4 ms·

>Which is exactly what we crazy cookoo conspiracy theorists have been warning about. Which is what exactly? That a spy agency is spying? >If you put backdoors

>Which is exactly what we crazy cookoo conspiracy theorists have been warning about. Which is what exactly? That a spy agency is spying? >If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security I don't agree with putting in backdoors, but I don't see how exploiting backdoors by your security agency is so nefarious. That is literally why they were created to do, and this is what every other foreign security agency is doing as well. >So while I don't disagree that triple letters need some cool tools to get shit done Sounds like you do. >I think this function needs some technocratic oversight specifically for this issue. How about congressional, judicial and executive oversight? Because that's what we have now.

losteric 10y ago
The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy... But it does beg the question: who's protecting our information from foreign intrusions?
- macspoofing 10y ago
  Isn't that partly the mission statement of the NSA and CIA and FBI?
  - losteric 10y ago
    The CIA and NSA are externally oriented. Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution. We need an organization focused on preemptively securing our infrastructure.
    - knowaveragejoe 10y ago
      The NSA is actually tasked with that mission: > NSA is concurrently charged with protection of U.S. government communications and information systems against penetration and network warfare. https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency
      - losteric 10y ago
        Yes, government defense. Who protects the rest?
        jessaustin 10y ago
        Private entities protect themselves and their customers, to varying degrees, which is how it has always been.
        knowaveragejoe 10y ago
        That actually overlaps with things like the power grid and ATC, for what it's worth. It's a little bigger than just "government computers".
- jimnotgym 10y ago
  Before this runs the risk of becoming a universally acknowledged truth, is it fine? Actually wasn't "Gentlemen don't open each other mail", also a perfectly reasonable position? In the cyberwar the US already seems to be fighting against its own weapons! Would it actually be much better for a nation like the US to use its knowledge defensively and keep their citizens safe from foreign interference?
  - losteric 10y ago
    I also strongly advocate for information disclosure and collaborating with vendors. However, I'm not convinced the NSA is the entity for that role. Organizationally, the NSA makes more sense as an R&D entity that discloses to offensive intelligence agencies and defensive security forces.
mannigfaltig 10y ago
> Which is what exactly? That a spy agency is spying? To spell it out: backdoors are of course a helpful tool for a security agency, but once the key for the backdoors falls into the wrong hands the potential for misuse is monstrous because, well, the backdoors are in all kinds of potentially critical systems systems, e.g. even in the cellphones of high ranking officials (or in cellphones of their families) etc. To get the same intel by different means than a backdoor is of course much more expensive. So one needs to find the sweet spot, where the utility as a function of cost and security is maximized. That sweet spot likely does not involve backdoors.
abecedarius 10y ago
> literally why they were created to do The NSA is supposed to do both defense and offense. The defense came up, for example, when they improved DES to resist differential cryptanalysis (which the public crypto world hadn't discovered yet) before DES was standardized. But that was a long time ago; at least since 9/11 the offense side seems to have pretty much eaten the defense, as far as we can tell. (See: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG) I believe this newer strategy is badly misplaced from the standpoint of the security of the American people (and good for the power of security-state insiders).
- lern_too_spel 10y ago
  If the IA department in the NSA were smart enough to figure out every vulnerability that the SIGINT department discovered and got everything fixed, SIGINT would be impotent. Clearly, things like SELinux make SIGINT's job harder, but your suggestion that SIGINT should handicap itself is ludicrous on its face.
  - abecedarius 10y ago
    Consider a few salient states: the U.S., Iran, Russia, ... If computers worldwide are mostly secure, which see the greatest benefit? If they're a festering pile of vulnerabilities, which see the greatest cost? That's the choice, as U.S. policy, of where you can focus your efforts. It's not a choice of secure U.S. computers and insecure Russian ones. The way you're framing it presumes SIGINT is in charge and positively welcomes insecure U.S. computers. I'm saying that's bad for us. I've seen others saying the same. Also, secure computers would not make spying go away, and SIGINT would not be impotent. Its powers are still increasing with, e.g., surveillance of whole populations from the air with high-res video cameras. Comms spying would go back to retail instead of wholesale data collection.
    - lern_too_spel 10y ago
      > The way you're framing it presumes SIGINT is in charge. You fundamentally misunderstood my post, whiis causing you to reach strange conclusions. Neither is "in charge." They are two separate entities with separate missions. Some of the systems developed and documented by IA make the job of SIGINT difficult if our adversaries implement them as well. How would spying from the air have prevented Iran from developing it's nuclear program?
arca_vorago 10y ago
>Which is what exactly? The fact that the three letters are continuously failing to understand the long term blowback potential of the programs they start, regardless of initial merit. In this case, instead of spending nearly as much time doing hardening documents, they were busy comprimising everything. The name of almost all of our fuckups in this arena is blowback. >I don't see how exploiting backdoors by your security agency is so nefarious When they use them for lawful purposes, such of foreign sigint, ok. With that kind of power though, at a bare minimum I would be concerned about abuses of that power domestically. At a minimum. I could wax on about all the reasons it could be bad for a long time. >How about congressional, judicial and executive oversight? Because that's what we have now. That's exactly what I said was needed. A technocratic oversight committe could exist in all branches on this subject. Also, we really don't have good oversight in place. Think about the kind of effects this has on potential oversight bodies... For example, the chairman on the senate intel committee is about to vote for more oversight of $secretprogram. It's imperative to national security that this program not receive scrutiny, so it's allowed to use these 0days against them, find or plant blackmail material, and exploit that to get the chairman of oversight to not do it. This is the kind of shit I was talking about having been warning people about. It's not just about the surveillance. Surveillance is always about control, not security, security is just the bullshit they sell the public to not induce outcry.
- freeflight 10y ago
  >For example, the chairman on the senate intel committee is about to vote for more oversight of $secretprogram. People's memories are way too short with this kind of stuff because something like this already happened: The CIA hacked the computers of the senate oversight committee responsible for investigating the CIAs record of torture. https://www.theguardian.com/world/2014/jul/31/cia-admits-spying-senate-staffers https://www.theguardian.com/world/2014/jul/31/cia-admits-spy...
  - jessaustin 10y ago
    That's just the time they got caught. We can be sure they do this constantly.
LoSboccacc 10y ago
> I don't see how exploiting backdoors by your security agency is so nefarious. Did you ever hear the tragedy of Stuxnet the wise? Stuxnet was a cyberweapon so powerful and so well hidden it could use computers to cause nuclear centrifuges to fail. Unfortunately, others learned from code the worm left behind, then other actors used the same techniques to infiltrate computers everywhere for a year. Ironic. It could save the world from nuclear weapons, but not computers.

