4 ms·
NSA is resposible for so-called SIGINT and SIGSEC, acronyms for signals intelligence, to which you refer, and signals security, which IS to keep our communicati
by jjtheblunt 7y ago
NSA is resposible for so-called SIGINT and SIGSEC, acronyms for signals intelligence, to which you refer, and signals security, which IS to keep our communications safe.
It seems of course that SIGINT is what's "popular" in news.
- deleted 7y ago[deleted]
- tareqak 7y agoI would argue that such a clear conflict in these two priorities should necessitate having a bespoke separate governmental organization for SIGSEC, so that the NSA can freely focus on SIGINT.
- jjtheblunt 7y agoWhat is the conflict in priorities that you mean? I ask because I considered code breaking and code making complimentary, in the sense they debug one another somewhat. My guess is that this chance to debug one another motivates their coresidence in a single agency.
- greendestiny 7y agoDisclosing vulnerabilities.
- blackflame7000 7y agoThey should definitely disclose vulnerabilities in American made software for SIGSEC. If it’s foreign then not disclosing it would be SIGINT
- kelnos 7y agoThe problem with that is there's a lot of software that's American made that is also used by potential targets of SIGINT.
- ClumsyPilot 7y agoIf the software is foreign made and used in US, americans are still vulnerable. And opensource isn't American/national
- kelnos 7y agoThe SIGINT arm of the NSA has an incentive to take any exploitable vulnerabilities in existing software and keep them secret, so they can use them against their enemies, rather than disclosing them so they can be fixed.
- MikeHolman 7y agoI don't think it's only popular in news. I work on a web platform team, and I've seen many vulnerability reports over the years (well over 100). I've never seen a report from the NSA or US government. Actually, the only government I've seen reports from are the UK, so credit to them for actually doing something to keep people secure. But most reports I see are from project zero or Chinese companies. Either the US government doesn't care at all about browser security or they are keeping vulnerabilities for themselves.
- elcomet 7y agoFrench gov (CERT-FR and ANSII) made recommendations about heartbleed.
- blackflame7000 7y agoNo, the US government has taken the position that it’s always best to have a few tricks up your sleeve when the chips are down. It is most certainly intentional stock piling of zero days for strategic advantage.