8 ms·
If the US government gives itself the right to install backdoors / exploit vulnerable software (as opposed to notifying companies about vulnerabilities) then I
by pizza 8y ago
If the US government gives itself the right to install backdoors / exploit vulnerable software (as opposed to notifying companies about vulnerabilities) then I feel pretty uncomfortable about ex-government hackers just becoming freelance mercenaries using knowledge they may have gleaned from those ops once they move onto their next gig.
I can't think of a great solution to this problem.
- java-man 8y agowe could elect sane leaders...
- floren 8y agoLike Obama? I remember how the NSA was shut down entirely during his tenure, man that was great.
- java-man 8y agophysicist for president! elect Lisa Randall, or Sean Carroll. provided, of course, that they agree.
- x3tm 8y agoMerkel is a physicist. She's great. But then again many physicists were also convinced Nazi officers.
- java-man 8y agoyou mean Heisenberg?
- mikejb 8y ago> But then again many physicists were also convinced Nazi officers. If the Germans would have won the war, we'd probably celebrate those officers :/ All the torture and killing would be spun as "necessary evil" (if it even came to light), and further investigations would be blocked by the government. How we perceive the past is...complicated.
- MrVitaliy 8y agoWhere is this love for NSA coming from?
- deleted 8y ago[deleted]
- x3tm 8y agoOr how he shutdown the drones gaming unit, and his constant efforts towards peace in the middle east by refusing to destabilize countries, etc. Great man.
- vuln 8y agoI also remember his campaign to reign in 'bush era spying' over the next 8 years the knob was turned to 11. I don't expect much from a person that won a Noble piece prize then proceeded to drop 26,000 bombs in 2016 a bomb every 20 minutes. https://www.theguardian.com/commentisfree/2017/jan/09/america-dropped-26171-bombs-2016-obama-legacy https://www.theguardian.com/commentisfree/2017/jan/09/americ...
- Angostura 8y agoAs a matter of interest, do you believe that the sane option is to shut down the NSA entirely?
- LinuxBender 8y agoleaders are well insulated from such knowledge for their (legal) safety.
- thatcat 8y agoThe president is immune from legal liability.
- LinuxBender 8y agoI was including all leaders. The president is just one of them. None of them have nearly the level of knowledge we give them credit for.
- tomschlick 8y agoAnd that's a novel idea when they are on the campaign trail... until they start getting daily national security briefings and learn about the attempted attacks supposedly foiled by good SIGINT. No one wants to be the president who turns that firehose off and "causes the next 9/11". I believe that is what happened with Obama.
- 794CD01 8y agoThat's a pretty outrageous claim. Do you have any evidence this is possible?
- kaybe 8y agoNo ethical one at least.
- deleted 8y ago[deleted]
- cryptonector 8y agoYou can make it illegal for ex-NSA employees to use their knowledge of exploits learned while on the NSA payroll. It may well already be the case for all I know.
- acct1771 8y agoPerfect. Then, just hope people follow rules.
- smolder 8y agoSometimes you have to disincentivize behavior with prison time and things like that and then hope people don't do it. Trying to prevent some crimes ahead of time is a recipe for dystopia.
- AgentME 8y agoIn this case, "trying to prevent some crimes [of government employees leaking the golden key]" possibly means "don't make a golden key that lets governments freely hack everyone", which is generally being regarded in this thread as the non-dystopian result.
- dexterdog 8y agoI can't imagine that it is not.
- empath75 8y agoQuitting your job doesn't let you expose classified secrets, no.
- YayamiOmate 8y agoAnd how do you enforce it? Hmm. Wait. Was that sarcasm?
- luxuryballs 8y agohow about we make it illegal to hack into systems unauthorized? oh wait...
- luxuryballs 8y agosounds like maybe they should get a warrant and get legitimate access on an individual basis rather than being allowed to hack everything, you don’t need to hack me if I let you in, it should be just as illegal as it is for them to poke around in my house without a warrant
- TimTheTinker 8y ago> I can't think of a great solution to this problem. There's really only one "final solution" to the problem in the purely technical realm. That would be to make provable security (in the theorem-proving sense) a non-negotiable requirement to all digital logic (both hardware and software) running on networked devices. I don't know if there's even a workable definition that would rigorously describe the goal of such an effort. ... But I believe that if provable security was important enough to everyone (just like "winning the war" in the 1940s or "getting to the moon" in the 1960's), we might possibly achieve it -- at least below the OS syscall level in a few major OSs and in several important userland libraries. However, that ignores the human element of security, which can't ever be completely solved via mere human effort. People will always be vulnerable to social engineering, for example.
- jdsudo 8y ago"final solution" is generally a poor phrase to use: https://en.wikipedia.org/wiki/Final_Solution https://en.wikipedia.org/wiki/Final_Solution
- TimTheTinker 8y agoOh crap, I'm sorry. No reference to that or anything like it was intended!
- deleted 8y ago[deleted]
- iheartpotatoes 8y agoI think your solution needs to extend to the hardware components on the board. High security MCUs go through great lengths to defeat sideband attacks on the package (some really neat stuff too like failing if exposed to die shaving). There are secure bus initiatives but they don't extend to the BOM (bill of materials) for all the components. On top of that, GUI techniques for obscuring physical input (keyboards, UI touches) are needed. Given Apple's posturing and patch release cadence, I think/feel they are on the side of privacy. Android too. We're on the right track, I wonder if eventually tech will win the arms race for exploits like this? (The rubber hose exploit will always work...)
- acqq 8y ago> I can't think of a great solution to this problem. The mentioned government agencies have the "NOBUS" belief: that the concept of "NObody But US" (having access to the "keys to the secrets") works. This article is just one of a many good examples that it doesn't. What could work are just the systems which are secure without any exceptions. Which is hard to achieve when enough powerful influences (most often directly or indirectly tax funded, even if not explicitly government organizations) do all they can to make that not happening. It's then easier than it appears to be to achieve the goals of nobody having an access to a really secure system. An example: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG "In September 2013, The New York Times reported that internal NSA memos leaked by Edward Snowden indicated that the NSA had worked during the standardization process to eventually become the sole editor of the Dual_EC_DRBG standard,[7] and concluded that the Dual_EC_DRBG standard did indeed contain a backdoor for the NSA.[8] As response, NIST stated that "NIST would not deliberately weaken a cryptographic standard."[9] According to the New York Times story, the NSA spends $250 million per year to insert backdoors in software and hardware as part of the Bullrun program.[10]"
- BLKNSLVR 8y agoThe US is Dr. Frankenstein, except they didn't learn their lesson from the first monster they unwittingly released into the world and continue to pump them out.