13 ms·

So we are investing dollars in NSA so they make tools that bring us damage? I think there should be a limit on how long they can keep their "secrets". Snowden a

So we are investing dollars in NSA so they make tools that bring us damage? I think there should be a limit on how long they can keep their "secrets". Snowden already showed that information can go outside, so any information will be leaked at some time. The society has much more to win when the software defects are repaired instead of used for hacking. I think that all these NSA problems show bad management. They should be reorganized, or maybe even abandoned. They cost more than they deliver, and even costed us our privacy. Probably they are still breaking US and international laws on that. Breaking up NSA can allow the FBI and (open) security companies to take over the cybersecurity. I suspect that we will soon have leaks of CIA tools too. But thanks to wikileaks companies can prepare for these future problems. We can go deeper into who got these tools and who is using them. Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future. The article mentions the popular political scapegoats, and as usual this is just speculation. To solve NSA's problem we have to request very concrete evidence, otherwise we are just being played with. Article: > The Shadow Brokers resurfaced last month, promising a fresh load of N.S.A. attack tools, even offering to supply them for monthly paying subscribers — like a wine-of-the-month club for cyberweapon enthusiasts. This shows how we are being played with. The NSA could already have published the security details of all leaked tools, so we could all have protected our computer systems. We could have prevented Wannacry.

SomeStupidPoint 9y ago
The NSA did contact the appropriate vendor in time to patch WannaCry. People didn't (or couldn't) update their systems with the appropriate patch.
wybiral 9y ago
> Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future. Some may argue a lot of things that may or may not be true. This will probably always be an issue so long as there are classified operations... Everyone who isn't privy will have their own interpretation of what really happened.
jlgaddis 9y ago
> I suspect that we will soon have leaks of CIA tools too. All of the stuff recently leaked by Wikileaks (including today) was from CIA.
- imron 9y ago
  But they purposefully didn't release the tools or the source code for the tools, despite receiving them.
adekok 9y ago
> I think that all these NSA problems show bad management. They should be reorganized, or maybe even abandoned. They cost more than they deliver, and even costed us our privacy. I.e. the average citizen. Q: Is the NSA there to support the average citizen, or are they there to support the bureaucracy / power structures? Q: depending on the previous answer, does your security or privacy matter to the NSA? >Probably they are still breaking US and international laws on that. Do the people who enforce the law get punished when they break it? On the whole, I don't think that's a clear "Yes". More of a "maybe, sometimes".
- pbhjpbhj 9y ago
  >Do the people who enforce the law get punished when they break it? In a democracy they do ...
  - johnvonneumann 9y ago
    In theory, yes. In practice, no.
  - WJW 9y ago
    Democracy is technically orthogonal to this issue. If the rule of law is firmly established in the country, people who do illegal things get punished. This is equally possible in well-organized dictatorships as in democracies. I will grant that there is a strong correlation between (the presence of) rule of law and democracy, but it's debatable in which way a causal relationship might flow or if they might both be caused by something else. (For example, economic prosperity seems to help)
    - pbhjpbhj 9y ago
      Surely a dictatorship is necessarily contrary to rule of law as at least one person is not bound by the law? Meanwhile, in a democracy, I can see you could have group not under the rule of law _iff_ any actions they take do not impact anyone who is going by the law, including an impact such as "gives an advantage or benefit to those under the law can't get". Otherwise the government whilst possibly being "by the people" would no longer be "for the people" but instead "for the preferred classes". You could maybe finagle something that some people could do, that was illegal for others, but doesn't give the first group any benefit. But I don't think you can practically; so practically then democracy would be predicated on rule of law even if not technically required.
nyolfen 9y ago
>This shows how we are being played with. The NSA could already have published the security details of all leaked tools, so we could all have protected our computer systems. We could have prevented Wannacry. NSA did exactly what you said and went to MS months before wcry hit, once it was clear what shadowbrokers had, in order to patch the vulnerability that wcry exploited: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... unfortunately, not everyone keeps their systems totally up to date for various reasons.
- athenot 9y ago
  > unfortunately, not everyone keeps their systems totally up to date for various reasons Because patching requires a quick risk calculation. Should I patch to the bleeding edge and get the latests security but risk a regression bug, or do I wait a bit so I can run a full regression test? On my machines, sure I like to stay on the latest and greatest. But I'm sure there are plenty of companies that got bitten because some critical software they rely on didn't play well with the latest OS upgrade. Blame game notwithstanding, it comes down to a business disruption risk. Of course, the right answer is to test the patches as they come out in a non-production environment, and go from there based on results. But I can see where some companies wouldn't have the resources devoted to do that on a frequent basis, which is unfortunate.
  - sillysaurus3 9y ago
    Similar to this, I didn't patch my OS X laptop for something like three months because the darn update was a firmware update. It said something along the lines of "Make sure your laptop doesn't lose power, and make sure you have a full backup before starting." Uh-huh. I do have a full backup, but clicking that "Later" button was far more valuable than dealing with the 0.001% chance of disaster. And I'm a security guy. If I don't care enough to update every day, what do other people do? (There's not much reason to keep a personal laptop up to date when you're not interesting enough to be targeted and not in the habit of running random internet programs. Or rather, a few months of lag is fine, as long as you're paying attention to what the updates are for.) I think we just don't like to acknowledge the fact that updates sort of suck, yet we bash people and shame them for not doing them. I mean, we don't have many other tools to force them to update, but surprise surprise when people are just concealing the fact that they don't update at all. Even in corporate settings.
nobodyorother 9y ago
I've just been waiting for someone to send them a bill. How much money have their tools cost folks in time, money, hardware, and personnel, even in just the last year? How much money have their unpatched exploits cost? How's that all compare to their (mostly undocumented) annual budget, anyway?

