3 ms·

Anyone notice at the bottom where it says "Our research on LandHere was made possible by funding from the NSA"?

by tbodt 10y ago

elihu 10y ago
Yeah, a lot of what Galois does is funded by government grants of one sort or another. While my general opinion of the NSA is not favorable, I think that funding basic research in computer security is a legitimate part of their mission. Since Galois is blogging about it, I presume that the NSA isn't hoarding the technology for themselves. So, I see no immediate issue with them accepting money from the NSA.
sanxiyn 10y ago
Yes, everybody noticed. Let us praise NSA for this virtuous act of trying to make the computing more secure.
hueving 10y ago
Did you not know one of the NSA mandates is to improve security? It's a dual personality organization to say the least. They suggested a change to a crypto algorithm to protect it from differential cryptanalysis before that was a public attack. This resulted in a weird dilemma of decided which arm of the NSA was 'helping' because the purpose wasn't public. It wasn't until much later that it turned out to be good.
nickpsecurity 10y ago
So what? The IAD part of NSA helped invent INFOSEC, did some of best stuff in COMSEC for long time, did TEMPEST sheilding, evaluated early high-assurance systems (some never broken), made guides for securing many COTS tech, funded work like Galois Inc’s that regularly gets FOSS’d, and some other stuff Im probably forgetting. They’ve done far more good in IAD than bad with the one subversion that was probably NOBUS in practice. They also published methods to build stuff they can’t beat most of the time under TCSEC B3/A1 and Common Criteria EAL6/7 High Robustness. If we’re being honest, the FOSS and commercial developers ignoring such advice from NSA and others in high-assurance security for decades did more for NSA SIGINT division than TAO subversions ever did. NSA just finds the avoidable problems people leave in there. So, this meme of “Oh, it’s NSA!” needs to stop unless they’re supplying a closed-source solution or asking for backdoors/escrow. Anything else should simply be rigorously analyzed by 3rd parties like every other source. Funny enough, that’s one of NSA’s certification requirements.

Anyone notice at the bottom where it says "Our research on LandHere was made possible by funding from the NSA"?

by tbodt 10y ago

Anyone notice at the bottom where it says "Our research on LandHere was made possible by funding from the NSA"?

elihu 10y ago

Yeah, a lot of what Galois does is funded by government grants of one sort or another. While my general opinion of the NSA is not favorable, I think that funding basic research in computer security is a legitimate part of their mission. Since Galois is blogging about it, I presume that the NSA isn't hoarding the technology for themselves. So, I see no immediate issue with them accepting money from the NSA.

sanxiyn 10y ago

Yes, everybody noticed. Let us praise NSA for this virtuous act of trying to make the computing more secure.

hueving 10y ago

Did you not know one of the NSA mandates is to improve security? It's a dual personality organization to say the least. They suggested a change to a crypto algorithm to protect it from differential cryptanalysis before that was a public attack. This resulted in a weird dilemma of decided which arm of the NSA was 'helping' because the purpose wasn't public. It wasn't until much later that it turned out to be good.

nickpsecurity 10y ago

So what? The IAD part of NSA helped invent INFOSEC, did some of best stuff in COMSEC for long time, did TEMPEST sheilding, evaluated early high-assurance systems (some never broken), made guides for securing many COTS tech, funded work like Galois Inc’s that regularly gets FOSS’d, and some other stuff Im probably forgetting. They’ve done far more good in IAD than bad with the one subversion that was probably NOBUS in practice. They also published methods to build stuff they can’t beat most of the time under TCSEC B3/A1 and Common Criteria EAL6/7 High Robustness. If we’re being honest, the FOSS and commercial developers ignoring such advice from NSA and others in high-assurance security for decades did more for NSA SIGINT division than TAO subversions ever did. NSA just finds the avoidable problems people leave in there. So, this meme of “Oh, it’s NSA!” needs to stop unless they’re supplying a closed-source solution or asking for backdoors/escrow. Anything else should simply be rigorously analyzed by 3rd parties like every other source. Funny enough, that’s one of NSA’s certification requirements.