3 ms·

The NSA can attack foreign assets without compromising a single american asset. Mind you, I'm playing devil's advocate here to understand the reasoning. The N

The NSA can attack foreign assets without compromising a single american asset. Mind you, I'm playing devil's advocate here to understand the reasoning. The NSA is abhorrent to me.

thaumasiotes 6y ago
No, that's not how software works. An attack that works against foreign assets works just as well against American assets, because they run the same software. So once you have the attack, you know that (1) The evil Turks have a hole in their defenses, and you can use it to spy on them; (2) The righteous Americans have a hole -- exactly the same hole -- in their defenses, and you can use it to spy on them; (3) Everyone else in the world can also spy on the righteous Americans, just like you can. Now you have to choose whether your job is protecting the Americans or undermining the Turks. You can do exactly one of those things. If you protect the Americans, the Turks will receive the same protection. If you keep silent to let the Turks embarrass themselves, you're also letting the Americans embarrass themselves.
- unishark 6y ago
  Are you talking about the introduction of backdoors or just exploiting vulnerabilities that are there? Because the latter sounds analogous to the creation of a tank bomb which might theoretically used against your tanks also. The parent poster said the NSA "can" do attacks that don't reduce the security US assets. They didn't claim that all possible attacks fit this description. For example they can try to guess at bad passwords used on that foreign computer system.
  - thaumasiotes 6y ago
    Root comment: >>> how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them? >> why does this have to be XOR? Because these are opposed goals. Defending Americans means invalidating zero-days. You could restrict yourself solely to attacks that don't rely on flaws in the software. In that case, you would have no reason to hoard zero-days, because you are ideologically committed to never use them. That would be weird in a few different ways. But most relevant here, it answers "Why can't we do both?" with "We can, as long as we never do the second one!" This is not really a compelling response.
    - colordrops 6y ago
      But this isn't answering my question - why aren't they opposed goals for other parts of the military? Why just cyber? And we've already addressed the question of exposing ourselves - attacks can targeted and not universal, just like physical attacks. This property is not specific to cyber. For the inverse, the military could decide to use a bioweapon, but it would also attack ourselves.
- colordrops 6y ago
  Someone else already responded in kind, but to emphasize, not all attacks are zero-sum - there are vulnerabilities specific to a particular asset and are not universal. Why couldn't these attack vectors be used?
  - thaumasiotes 6y ago
    Are you just asking for me to repeat myself? Here you go: Saying "when these two goals come into conflict, I believe the first one should always take priority over the second one" does not actually amount to a claim that the two goals are not in conflict.

The NSA can attack foreign assets without compromising a single american asset. Mind you, I'm playing devil's advocate here to understand the reasoning. The NSA is abhorrent to me.

thaumasiotes 6y ago

No, that's not how software works. An attack that works against foreign assets works just as well against American assets, because they run the same software. So once you have the attack, you know that (1) The evil Turks have a hole in their defenses, and you can use it to spy on them; (2) The righteous Americans have a hole -- exactly the same hole -- in their defenses, and you can use it to spy on them; (3) Everyone else in the world can also spy on the righteous Americans, just like you can. Now you have to choose whether your job is protecting the Americans or undermining the Turks. You can do exactly one of those things. If you protect the Americans, the Turks will receive the same protection. If you keep silent to let the Turks embarrass themselves, you're also letting the Americans embarrass themselves.

unishark 6y ago
Are you talking about the introduction of backdoors or just exploiting vulnerabilities that are there? Because the latter sounds analogous to the creation of a tank bomb which might theoretically used against your tanks also. The parent poster said the NSA "can" do attacks that don't reduce the security US assets. They didn't claim that all possible attacks fit this description. For example they can try to guess at bad passwords used on that foreign computer system.
- thaumasiotes 6y ago
  Root comment: >>> how about the NSA used its powers to defend Americans instead of hoarding zero days and spying on them? >> why does this have to be XOR? Because these are opposed goals. Defending Americans means invalidating zero-days. You could restrict yourself solely to attacks that don't rely on flaws in the software. In that case, you would have no reason to hoard zero-days, because you are ideologically committed to never use them. That would be weird in a few different ways. But most relevant here, it answers "Why can't we do both?" with "We can, as long as we never do the second one!" This is not really a compelling response.
  - colordrops 6y ago
    But this isn't answering my question - why aren't they opposed goals for other parts of the military? Why just cyber? And we've already addressed the question of exposing ourselves - attacks can targeted and not universal, just like physical attacks. This property is not specific to cyber. For the inverse, the military could decide to use a bioweapon, but it would also attack ourselves.
colordrops 6y ago
Someone else already responded in kind, but to emphasize, not all attacks are zero-sum - there are vulnerabilities specific to a particular asset and are not universal. Why couldn't these attack vectors be used?
- thaumasiotes 6y ago
  Are you just asking for me to repeat myself? Here you go: Saying "when these two goals come into conflict, I believe the first one should always take priority over the second one" does not actually amount to a claim that the two goals are not in conflict.