6 ms·

> Mudge, who is well respected in the industry Keep in mind, although he's classed as an 'ethical' hacker, many whitehats come from blackhat backgrounds, and t

by vmoore 4y ago

> Mudge, who is well respected in the industry Keep in mind, although he's classed as an 'ethical' hacker, many whitehats come from blackhat backgrounds, and turned whitehat because of fear of getting caught up in draconian CFAA[0] trials. Every hacker in their youth done some stupid stuff that could haunt them later. If you didn't do stupid stuff in your youth, you never really grew or learned from it. [0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

nekoashide 4y ago
That's why you don't request your personal file from the FBI, either they have a file on you from your youth or you have given them reason to suspect you did something at some point. I'm curious, but not that curious.
- woodruffw 4y ago
  Tens of thousands of people FOIA their DOJ files each year. Unless you're already pinged for something, I doubt the FBI is going to expend any additional effort solely because you've asked for some personal files.
jjulius 4y ago
>If you didn't do stupid stuff in your youth, you never really grew or learned from it. So, he's... just like most people? Do you have any specific incident(s) to point to, re: Mudge, or is this just speculation that can be applied to nearly everyone?
marshray 4y ago
Mudge held a significant position within the Department of Defense. That doesn't happen without having any skeletons in your closet identified and investigated.
- ChrisMarshallNY 4y ago
  > That doesn't happen without having any skeletons in your closet identified and investigated. Yup. They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it. If they are looking for dirt, they won't get it. I assume they are intelligent people, and know that, so maybe they are actually doing what has been suggested; looking for as much accurate information as possible -either way. NPD is a multibillion-dollar company, because they sell accurate information; not information that people want to hear (how they get that information, well, that's another matter).
  - cma 4y ago
    > They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it. Astronauts undergo detailed psyche exams, personality evaluations, and usually have some level of security clearance. And yet.. https://www.wikipedia.org/wiki/Lisa_Nowak https://www.wikipedia.org/wiki/Lisa_Nowak
    - brigandish 4y ago
      11 years after getting clearance she committed assault as a jilted/cheated lover and that somehow means they missed something? How is that relevant to whether someone has a skeleton in the closet when they are getting a background check?
  - mc32 4y ago
    Not only that, but we know fabrications happen and take years to dispel. If a powerful entity wants to ruin your reputation, they can and do not need truth behind them. It's courageous for him to speak the truth (at least his observations) when they were unwilling to and actively try to undermine it.
  - woodruffw 4y ago
    > Yup. They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it. This is a mild overstatement. DARPA doesn't necessarily require clearances for PMs; even if a particular project does, it's not necessarily one that requires the "full-scope" process (meaning polygraph and the rest of the works). I wound't be surprised if Mudge had to fill out an SF-86, but that's not that invasive as far as background investigations go. It's nearly identical to the process used for Global Entry.
- tptacek 4y ago
  What kind of clearance do you actually need to be a DARPA PI?
  - woodruffw 4y ago