losteric 10y ago

The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy... But it does beg the question: who's protecting our information from foreign intrusions?

macspoofing 10y ago
Isn't that partly the mission statement of the NSA and CIA and FBI?
- losteric 10y ago
  The CIA and NSA are externally oriented. Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution. We need an organization focused on preemptively securing our infrastructure.
  - knowaveragejoe 10y ago
    The NSA is actually tasked with that mission: > NSA is concurrently charged with protection of U.S. government communications and information systems against penetration and network warfare. https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency
    - losteric 10y ago
      Yes, government defense. Who protects the rest?
      - jessaustin 10y ago
        Private entities protect themselves and their customers, to varying degrees, which is how it has always been.
      - knowaveragejoe 10y ago
        That actually overlaps with things like the power grid and ATC, for what it's worth. It's a little bigger than just "government computers".
jimnotgym 10y ago
Before this runs the risk of becoming a universally acknowledged truth, is it fine? Actually wasn't "Gentlemen don't open each other mail", also a perfectly reasonable position? In the cyberwar the US already seems to be fighting against its own weapons! Would it actually be much better for a nation like the US to use its knowledge defensively and keep their citizens safe from foreign interference?
- losteric 10y ago
  I also strongly advocate for information disclosure and collaborating with vendors. However, I'm not convinced the NSA is the entity for that role. Organizationally, the NSA makes more sense as an R&D entity that discloses to offensive intelligence agencies and defensive security forces.

mannigfaltig 10y ago

> Which is what exactly? That a spy agency is spying? To spell it out: backdoors are of course a helpful tool for a security agency, but once the key for the backdoors falls into the wrong hands the potential for misuse is monstrous because, well, the backdoors are in all kinds of potentially critical systems systems, e.g. even in the cellphones of high ranking officials (or in cellphones of their families) etc. To get the same intel by different means than a backdoor is of course much more expensive. So one needs to find the sweet spot, where the utility as a function of cost and security is maximized. That sweet spot likely does not involve backdoors.