SomeStupidPoint 9y ago

The NSA did contact the appropriate vendor in time to patch WannaCry. People didn't (or couldn't) update their systems with the appropriate patch.

wybiral 9y ago

> Some may even argue that the CIA leaked the NSA tools to weaken the NSA. Or worse, that some in the NSA want to create cyber chaos to push for more control over the internet in the future. Some may argue a lot of things that may or may not be true. This will probably always be an issue so long as there are classified operations... Everyone who isn't privy will have their own interpretation of what really happened.

jlgaddis 9y ago

> I suspect that we will soon have leaks of CIA tools too. All of the stuff recently leaked by Wikileaks (including today) was from CIA.

imron 9y ago
But they purposefully didn't release the tools or the source code for the tools, despite receiving them.

adekok 9y ago

> I think that all these NSA problems show bad management. They should be reorganized, or maybe even abandoned. They cost more than they deliver, and even costed us our privacy. I.e. the average citizen. Q: Is the NSA there to support the average citizen, or are they there to support the bureaucracy / power structures? Q: depending on the previous answer, does your security or privacy matter to the NSA? >Probably they are still breaking US and international laws on that. Do the people who enforce the law get punished when they break it? On the whole, I don't think that's a clear "Yes". More of a "maybe, sometimes".

pbhjpbhj 9y ago
>Do the people who enforce the law get punished when they break it? In a democracy they do ...
- johnvonneumann 9y ago
  In theory, yes. In practice, no.
- WJW 9y ago
  Democracy is technically orthogonal to this issue. If the rule of law is firmly established in the country, people who do illegal things get punished. This is equally possible in well-organized dictatorships as in democracies. I will grant that there is a strong correlation between (the presence of) rule of law and democracy, but it's debatable in which way a causal relationship might flow or if they might both be caused by something else. (For example, economic prosperity seems to help)
  - pbhjpbhj 9y ago
    Surely a dictatorship is necessarily contrary to rule of law as at least one person is not bound by the law? Meanwhile, in a democracy, I can see you could have group not under the rule of law _iff_ any actions they take do not impact anyone who is going by the law, including an impact such as "gives an advantage or benefit to those under the law can't get". Otherwise the government whilst possibly being "by the people" would no longer be "for the people" but instead "for the preferred classes". You could maybe finagle something that some people could do, that was illegal for others, but doesn't give the first group any benefit. But I don't think you can practically; so practically then democracy would be predicated on rule of law even if not technically required.

nyolfen 9y ago

>This shows how we are being played with. The NSA could already have published the security details of all leaked tools, so we could all have protected our computer systems. We could have prevented Wannacry. NSA did exactly what you said and went to MS months before wcry hit, once it was clear what shadowbrokers had, in order to patch the vulnerability that wcry exploited: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... unfortunately, not everyone keeps their systems totally up to date for various reasons.

athenot 9y ago
> unfortunately, not everyone keeps their systems totally up to date for various reasons Because patching requires a quick risk calculation. Should I patch to the bleeding edge and get the latests security but risk a regression bug, or do I wait a bit so I can run a full regression test? On my machines, sure I like to stay on the latest and greatest. But I'm sure there are plenty of companies that got bitten because some critical software they rely on didn't play well with the latest OS upgrade. Blame game notwithstanding, it comes down to a business disruption risk. Of course, the right answer is to test the patches as they come out in a non-production environment, and go from there based on results. But I can see where some companies wouldn't have the resources devoted to do that on a frequent basis, which is unfortunate.
- sillysaurus3 9y ago
  Similar to this, I didn't patch my OS X laptop for something like three months because the darn update was a firmware update. It said something along the lines of "Make sure your laptop doesn't lose power, and make sure you have a full backup before starting." Uh-huh. I do have a full backup, but clicking that "Later" button was far more valuable than dealing with the 0.001% chance of disaster. And I'm a security guy. If I don't care enough to update every day, what do other people do? (There's not much reason to keep a personal laptop up to date when you're not interesting enough to be targeted and not in the habit of running random internet programs. Or rather, a few months of lag is fine, as long as you're paying attention to what the updates are for.) I think we just don't like to acknowledge the fact that updates sort of suck, yet we bash people and shame them for not doing them. I mean, we don't have many other tools to force them to update, but surprise surprise when people are just concealing the fact that they don't update at all. Even in corporate settings.

nobodyorother 9y ago

I've just been waiting for someone to send them a bill. How much money have their tools cost folks in time, money, hardware, and personnel, even in just the last year? How much money have their unpatched exploits cost? How's that all compare to their (mostly undocumented) annual budget, anyway?