    None that I'm aware of (or can find on DARPA's site). DARPA might help a PM maintain their clearance if they already have one, but I don't think they require one for new PMs (unless the project directly requires classified information, which of course some do).
    - throwawaylol_ 4y ago
    - V_Terranova_Jr 4y ago
      @throwawaylol_ is correct. I'm afraid you're mistaken.
      - woodruffw 4y ago
        I saw your other comment as well, thanks. (I don’t know why ‘throwawaylol_ is flagged; I vouched for their comment.)
  - marshray 4y ago
    In talks, Mudge has referenced participation in various Pentagon projects that would definitely require a nontrivial clearance.
    - tptacek 4y ago
      I'm not doubting so much as asking curiously: I've participated in what I'd guess are fairly sensitive Pentagon projects (commercially, over about a year and a half†) and I've never been cleared for anything. † None of it involved vulnerability research; this was back in my anti-DDOS days.
- woodruffw 4y ago
  Mudge was a DARPA PM; that's a significant position in the sense that he led DARPA-funded research programs, but I don't think it's one that actually requires a clearance. Source: currently do DARPA-funded research. No PM has ever mentioned having a clearance to me, and the work itself is entirely uncleared.
  - snowwrestler 4y ago
    To be fair, marshray did not mention clearance, just that some skeletons would be looked for. Getting cleared is not the only time or the only way the federal government does that sort of thing.
    - woodruffw 4y ago
      Sure. I actually wouldn’t doubt that Mudge was already a known entity to USG. I just wanted to dispel some of the clearance voodoo that comes along with “significant position within the Department of Defense.”
  - coldsauce 4y ago
    In his most recent testimony, Mudge mentioned that he was in the leaked OPM database with his details and clearance level leaked which implies he had clearance.
    - woodruffw 4y ago
      Did he mention a clearance level, or just being in the OPM breach? My understanding is that the OPM breach included plenty of uncleared employeesas well. (I’m not trying to be stubborn! If he really did hold a clearance as a DARPA PM, then I’m wrong in his case.)
      - RajT88 4y ago
        You could have been in the OPM database being a janitor at the VA. Although that wording about "Clearance level" does seem to suggest more than just the baseline government employee background check.
- pclmulqdq 4y ago
  I have had several friends go through the interviews to get TS-level clearance. The point of getting a clearance is to get the dirt out on the table, not to find dirt. You can get one with many skeletons, and if you are honest about their presence, nobody minds.
gnu8 4y ago
This is a no-true-Scotsman argument where none was asked for, but thank you for linking to Wikipedia properly. “Ethical” hacker is also a nonsense term. Ethics means the study of moral philosophy, it is not a synonym for “good” and to use it as such belies a superficial understanding of both morality and hacking.
- zimpenfish 4y ago
  > “Ethical” [...] is not a synonym for “good” I think it's generally accepted that these days it is a synonym for, if not "good" per se, at least "morally acceptable".
bitexploder 4y ago
I got into infosec consulting perfectly cleanly, as did most of my peers. Sure some of them were involved in shenanigans in the distant past, but that is a very broad brush to paint with and seems out of place here given zero specific knowledge about Mudge and what he may or may not have done just because he is in an industry where some people occasionally did some questionable things in the past.