abecedarius 10y ago

> literally why they were created to do The NSA is supposed to do both defense and offense. The defense came up, for example, when they improved DES to resist differential cryptanalysis (which the public crypto world hadn't discovered yet) before DES was standardized. But that was a long time ago; at least since 9/11 the offense side seems to have pretty much eaten the defense, as far as we can tell. (See: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG) I believe this newer strategy is badly misplaced from the standpoint of the security of the American people (and good for the power of security-state insiders).

lern_too_spel 10y ago
If the IA department in the NSA were smart enough to figure out every vulnerability that the SIGINT department discovered and got everything fixed, SIGINT would be impotent. Clearly, things like SELinux make SIGINT's job harder, but your suggestion that SIGINT should handicap itself is ludicrous on its face.
- abecedarius 10y ago
  Consider a few salient states: the U.S., Iran, Russia, ... If computers worldwide are mostly secure, which see the greatest benefit? If they're a festering pile of vulnerabilities, which see the greatest cost? That's the choice, as U.S. policy, of where you can focus your efforts. It's not a choice of secure U.S. computers and insecure Russian ones. The way you're framing it presumes SIGINT is in charge and positively welcomes insecure U.S. computers. I'm saying that's bad for us. I've seen others saying the same. Also, secure computers would not make spying go away, and SIGINT would not be impotent. Its powers are still increasing with, e.g., surveillance of whole populations from the air with high-res video cameras. Comms spying would go back to retail instead of wholesale data collection.
  - lern_too_spel 10y ago
    > The way you're framing it presumes SIGINT is in charge. You fundamentally misunderstood my post, whiis causing you to reach strange conclusions. Neither is "in charge." They are two separate entities with separate missions. Some of the systems developed and documented by IA make the job of SIGINT difficult if our adversaries implement them as well. How would spying from the air have prevented Iran from developing it's nuclear program?

arca_vorago 10y ago

>Which is what exactly? The fact that the three letters are continuously failing to understand the long term blowback potential of the programs they start, regardless of initial merit. In this case, instead of spending nearly as much time doing hardening documents, they were busy comprimising everything. The name of almost all of our fuckups in this arena is blowback. >I don't see how exploiting backdoors by your security agency is so nefarious When they use them for lawful purposes, such of foreign sigint, ok. With that kind of power though, at a bare minimum I would be concerned about abuses of that power domestically. At a minimum. I could wax on about all the reasons it could be bad for a long time. >How about congressional, judicial and executive oversight? Because that's what we have now. That's exactly what I said was needed. A technocratic oversight committe could exist in all branches on this subject. Also, we really don't have good oversight in place. Think about the kind of effects this has on potential oversight bodies... For example, the chairman on the senate intel committee is about to vote for more oversight of $secretprogram. It's imperative to national security that this program not receive scrutiny, so it's allowed to use these 0days against them, find or plant blackmail material, and exploit that to get the chairman of oversight to not do it. This is the kind of shit I was talking about having been warning people about. It's not just about the surveillance. Surveillance is always about control, not security, security is just the bullshit they sell the public to not induce outcry.

freeflight 10y ago
>For example, the chairman on the senate intel committee is about to vote for more oversight of $secretprogram. People's memories are way too short with this kind of stuff because something like this already happened: The CIA hacked the computers of the senate oversight committee responsible for investigating the CIAs record of torture. https://www.theguardian.com/world/2014/jul/31/cia-admits-spying-senate-staffers https://www.theguardian.com/world/2014/jul/31/cia-admits-spy...
- jessaustin 10y ago
  That's just the time they got caught. We can be sure they do this constantly.

LoSboccacc 10y ago

> I don't see how exploiting backdoors by your security agency is so nefarious. Did you ever hear the tragedy of Stuxnet the wise? Stuxnet was a cyberweapon so powerful and so well hidden it could use computers to cause nuclear centrifuges to fail. Unfortunately, others learned from code the worm left behind, then other actors used the same techniques to infiltrate computers everywhere for a year. Ironic. It could save the world from nuclear weapons, but not computers.