4 ms·

Yes, I'm pretty glad this is around. Hopefully it will lead to less NSA exploits.

by mercurysmessage 9y ago

astrodust 9y ago
The NSA will just have to pay more.
- Fej 9y ago
  They have an almost unlimited budget, as far as we know.
  - monocasa 9y ago
    Eh, I don't know anyone who when faced with managing billions of dollars has said, "OK, this is enough money".
- mercurysmessage 9y ago
  Where the people pay increased taxes to help the NSA spy on them easier.
  - mtgx 9y ago
    That $50+ billion black budget doesn't spend itself.
- tptacek 9y ago
  Which is actually sort of a worst-case scenario (not that I think this bounty is bad), because NSA's primary objective is in fact not to hack all your Windows machines, or even to hack anyone's Windows machine. NSA's primary objective is to secure more budget/headcount for NSA.
  - cperciva 9y ago
    While that's true, the NSA's secondary objective is to be the only people who have an arsenal of exploits. Since they have the largest budget, having the price of exploits go up only helps this goal.
    - tptacek 9y ago
      Right. I don't think bounties like this alarm NSA in any way. In fact, since NSA probably believes it has a practically unlimited capability of acquiring Windows vulnerabilities, the bounty probably helps, by taking the heat off them and the intractable notion of a "vulnerability equities process". I think it's more important to remember the NSA's primary goal in other security conversations. What you really don't want to do is propose protocols that leave plausible-but-difficult attack vectors for NSA, because "plausible-but-difficult" is probably inscribed in Latin on some seal somewhere in Ft. Meade.
    - astrodust 9y ago
      I bet the NSA can and would pay a billion dollars for an exploit that was worth it, but other nation-states would be shut out from bidding simply because they couldn't even if they wanted to. It would taken an extraordinary exploit to be worth that much, but imagine a flaw in some weapons platform used by an aggressor that's impractical or impossible to patch and allows for remote code execution. If the US was trying to fend off an attack, or was embroiled in a conflict where this would be an invaluable asset, could end the conflict overnight, they'd pony up. Like if it could allow them to hack the enemy's radar system to render allied jets invisible, or could corrupt the firmware in anti-aircraft missiles to make them always miss their targets, that would be worth a billion. If it prevented the loss of a few high-value planes it'd pay for itself instantly.

Yes, I'm pretty glad this is around. Hopefully it will lead to less NSA exploits.

astrodust 9y ago

The NSA will just have to pay more.

Fej 9y ago
They have an almost unlimited budget, as far as we know.
- monocasa 9y ago
  Eh, I don't know anyone who when faced with managing billions of dollars has said, "OK, this is enough money".
mercurysmessage 9y ago
Where the people pay increased taxes to help the NSA spy on them easier.
- mtgx 9y ago
  That $50+ billion black budget doesn't spend itself.
tptacek 9y ago
Which is actually sort of a worst-case scenario (not that I think this bounty is bad), because NSA's primary objective is in fact not to hack all your Windows machines, or even to hack anyone's Windows machine. NSA's primary objective is to secure more budget/headcount for NSA.
- cperciva 9y ago
  While that's true, the NSA's secondary objective is to be the only people who have an arsenal of exploits. Since they have the largest budget, having the price of exploits go up only helps this goal.
  - tptacek 9y ago
    Right. I don't think bounties like this alarm NSA in any way. In fact, since NSA probably believes it has a practically unlimited capability of acquiring Windows vulnerabilities, the bounty probably helps, by taking the heat off them and the intractable notion of a "vulnerability equities process". I think it's more important to remember the NSA's primary goal in other security conversations. What you really don't want to do is propose protocols that leave plausible-but-difficult attack vectors for NSA, because "plausible-but-difficult" is probably inscribed in Latin on some seal somewhere in Ft. Meade.
  - astrodust 9y ago
    I bet the NSA can and would pay a billion dollars for an exploit that was worth it, but other nation-states would be shut out from bidding simply because they couldn't even if they wanted to. It would taken an extraordinary exploit to be worth that much, but imagine a flaw in some weapons platform used by an aggressor that's impractical or impossible to patch and allows for remote code execution. If the US was trying to fend off an attack, or was embroiled in a conflict where this would be an invaluable asset, could end the conflict overnight, they'd pony up. Like if it could allow them to hack the enemy's radar system to render allied jets invisible, or could corrupt the firmware in anti-aircraft missiles to make them always miss their targets, that would be worth a billion. If it prevented the loss of a few high-value planes it'd pay for itself instantly.