5 ms·
> However, there is a risk they would sit on zero days Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular
by user5994461 10y ago
> However, there is a risk they would sit on zero days
Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda.
There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.
- WJW 10y agoSo what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.
- strictnein 10y agoIt'd be tough to form an international legal entity anyways.
- user5994461 10y agoThen you don't report that to the FBI, it's not their jurisdiction.
- thecrazyone 10y agoIt's good to have this as a general reminder: "Not everyone is from the US", people tend to forget that so often :)
- colordrops 10y agoWhat makes you say that? Plenty of evidence points to upper management at the FBI and other 3 letter agencies being more interested in power brokering than honesty and serving the public.
- njharman 10y ago> They are still here to protect americans That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".
- pdelbarba 10y agoThey were perfectly happy to use the vulnerabilities exploited by Stingray after all.
- anigbrowl 10y agoDon't mix up the existence of incentives with the idea that you have insight into what people's goals are.
- Spooky23 10y agoHave you ever interacted with law enforcement on any professional basis? They aren't like that at all.
- njharman 10y ago1) yes, but with the "troops" and lower level managers. 2) the Director of the FBI (and other other high level managers) is much more of a political bureaucrat than they are a LEO.
- jxcole 10y agoWhile it may be true that in this particular instance the FBI might act benevolently, the idea was that it would be nice if there was an organization you could go to with any zero day bug. Even if the FBI is not mismanaged and always tries to protect Americans, you could easily imagine a scenario where someone reports an exploit to an OS where anyone can remotely install a key logger. The FBI wouldn't be a good organization to report this to because they may want to use this to track down criminals which, they would no doubt feel, would greatly outweigh the cost to Americans that the zero day represents. The EFF seems like a good choice. In general you would need to pick an organization that does not have a vested interest in using exploits.
- eric_h 10y ago> While it may be true that in this particular instance the FBI might act benevolently Indeed. Didn't the FBI effectively purchase a zero day to break into the iPhone of the San Bernardino shooter? Didn't they also then not disclose said zero day to Apple? There's no way that any LE agency can be trusted with this responsibility; I'm not convinced that it can be done by the federal government at all. EFF seems like a reasonable choice, but even non-profits have the potential to be corrupted/subverted (and operating as a dump for zero days has the power to corrupt, for sure, regardless of how moral your organization claims to be on its website). This definitely falls under the umbrella of hard-problems-in-politics-that-will-not-be-solved-any-time-soon
- sverhagen 10y agoWhat if there were multiple non-profits that can keep each other honest?
- deleted 10y ago[deleted]