6 ms·

> The agency regarded as the world’s leader in breaking into adversaries’ computer networks failed to protect its own. Those are two very different things. Foc

by sebcat 9y ago

> The agency regarded as the world’s leader in breaking into adversaries’ computer networks failed to protect its own. Those are two very different things. Focusing on one of them doesn't automatically benefit your efforts on the other.

noobermin 9y ago
The hope is that one's level of expertise in those areas are correlated.
magicalist 9y ago
> Focusing on one of them doesn't automatically benefit your efforts on the other. Uh, yeah. It isn't saying, "why did defense fail to automatically follow from offense?" It's literally just saying they failed to protect their own network, whether technically or organizationally.
chiefalchemist 9y ago
I don't think I see it that way. If you have the best then you should test your systems against being exploited by the best. And then harden from there. If you have the knowledge - knowing you're a prome target- why not double its value? As it is, their approach strikes me as one of arrogance, or (ironically) lack of intelligence about foreign threats, or worse...both. Both is not what we're paying them for.
kevin_thibedeau 9y ago
NSA is also responsible for establishing computer security practices for the rest of the government to follow. That they don't eat their own dogfood is damning.
- meowface 9y ago
  They do typically eat their own dogfood when it comes to the security practices they propose. Dual_EC_DRBG is the big exception, but it's generally considered that most of the rest of their cryptographic standards are secure and suitable for public and government use. There are likely many conflicting departments and teams within NSA. Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk.
  - retailbuyout 9y ago
    > Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk. Directly at odds. I don’t believe you should encourage anyone to trust known espionage. If it’s good advice, someone else will say it too you can trust independently.
- fujiters 9y ago
  We should also keep in mind that finding an exploit or two is much easier than making sure that nothing on your network can be exploited. I wouldn't expect even the best in the world to be able to thwart all attacks.

by sebcat 9y ago

noobermin 9y ago

The hope is that one's level of expertise in those areas are correlated.

magicalist 9y ago

> Focusing on one of them doesn't automatically benefit your efforts on the other. Uh, yeah. It isn't saying, "why did defense fail to automatically follow from offense?" It's literally just saying they failed to protect their own network, whether technically or organizationally.

chiefalchemist 9y ago

I don't think I see it that way. If you have the best then you should test your systems against being exploited by the best. And then harden from there. If you have the knowledge - knowing you're a prome target- why not double its value? As it is, their approach strikes me as one of arrogance, or (ironically) lack of intelligence about foreign threats, or worse...both. Both is not what we're paying them for.

kevin_thibedeau 9y ago

NSA is also responsible for establishing computer security practices for the rest of the government to follow. That they don't eat their own dogfood is damning.

meowface 9y ago
They do typically eat their own dogfood when it comes to the security practices they propose. Dual_EC_DRBG is the big exception, but it's generally considered that most of the rest of their cryptographic standards are secure and suitable for public and government use. There are likely many conflicting departments and teams within NSA. Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk.
- retailbuyout 9y ago
  > Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk. Directly at odds. I don’t believe you should encourage anyone to trust known espionage. If it’s good advice, someone else will say it too you can trust independently.
fujiters 9y ago
We should also keep in mind that finding an exploit or two is much easier than making sure that nothing on your network can be exploited. I wouldn't expect even the best in the world to be able to thwart all attacks.