4 ms·
Of course not. The NSA didn’t put those vulnerabilities there. If we want to start pointing fingers, the first point of liability would be with whoever released
by lawnchair_larry 7y ago
Of course not. The NSA didn’t put those vulnerabilities there. If we want to start pointing fingers, the first point of liability would be with whoever released the vulnerable software.
- lapinot 7y agoI do and you probably do too. Of course we can fantasize that these vulns have been planted, maybe even a couple have been. But most of them are probably just uncaught mistakes and subtle semantic errors. I believe in proving software (and other stuff) correct, but that doesn't mean we'll arrive at some point to the one true software. The problem is about defining formally what it is to be correct, having a model that encompasses all things you care about. You can't blame people for writing faulty software and shipping exploitable hardware, that's just what one does. I think it makes sense to blame people for discovering exploits and not disclosing them properly tho. That's what one is expected to do... Some wishful thinking: let's hope the US will see that the only move with positive outcome is to start a global disarmament initiative. We seem to have forgotten the days of fighting for de-weaponizing encryption, this should apply to cyber-security in general.