5 ms·

When only some people have security, nobody has security. This is the sort of event that should -- though it obviously won't -- lead to a policy debate about t

by HillRat 10y ago

When only some people have security, nobody has security. This is the sort of event that should -- though it obviously won't -- lead to a policy debate about the wisdom of locating cyberdefense and cyberwar within the same hallwaus.

Zigurd 10y ago
> "locating cyberdefense and cyberwar within the same hallways" This is thus far the largest scale example that if you sell security and surveillance, at most one of those product lines isn't a fraud.
- nickpsecurity 10y ago
  Sort of. They're only legally required to protect government communications, maybe government systems, and defense contractors. The "defense-only" solutions they have for them are high-quality. Then they push BS for everyone else to benefit surveillance mission. Quite a lame deal we US taxpayers get on those high-security products.
  - rdtsc 10y ago
    It is entertaining to read NSA's recommendations on how US govt should secure its data. Because you always wonder if they'd know of a vulnerability if they'd still advise using that technology. That is, if that department which writes the guide talks to the department that does the exploits. I imagine due to heavy and intentional compartmentalization this doesn't happen. Perhaps it depends on the nature of the exploit. For example, I consider the weakening of Dual_EC_DRBG devilishly good: because of the chosen P and Q they knew it was weak but also were the only ones who had the key. They would definitely not tell anyone about that.
    - nickpsecurity 10y ago
      I imagine due to heavy and intentional compartmentalization this doesn't happen" That seems to be best explanation. Two different groups with IAD being smaller one. The IAD also faces many issues with regs, red tape, Congessional mandate to use COTS garbage, lack of liability enforcement, etc. It all adds up to them getting less effective over time. They still do some good stuff when they put their pros on it. Their Inline Media Encryptor is great. I just cloned it and expanded in one of my designs. Just compare its security features to any encrypted USB disk. You'll see high-security vs mainstream security difference.

by HillRat 10y ago

Zigurd 10y ago

> "locating cyberdefense and cyberwar within the same hallways" This is thus far the largest scale example that if you sell security and surveillance, at most one of those product lines isn't a fraud.

nickpsecurity 10y ago
Sort of. They're only legally required to protect government communications, maybe government systems, and defense contractors. The "defense-only" solutions they have for them are high-quality. Then they push BS for everyone else to benefit surveillance mission. Quite a lame deal we US taxpayers get on those high-security products.
- rdtsc 10y ago
  It is entertaining to read NSA's recommendations on how US govt should secure its data. Because you always wonder if they'd know of a vulnerability if they'd still advise using that technology. That is, if that department which writes the guide talks to the department that does the exploits. I imagine due to heavy and intentional compartmentalization this doesn't happen. Perhaps it depends on the nature of the exploit. For example, I consider the weakening of Dual_EC_DRBG devilishly good: because of the chosen P and Q they knew it was weak but also were the only ones who had the key. They would definitely not tell anyone about that.
  - nickpsecurity 10y ago
    I imagine due to heavy and intentional compartmentalization this doesn't happen" That seems to be best explanation. Two different groups with IAD being smaller one. The IAD also faces many issues with regs, red tape, Congessional mandate to use COTS garbage, lack of liability enforcement, etc. It all adds up to them getting less effective over time. They still do some good stuff when they put their pros on it. Their Inline Media Encryptor is great. I just cloned it and expanded in one of my designs. Just compare its security features to any encrypted USB disk. You'll see high-security vs mainstream security difference.