4 ms·

A little game theory: I really believe that it's not in the US government interest to increase computer security. I think the NSA is at least 5 or 6 steps ahe

by jokoon 5y ago

A little game theory: I really believe that it's not in the US government interest to increase computer security. I think the NSA is at least 5 or 6 steps ahead of the security game, so for now the NSA dominates cyber warfare, which is why they don't want more security in software, so they will constantly make everything possible so that software is insecure. But at some point, it is going to sting because China, Russia and others are catching up. I always found it weird that there are a lot of security standards for other industries, OSHA, etc, but for software, there is nothing, no companies are required to comply to software security standards. No software is being inspected at all. Isn't it weird?

m12k 5y ago
If the NSA is ahead on discovering exploits shouldn't they want a ban on selling exploits, so others have a harder time catching up, and it's less likely that any of the exploits that they've discovered in-house get "burned" by being used by someone else?
- xmprt 5y ago
  Not if they're also a big purchaser of exploits.
  - m12k 5y ago
    It's quite possible for the government to outlaw selling things to anyone other than them. Cf. a lot of military hardware.
legrande 5y ago
> I really believe that it's not in the US government interest to increase computer security Agreed. It's just doublespeak[0]. We all know it's the National Insecurity Agency, and that the NSA hoards & stockpiles 0day. They very rarely release tools and research papers designed to strengthen our IT infra, since they sit on so much 0day. There's no balance. I don't buy that they're 50% red team, and 50% blue team. More like 99% red team and 1% blue team. [0] https://en.wikipedia.org/wiki/Doublespeak https://en.wikipedia.org/wiki/Doublespeak
- HideousKojima 5y ago
  Hell the NIST does more to fulfill the NSA's mission of domestic IT security than the NSA does. Ghidra is the only good thing out of the NSA is a long time.
lstodd 5y ago
> I think the NSA is at least 5 or 6 steps ahead of the security game NSA isn't. There is no lead, and the barrier for entry is at a historical low. Many people just don't bother because it's boring, not because it's hard. Breaking into stuff became so simple that it just doesn't attract talent any more.
toomanyducks 5y ago
It might not be fair to assume that OSHA, etc, and the NSA, etc, operate under the same agenda. Some industries do have standards for tech. HIPAA, for instance, sets some minimum expectations for cyber security with regard to private health information (PHI). And there are HIPAA inspections, right along with OSHA ones. Of course, it's a fairly clunky solution given that government is slow and tech is fast, but it's certainly there, and it's certainly helpful.
TheCapn 5y ago
>I always found it weird that there are a lot of security standards for other industries, OSHA, etc Can't speak for all, but look into things like the CISA[1]. I don't think they have much of legal authority over industries, perhaps in some deemed critical but not others, but to say there's no "standards" is a bit wrong. [1]: https://www.cisa.gov/ https://www.cisa.gov/

by jokoon 5y ago

m12k 5y ago

If the NSA is ahead on discovering exploits shouldn't they want a ban on selling exploits, so others have a harder time catching up, and it's less likely that any of the exploits that they've discovered in-house get "burned" by being used by someone else?

xmprt 5y ago
Not if they're also a big purchaser of exploits.
- m12k 5y ago
  It's quite possible for the government to outlaw selling things to anyone other than them. Cf. a lot of military hardware.

legrande 5y ago

> I really believe that it's not in the US government interest to increase computer security Agreed. It's just doublespeak[0]. We all know it's the National Insecurity Agency, and that the NSA hoards & stockpiles 0day. They very rarely release tools and research papers designed to strengthen our IT infra, since they sit on so much 0day. There's no balance. I don't buy that they're 50% red team, and 50% blue team. More like 99% red team and 1% blue team. [0] https://en.wikipedia.org/wiki/Doublespeak https://en.wikipedia.org/wiki/Doublespeak

HideousKojima 5y ago
Hell the NIST does more to fulfill the NSA's mission of domestic IT security than the NSA does. Ghidra is the only good thing out of the NSA is a long time.

lstodd 5y ago

> I think the NSA is at least 5 or 6 steps ahead of the security game NSA isn't. There is no lead, and the barrier for entry is at a historical low. Many people just don't bother because it's boring, not because it's hard. Breaking into stuff became so simple that it just doesn't attract talent any more.

toomanyducks 5y ago

It might not be fair to assume that OSHA, etc, and the NSA, etc, operate under the same agenda. Some industries do have standards for tech. HIPAA, for instance, sets some minimum expectations for cyber security with regard to private health information (PHI). And there are HIPAA inspections, right along with OSHA ones. Of course, it's a fairly clunky solution given that government is slow and tech is fast, but it's certainly there, and it's certainly helpful.

TheCapn 5y ago

>I always found it weird that there are a lot of security standards for other industries, OSHA, etc Can't speak for all, but look into things like the CISA[1]. I don't think they have much of legal authority over industries, perhaps in some deemed critical but not others, but to say there's no "standards" is a bit wrong. [1]: https://www.cisa.gov/ https://www.cisa.gov/