4 ms·
The government already admitted that they are hoarding vulnerabilities: ...the Obama administration announced, in early 2014, that the NSA must disclose flaws
by Johnny555 10y ago
The government already admitted that they are hoarding vulnerabilities:
...the Obama administration announced, in early 2014, that the NSA must disclose flaws in common software so they can be patched (unless there is "a clear national security or law enforcement" use)...
Obviously any valuable zero-day flaw has clear national security use to a national security agency that's tasked with breaking into "enemy" systems.
- tptacek 10y agoWhy the scare quotes around "enemy"?
- CDRdude 10y agoBecause the NSA breaks into US-based companies too.
- tptacek 10y agoI'm sure that's happened, but there's a reason the EQ dump included lots of vulnerabilities for Chinese products nobody in the US deploys. "Enemy" is a weird word ("adversary" is probably better), but however you slice it: NSA's mission includes real ones.
- nitrogen 10y agoThat is entirely irrelevant to people who are still getting hacked because of these hoarded vulnerabilities.
- tptacek 10y agoI don't follow. Could you make this argument more specific? Who's doing this attacking? What kinds of vulnerabilities? Stated as vaguely as you have, that's a hard argument to rebut. I tend to agree: the world would be a safer place if everything was publicly disclosed immediately. But even NSA's opponents tend not to support that as a policy objective.
- gknoy 10y agoTheir tasking, though, is to break into foreign ones. They see breaking into domestic ones as necessary to do that (and I can see why they might feel that way, even if I don't like the result), but I don't believe it's part of their core mandate.
- godgod 10y agoRemind me again how that is even remotely legal to do?
- Johnny555 10y agoBecause, for example, few Americans consider Germany to be an "enemy" or even an "adversary", yet: https://www.theguardian.com/us-news/2015/jul/08/nsa-tapped-german-chancellery-decades-wikileaks-claims-merkel https://www.theguardian.com/us-news/2015/jul/08/nsa-tapped-g...
- tptacek 10y agoNobody in the IC believes allies aren't constantly spying on each other. Germany and France are notorious for doing it to support their state industries. Like it or not, in the intelligence arena, the US and Germany are rivals.
- Florin_Andrei 10y agoThat the NSA is sitting on a zero-day stockpile is absolutely not a surprise for anyone in the industry. Of course they do. If you worked there, you'd to it too. But it's good to make the public more aware that this, indeed, is happening, it's not just something out of a Dan Brown paperback.
- pnathan 10y agoI'm a little surprised that this is even a point of ignorance... Of course they do. Of course there is military research. Of course there is spying research. It's just the way it works.