/01/16/bill-gates-announces-microsoft-strategy-shift-toward-security-privacy.html http://www.foxnews.com/story/2002/01/16/bill-gates-announces... [2] https://en.wikipedia.org/wiki/Trustworthy_computing https://en.wikipedia.org/wiki/Trustworthy_computing

NullCharacter 11y ago
Definitely agree. In terms of raw "national security" net gain, it's likely it would be more useful if kept secret and used offensively than if it was revealed and patched. Vulnerabilities are dime a dozen. Patching one zero day says nothing of the 10 more that are floating around at any given time.
flyryan 11y ago
This is why I have an issue with Project Zero. You will NEVER patch all the 0days. There are only a few bugs that I've seen that were so impactful (Heartbleed for example) that it made a massive impact to release and patch it. And as you implied, patching an 0day often publicizes a new vulnerable attack surface with new bugs to follow. The real way to fix security issues isn't to find new exploits and expose them. It's to architect new ways to prevent whole families of exploits from being possible. I've only really seen Project Zero do one sort of recommendation in this way. Outside of that, I don't feel that them finding 0days and releasing them is actually a significant improvement on security because they aren't even close to plugging all of the holes (or even enough to really make a difference).

NullCharacter 11y ago

Definitely agree. In terms of raw "national security" net gain, it's likely it would be more useful if kept secret and used offensively than if it was revealed and patched. Vulnerabilities are dime a dozen. Patching one zero day says nothing of the 10 more that are floating around at any given time.

flyryan 11y ago

This is why I have an issue with Project Zero. You will NEVER patch all the 0days. There are only a few bugs that I've seen that were so impactful (Heartbleed for example) that it made a massive impact to release and patch it. And as you implied, patching an 0day often publicizes a new vulnerable attack surface with new bugs to follow. The real way to fix security issues isn't to find new exploits and expose them. It's to architect new ways to prevent whole families of exploits from being possible. I've only really seen Project Zero do one sort of recommendation in this way. Outside of that, I don't feel that them finding 0days and releasing them is actually a significant improvement on security because they aren't even close to plugging all of the holes (or even enough to really make a difference).