4 ms·

The point is that there would be fewer cyber attacks, both because the NSA itself would no longer be adding to the number of hacks and because the NSA would use

by 3131s 9y ago

The point is that there would be fewer cyber attacks, both because the NSA itself would no longer be adding to the number of hacks and because the NSA would use their sizeable budget to discover and disclose vulnerabilities, presumably making all of us safer.

thoth 9y ago
Their budget is sizeable but less than the annual profits of Google, Microsoft, Apple, etc. And NSA pays for tons of stuff that those corporations don't have to deal with like having thousands of linguists. Where is the responsibility of corporations in all of this? They have a cash pile that dwarfs the entire intel budget and ought to be the FIRST entities that invest in fixing their OWN products, right?
- noir_lord 9y ago
  > Where is the responsibility of corporations in all of this? Somewhere around here :- > "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!" Sorry shareholders, you'll be getting a tiny dividend this year because we are spending a huge part of our 'profit' on backfixing all the shit we let slide said no CEO ever.
willstrafach 9y ago
> because the NSA would use their sizeable budget to discover and disclose vulnerabilities Right now, the process is: 1. Find a way to survey the target environment, learn what software and hardware they are running 2. Acquire vulnerabilities to exploit the known target software/hardware, either from a third-party, a contractor, or manual reverse engineering of those specific components. 3. Adapt mission specific payloads to use on the target. 4. Use for as long as needed. 5. Disclose to vendor after the purpose is served. If the agency mission changed to be purely about discovery and reporting, that might not help the general public. If this were to happen, it seems like the focus would likely be on protection of only software/hardware in classified systems, as that is already their defensive mission. Instead of having things like EternalBlue patched we would have them open and available for a different party to discover. That seems worrisome to me, but I am really curious to know if you might have a different take on how this would work.

by 3131s 9y ago

thoth 9y ago

Their budget is sizeable but less than the annual profits of Google, Microsoft, Apple, etc. And NSA pays for tons of stuff that those corporations don't have to deal with like having thousands of linguists. Where is the responsibility of corporations in all of this? They have a cash pile that dwarfs the entire intel budget and ought to be the FIRST entities that invest in fixing their OWN products, right?

noir_lord 9y ago
> Where is the responsibility of corporations in all of this? Somewhere around here :- > "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!" Sorry shareholders, you'll be getting a tiny dividend this year because we are spending a huge part of our 'profit' on backfixing all the shit we let slide said no CEO ever.

willstrafach 9y ago

> because the NSA would use their sizeable budget to discover and disclose vulnerabilities Right now, the process is: 1. Find a way to survey the target environment, learn what software and hardware they are running 2. Acquire vulnerabilities to exploit the known target software/hardware, either from a third-party, a contractor, or manual reverse engineering of those specific components. 3. Adapt mission specific payloads to use on the target. 4. Use for as long as needed. 5. Disclose to vendor after the purpose is served. If the agency mission changed to be purely about discovery and reporting, that might not help the general public. If this were to happen, it seems like the focus would likely be on protection of only software/hardware in classified systems, as that is already their defensive mission. Instead of having things like EternalBlue patched we would have them open and available for a different party to discover. That seems worrisome to me, but I am really curious to know if you might have a different take on how this would work.