4 ms·

Well that’s… curious. Not sure I’ve ever read the NSA providing hardening guidance on anything before.

antonvs 5y ago
They've been doing that for at least a decade, but probably quite a bit longer. Here are their hardening guidelines for RHEL 5, from 2011: https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm https://apps.nsa.gov/iaarchive/library/ia-guidance/security-... They have similar guidance for Windows, web browsers, industrial control systems, etc.
- andrewmcwatters 5y ago
  Interesting! Thank you for sharing this.
- deleted 5y ago
  [deleted]
beprogrammed 5y ago
It's fine to trust them right up until they give you a magic number.
- tablespoon 5y ago
  > It's fine to trust them right up until they give you a magic number. IIRC, DES had NSA-provided magic numbers in it that made it more secure against a then-not-publicly-known cryptoanalytic attack.
sdmike1 5y ago
In general the NSA functions more like 2 agencies, one focused on the "red" side (hacking, breaking crypto, sigint stuff) and one focused on the "blue" side (protecting US assets from being hacked, developing better/new crypto, providing guidance on security). Both sides are good at their jobs and for what it's worth, my understanding is that the blue side really does want to keep your shit from being hacked.
endymi0n 5y ago
For what it's worth, SELinux originated from the R&D Labs of the NSA.
samstave 5y ago
I used them back at lockheed as early as ~2005? Although they were mostly around hardening BSD IIRC... (which became SElinux? I can't recall) and at the time, they were really "best practices" (things that you want to make sure you have done if you expect to pass any sort of audit (SOX, SAS70, etc). Sarcastically, we would say "they already have back doors in everything, they just don't want any other Bad Actors getting in their yard"
HWR_14 5y ago
> Not sure I’ve ever read the NSA providing hardening guidance on anything before. The NSA made SELinux, SHA-1, and SHA-256. SHA-1 was specifically a slight change to SHA-0 that was unjustified at the time but over the next 3-5 years some attacks on SHA-0 that SHA-1 was not vulnerable to surfaced.
Gene_Parmesan 5y ago
If you take the name National Security Agency at face value, it makes sense.

They've been doing that for at least a decade, but probably quite a bit longer. Here are their hardening guidelines for RHEL 5, from 2011: https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/operating-systems/guide-to-the-secure-configuration-of-red-hat-enterprise.cfm https://apps.nsa.gov/iaarchive/library/ia-guidance/security-... They have similar guidance for Windows, web browsers, industrial control systems, etc.

andrewmcwatters 5y ago
Interesting! Thank you for sharing this.
deleted 5y ago
[deleted]

beprogrammed 5y ago

It's fine to trust them right up until they give you a magic number.

tablespoon 5y ago
> It's fine to trust them right up until they give you a magic number. IIRC, DES had NSA-provided magic numbers in it that made it more secure against a then-not-publicly-known cryptoanalytic attack.

sdmike1 5y ago

In general the NSA functions more like 2 agencies, one focused on the "red" side (hacking, breaking crypto, sigint stuff) and one focused on the "blue" side (protecting US assets from being hacked, developing better/new crypto, providing guidance on security). Both sides are good at their jobs and for what it's worth, my understanding is that the blue side really does want to keep your shit from being hacked.

endymi0n 5y ago

For what it's worth, SELinux originated from the R&D Labs of the NSA.

samstave 5y ago

I used them back at lockheed as early as ~2005? Although they were mostly around hardening BSD IIRC... (which became SElinux? I can't recall) and at the time, they were really "best practices" (things that you want to make sure you have done if you expect to pass any sort of audit (SOX, SAS70, etc). Sarcastically, we would say "they already have back doors in everything, they just don't want any other Bad Actors getting in their yard"

HWR_14 5y ago

> Not sure I’ve ever read the NSA providing hardening guidance on anything before. The NSA made SELinux, SHA-1, and SHA-256. SHA-1 was specifically a slight change to SHA-0 that was unjustified at the time but over the next 3-5 years some attacks on SHA-0 that SHA-1 was not vulnerable to surfaced.

Gene_Parmesan 5y ago

If you take the name National Security Agency at face value, it makes sense.