3 ms·

> Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vu

> Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. While that approach might be effective, the long-term result could be increased distrust of American software companies by other countries, depending on how it's done. I think the primary problems are structural: that (a) a single agency has to act as both red and blue teams, (b) the red team lacks enough oversight to ensure it respects rule of law and civilian civil rights, and (c) the blue team isn't authorized to disclose all its known vulnerabilities to software vendors.

JumpCrisscross 8y ago
> the long-term result could be increased distrust of American software companies by other countries, depending on how it's done America isn't Australia. The NSA hoards bugs in software domestic and foreign alike. One amendment to their charter which might make sense would be installing a public ombudsman. This ombudsman reviews the NSA's vulnerability hoard, takes into account the software's usage in the United States and then makes arguments to senior leadership for selectively releasing them.
- ENOTTY 8y ago
  It seems to me that the public ombudsman role you propose is already played by the other agencies and departments involved in the Vulnerabilities Equities Process https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF https://www.whitehouse.gov/sites/whitehouse.gov/files/images... I would specifically call out Treasury (high dependence of financial sector on publicly available products), OMB (high dependence of government systems on publicly available products), and Commerce (most direct purview of publicly available products) in playing that role.

JumpCrisscross 8y ago

> the long-term result could be increased distrust of American software companies by other countries, depending on how it's done America isn't Australia. The NSA hoards bugs in software domestic and foreign alike. One amendment to their charter which might make sense would be installing a public ombudsman. This ombudsman reviews the NSA's vulnerability hoard, takes into account the software's usage in the United States and then makes arguments to senior leadership for selectively releasing them.

ENOTTY 8y ago
It seems to me that the public ombudsman role you propose is already played by the other agencies and departments involved in the Vulnerabilities Equities Process https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF https://www.whitehouse.gov/sites/whitehouse.gov/files/images... I would specifically call out Treasury (high dependence of financial sector on publicly available products), OMB (high dependence of government systems on publicly available products), and Commerce (most direct purview of publicly available products) in playing that role.