4 ms·

> this is exactly what I expect a spy agency would be doing From Wikileaks' overview: "In the wake of Edward Snowden's leaks about the NSA, the U.S. technolog

by imron 10y ago

> this is exactly what I expect a spy agency would be doing From Wikileaks' overview: "In the wake of Edward Snowden's leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis — rather than hoard — serious vulnerabilities, exploits, bugs or "zero days" to Apple, Google, Microsoft, and other US-based manufacturers. ... "Year Zero" documents show that the CIA breached the Obama administration's commitments. Many of the vulnerabilities used in the CIA's cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals." By not releasing this information to technology companies affected, they are increasing the risk of the same exploits being used against high profile US targets.

waifufucker 10y ago
by definition a zero day is unknown, if they detect that it's being used in the wild then they can easily trigger the software vendor to issue emergency patches or plant the story somewhere - hell, they can even release counter malware that can mitigate they have absolutely no reason to reveal their inventory of zero daze; that's not to say they're not morally obligated to do so, but when have morals driven their actions?
dvcc 10y ago
Again, I think there is a difference between the desired and realistic roles of an intelligence agency in disclosing exploits. Sure, I would hope they disclose them. But at the same time if they are actively using an exploit, I have pretty much no expectation of them disclosing it. I think this has way more to do with our reference-point than anything else. My expectations were never quite as high!
- _jal 10y ago
  In other words, you feel attempting to constrain the operations of intelligence agencies is equivalent of asking nicely, and that's the way is should be?
  - dvcc 10y ago
    I mean the mentioned attempt was not as general as it was made out to be. Obama placed an exception for “a clear national security or law enforcement need”. Pretty much what my expectations were set at. Again I am reluctant to take anything that Wikileaks says as absolute truth, they love to spin. https://www.nytimes.com/2014/04/13/us/politics/obama-lets-nsa-exploit-some-internet-flaws-officials-say.html?_r=0 https://www.nytimes.com/2014/04/13/us/politics/obama-lets-ns...
bluejekyll 10y ago
Not to nitpick, I absolutely agree that the NSA should be responsible for disclosing this type of information to help secure the USA and its infrastructure. The CIA on the other hand has clear (though not always followed) directive to only act outside the US and to act against foreign nationals. It's less clear to me that they should be required to disclose these. Another post makes the claim that the CIA may have lost these, that case seems clearer that they must disclose to protect US interests.
- clubm8 10y ago
  The problem is that there are very few IT systems that are purely foreign. For example, if the CIA finds an exploit in a wireless router made in China and sold all over the world, that hole can also be found by others and used against targets in the United States. Is being able to hack others worth letting ourselves get hacked?
  - bluejekyll 10y ago
    > Is being able to hack others worth letting ourselves get hacked? The answer to this for me is a clear no. What I was more questioning is given the CIA's role and job, I don't think it's necessarily their responsibility to do it. We're talking about a government agency who's purpose is to collect information about potential threats against the US, they have no reason to want to make that harder on themselves. If you want to debate changing the role of the CIA, and if or if not it should exist, that's a different set of questions. But given what their job is, why would they want to turn that funnel of information off? It's not in their interest to do that. I want everything to be hyper secure on the internet, but I also know that there are threats against the US (some created because of our actions) which the CIA is responsible for trying to keep an eye on. A similar question: is it worth being hacked so that we can know that there is an imminent attack coming against some US interest? EDIT: I know that the CIA is responsible for some really ugly things in the world, I'm not defending any of those actions. I'm speaking more of what their theoretical function is and what responsibilities they have in disclosing some of this information.
    - 10y ago

by imron 10y ago

waifufucker 10y ago

by definition a zero day is unknown, if they detect that it's being used in the wild then they can easily trigger the software vendor to issue emergency patches or plant the story somewhere - hell, they can even release counter malware that can mitigate they have absolutely no reason to reveal their inventory of zero daze; that's not to say they're not morally obligated to do so, but when have morals driven their actions?

dvcc 10y ago

Again, I think there is a difference between the desired and realistic roles of an intelligence agency in disclosing exploits. Sure, I would hope they disclose them. But at the same time if they are actively using an exploit, I have pretty much no expectation of them disclosing it. I think this has way more to do with our reference-point than anything else. My expectations were never quite as high!

_jal 10y ago
In other words, you feel attempting to constrain the operations of intelligence agencies is equivalent of asking nicely, and that's the way is should be?
- dvcc 10y ago
  I mean the mentioned attempt was not as general as it was made out to be. Obama placed an exception for “a clear national security or law enforcement need”. Pretty much what my expectations were set at. Again I am reluctant to take anything that Wikileaks says as absolute truth, they love to spin. https://www.nytimes.com/2014/04/13/us/politics/obama-lets-nsa-exploit-some-internet-flaws-officials-say.html?_r=0 https://www.nytimes.com/2014/04/13/us/politics/obama-lets-ns...

bluejekyll 10y ago

Not to nitpick, I absolutely agree that the NSA should be responsible for disclosing this type of information to help secure the USA and its infrastructure. The CIA on the other hand has clear (though not always followed) directive to only act outside the US and to act against foreign nationals. It's less clear to me that they should be required to disclose these. Another post makes the claim that the CIA may have lost these, that case seems clearer that they must disclose to protect US interests.

clubm8 10y ago
The problem is that there are very few IT systems that are purely foreign. For example, if the CIA finds an exploit in a wireless router made in China and sold all over the world, that hole can also be found by others and used against targets in the United States. Is being able to hack others worth letting ourselves get hacked?
- bluejekyll 10y ago
  > Is being able to hack others worth letting ourselves get hacked? The answer to this for me is a clear no. What I was more questioning is given the CIA's role and job, I don't think it's necessarily their responsibility to do it. We're talking about a government agency who's purpose is to collect information about potential threats against the US, they have no reason to want to make that harder on themselves. If you want to debate changing the role of the CIA, and if or if not it should exist, that's a different set of questions. But given what their job is, why would they want to turn that funnel of information off? It's not in their interest to do that. I want everything to be hyper secure on the internet, but I also know that there are threats against the US (some created because of our actions) which the CIA is responsible for trying to keep an eye on. A similar question: is it worth being hacked so that we can know that there is an imminent attack coming against some US interest? EDIT: I know that the CIA is responsible for some really ugly things in the world, I'm not defending any of those actions. I'm speaking more of what their theoretical function is and what responsibilities they have in disclosing some of this information.
  - 10y ago