5 ms·

I know we should always assume good faith. From all the vulnerabilities they know, they chose to publish one that's known and only concerns outdated software.

I know we should always assume good faith. From all the vulnerabilities they know, they chose to publish one that's known and only concerns outdated software. Maybe I'm too skeptical but when the NSA starts leaking fixes for zero day exploits, I'll take them more seriously.

bob_doggo 7y ago
I can't exactly say that I trust NSA, and I don't doubt that they have knowledge of vulnerabilities that they aren't releasing. But I still don't see how that could be a reason to not take this warning seriously. I think that the cynical view of this would rather be that they consider the potential harm from someone they don't like, making a 1m machines botnet from this, to be greater that the benefit they get from themselves making a 1m machines botnet.
- nocturnial 7y ago
  Maybe you're right and I'm too cynical, but I see this more like a PR piece to attract talent to their organization. I think the NSA has a real image problem. They released ghidra. They admitted it was a recruitment tool. They now release this warning which basically tells us to update our software. Anyways, if they really want to improve their image, they need to release zero day exploits and prove it's not just an offensive but also a defensive agency. The release of an exploitable bug might deny them a couple of targets but will protect millions.
save_ferris 7y ago
That’s kinda like saying you’ll only take google seriously when they start releasing their SERP algorithms. Zero-days are far more useful to them as exploitable points of entry as opposed to patches.
- CWuestefeld 7y ago
  That suggests to me that there's a conflict of interest in the NSA's mission. Perhaps it's not wise to have the same organization looking after both the defensive aspects of our security, AND also offensive espionage operations.
sigmar 7y ago
Why would they leak vulnerabilities they've spent millions of dollars to find? Seems like that would be a waste of money with zero benefit to their mission.
- deleted 7y ago
  [deleted]

bob_doggo 7y ago

I can't exactly say that I trust NSA, and I don't doubt that they have knowledge of vulnerabilities that they aren't releasing. But I still don't see how that could be a reason to not take this warning seriously. I think that the cynical view of this would rather be that they consider the potential harm from someone they don't like, making a 1m machines botnet from this, to be greater that the benefit they get from themselves making a 1m machines botnet.

nocturnial 7y ago
Maybe you're right and I'm too cynical, but I see this more like a PR piece to attract talent to their organization. I think the NSA has a real image problem. They released ghidra. They admitted it was a recruitment tool. They now release this warning which basically tells us to update our software. Anyways, if they really want to improve their image, they need to release zero day exploits and prove it's not just an offensive but also a defensive agency. The release of an exploitable bug might deny them a couple of targets but will protect millions.

save_ferris 7y ago

That’s kinda like saying you’ll only take google seriously when they start releasing their SERP algorithms. Zero-days are far more useful to them as exploitable points of entry as opposed to patches.

CWuestefeld 7y ago
That suggests to me that there's a conflict of interest in the NSA's mission. Perhaps it's not wise to have the same organization looking after both the defensive aspects of our security, AND also offensive espionage operations.

sigmar 7y ago

Why would they leak vulnerabilities they've spent millions of dollars to find? Seems like that would be a waste of money with zero benefit to their mission.

deleted 7y ago
[deleted]