by vmoore 4y ago

nekoashide 4y ago

That's why you don't request your personal file from the FBI, either they have a file on you from your youth or you have given them reason to suspect you did something at some point. I'm curious, but not that curious.

woodruffw 4y ago
Tens of thousands of people FOIA their DOJ files each year. Unless you're already pinged for something, I doubt the FBI is going to expend any additional effort solely because you've asked for some personal files.

jjulius 4y ago

>If you didn't do stupid stuff in your youth, you never really grew or learned from it. So, he's... just like most people? Do you have any specific incident(s) to point to, re: Mudge, or is this just speculation that can be applied to nearly everyone?

marshray 4y ago

Mudge held a significant position within the Department of Defense. That doesn't happen without having any skeletons in your closet identified and investigated.

ChrisMarshallNY 4y ago
> That doesn't happen without having any skeletons in your closet identified and investigated. Yup. They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it. If they are looking for dirt, they won't get it. I assume they are intelligent people, and know that, so maybe they are actually doing what has been suggested; looking for as much accurate information as possible -either way. NPD is a multibillion-dollar company, because they sell accurate information; not information that people want to hear (how they get that information, well, that's another matter).
- cma 4y ago
  > They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it. Astronauts undergo detailed psyche exams, personality evaluations, and usually have some level of security clearance. And yet.. https://www.wikipedia.org/wiki/Lisa_Nowak https://www.wikipedia.org/wiki/Lisa_Nowak
  - brigandish 4y ago
    11 years after getting clearance she committed assault as a jilted/cheated lover and that somehow means they missed something? How is that relevant to whether someone has a skeleton in the closet when they are getting a background check?
- mc32 4y ago
  Not only that, but we know fabrications happen and take years to dispel. If a powerful entity wants to ruin your reputation, they can and do not need truth behind them. It's courageous for him to speak the truth (at least his observations) when they were unwilling to and actively try to undermine it.
- woodruffw 4y ago
  > Yup. They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it. This is a mild overstatement. DARPA doesn't necessarily require clearances for PMs; even if a particular project does, it's not necessarily one that requires the "full-scope" process (meaning polygraph and the rest of the works). I wound't be surprised if Mudge had to fill out an SF-86, but that's not that invasive as far as background investigations go. It's nearly identical to the process used for Global Entry.
tptacek 4y ago
What kind of clearance do you actually need to be a DARPA PI?
- woodruffw 4y ago
  None that I'm aware of (or can find on DARPA's site). DARPA might help a PM maintain their clearance if they already have one, but I don't think they require one for new PMs (unless the project directly requires classified information, which of course some do).
  - throwawaylol_ 4y ago
  - V_Terranova_Jr 4y ago
    @throwawaylol_ is correct. I'm afraid you're mistaken.
    - woodruffw 4y ago
      I saw your other comment as well, thanks. (I don’t know why ‘throwawaylol_ is flagged; I vouched for their comment.)
- marshray 4y ago
  In talks, Mudge has referenced participation in various Pentagon projects that would definitely require a nontrivial clearance.
  - tptacek 4y ago
    I'm not doubting so much as asking curiously: I've participated in what I'd guess are fairly sensitive Pentagon projects (commercially, over about a year and a half†) and I've never been cleared for anything. † None of it involved vulnerability research; this was back in my anti-DDOS days.
woodruffw 4y ago
Mudge was a DARPA PM; that's a significant position in the sense that he led DARPA-funded research programs, but I don't think it's one that actually requires a clearance. Source: currently do DARPA-funded research. No PM has ever mentioned having a clearance to me, and the work itself is entirely uncleared.
- snowwrestler 4y ago
  To be fair, marshray did not mention clearance, just that some skeletons would be looked for. Getting cleared is not the only time or the only way the federal government does that sort of thing.
  - woodruffw 4y ago
    Sure. I actually wouldn’t doubt that Mudge was already a known entity to USG. I just wanted to dispel some of the clearance voodoo that comes along with “significant position within the Department of Defense.”
- coldsauce 4y ago
  In his most recent testimony, Mudge mentioned that he was in the leaked OPM database with his details and clearance level leaked which implies he had clearance.
  - woodruffw 4y ago
    Did he mention a clearance level, or just being in the OPM breach? My understanding is that the OPM breach included plenty of uncleared employeesas well. (I’m not trying to be stubborn! If he really did hold a clearance as a DARPA PM, then I’m wrong in his case.)
    - RajT88 4y ago
      You could have been in the OPM database being a janitor at the VA. Although that wording about "Clearance level" does seem to suggest more than just the baseline government employee background check.
pclmulqdq 4y ago
I have had several friends go through the interviews to get TS-level clearance. The point of getting a clearance is to get the dirt out on the table, not to find dirt. You can get one with many skeletons, and if you are honest about their presence, nobody minds.

gnu8 4y ago

This is a no-true-Scotsman argument where none was asked for, but thank you for linking to Wikipedia properly. “Ethical” hacker is also a nonsense term. Ethics means the study of moral philosophy, it is not a synonym for “good” and to use it as such belies a superficial understanding of both morality and hacking.

zimpenfish 4y ago
> “Ethical” [...] is not a synonym for “good” I think it's generally accepted that these days it is a synonym for, if not "good" per se, at least "morally acceptable".

bitexploder 4y ago

I got into infosec consulting perfectly cleanly, as did most of my peers. Sure some of them were involved in shenanigans in the distant past, but that is a very broad brush to paint with and seems out of place here given zero specific knowledge about Mudge and what he may or may not have done just because he is in an industry where some people occasionally did some questionable things in the past.