28 ms·

You don't see the difference between a random bug and one that a state agency discovered, stockpiled, then misplaced, and in any case held secret? I think you

You don't see the difference between a random bug and one that a state agency discovered, stockpiled, then misplaced, and in any case held secret? I think you are just missing the entire discussion that this article is about.

tptacek 7y ago
I do not, that is correct. Perhaps you could explain it to me.
- criddell 7y ago
  If some terrorist group managed to detonate a bomb on US soil, don't you think it would be more outrageous if were discovered that the bomb belonged to the US military?
  - scarejunba 7y ago
    I think his argument is that these bombs are readily available. US military-style bombs are not that easily available which is why it’s not a big deal. If you could practically get one of those things at the corner store, the fact that it was US military is more coincidence than real problem.
    - criddell 7y ago
      > the fact that it was US military is more coincidence than real problem No, that's the entire point of my example. The military's primary job is to defend us. It's a major failure when their weapons are used against US citizens.
      - tptacek 7y ago
        The point of my comment, at the root of this thread, is that calling these things "military weapons" is misleading; there's no real difference between this Win8 SMB bug and any of a whole variety of bugs that were discovered and exploited by private actors just in these last 12 months alone. If you accept the premise of the article, that these were "broken arrow" military weapons, sure, I see how you can get yourself into a tizzy over it. But you should not accept the article's premise, because that premise seems self-evidently broken.
      - acct1771 7y ago
        The military's primary job is to protect themselves. Then political goals of their superiors. Sometimes those two are reversed. Then comes us.
    - belorn 7y ago
      Back in 1945 a bunch of countries realized that they had unnecessary huge stockpile of bombs, mines, and chemical weapons after the war. It would had been a real shame if bad actors would pick them up, bad enough that most of it was dumped into the ocean. Taking a minor look into history and we can easily find what happens with larger stockpiles of weapons if they don't get destroyed after wars (or cold wars). They get stolen or sold. They get used for new purposes which originally they never was intended for. I find it a fair case to argue that countries who do not destroy their large stockpiles once the war end are to a degree responsible when the weapons are reused in later conflicts outside their border by people we would classify as bad actors.
- atmosx 7y ago
  A state organization IMO should protect the public interest. If anything the NSA should be releasing CVEs and protecting US companies by patching their systems. I don’t understand what service exactly does the NSA (and similar intelligence agencies elsewhere) provide to their public by hiding vulnerabilities from the public. Does the victim of a hack that the NSA could have crates pay taxes? What for???
  - tptacek 7y ago
    More than half the NSA's actual, chartered job, and the part of NSA's job that precedes every other job to which it has been assigned, is to collect signals intelligence from foreign states. Modern SIGINT involves exploits. Publishing exploits, even after you're done using them, harms that mission. Does that appropriately answer the "what for???" question? A reasonable complaint about NSA is that the IAD (defensive) mission doesn't belong in the same agency as SIGINT or TAO or whatever they're calling it now. But that doesn't have much to do with this story; the SIGINT mission of any major government is going to (1) collect exploits and (2) almost never publish them, because that's how SIGINT is done. NSA collecting exploits doesn't prevent anyone else from discovering and reporting the same vulnerabilities. So maybe your complaint is that we're not funding enough defensive vulnerability research?
    - atmosx 7y ago
      That could go a long way. My point is the NSA and foreign counterparts do a disservice to their citizens. I would see the value in publishing vulnerabilities, I don’t see value for taxpayers in what they are doing now.

tptacek 7y ago

I do not, that is correct. Perhaps you could explain it to me.

criddell 7y ago
If some terrorist group managed to detonate a bomb on US soil, don't you think it would be more outrageous if were discovered that the bomb belonged to the US military?
- scarejunba 7y ago
  I think his argument is that these bombs are readily available. US military-style bombs are not that easily available which is why it’s not a big deal. If you could practically get one of those things at the corner store, the fact that it was US military is more coincidence than real problem.
  - criddell 7y ago
    > the fact that it was US military is more coincidence than real problem No, that's the entire point of my example. The military's primary job is to defend us. It's a major failure when their weapons are used against US citizens.
    - tptacek 7y ago
      The point of my comment, at the root of this thread, is that calling these things "military weapons" is misleading; there's no real difference between this Win8 SMB bug and any of a whole variety of bugs that were discovered and exploited by private actors just in these last 12 months alone. If you accept the premise of the article, that these were "broken arrow" military weapons, sure, I see how you can get yourself into a tizzy over it. But you should not accept the article's premise, because that premise seems self-evidently broken.
    - acct1771 7y ago
      The military's primary job is to protect themselves. Then political goals of their superiors. Sometimes those two are reversed. Then comes us.
  - belorn 7y ago
    Back in 1945 a bunch of countries realized that they had unnecessary huge stockpile of bombs, mines, and chemical weapons after the war. It would had been a real shame if bad actors would pick them up, bad enough that most of it was dumped into the ocean. Taking a minor look into history and we can easily find what happens with larger stockpiles of weapons if they don't get destroyed after wars (or cold wars). They get stolen or sold. They get used for new purposes which originally they never was intended for. I find it a fair case to argue that countries who do not destroy their large stockpiles once the war end are to a degree responsible when the weapons are reused in later conflicts outside their border by people we would classify as bad actors.
atmosx 7y ago
A state organization IMO should protect the public interest. If anything the NSA should be releasing CVEs and protecting US companies by patching their systems. I don’t understand what service exactly does the NSA (and similar intelligence agencies elsewhere) provide to their public by hiding vulnerabilities from the public. Does the victim of a hack that the NSA could have crates pay taxes? What for???
- tptacek 7y ago
  More than half the NSA's actual, chartered job, and the part of NSA's job that precedes every other job to which it has been assigned, is to collect signals intelligence from foreign states. Modern SIGINT involves exploits. Publishing exploits, even after you're done using them, harms that mission. Does that appropriately answer the "what for???" question? A reasonable complaint about NSA is that the IAD (defensive) mission doesn't belong in the same agency as SIGINT or TAO or whatever they're calling it now. But that doesn't have much to do with this story; the SIGINT mission of any major government is going to (1) collect exploits and (2) almost never publish them, because that's how SIGINT is done. NSA collecting exploits doesn't prevent anyone else from discovering and reporting the same vulnerabilities. So maybe your complaint is that we're not funding enough defensive vulnerability research?
  - atmosx 7y ago
    That could go a long way. My point is the NSA and foreign counterparts do a disservice to their citizens. I would see the value in publishing vulnerabilities, I don’t see value for taxpayers in what they are doing now.