6 ms·
> C#, Rust, Go, Java, Ruby or Swift Conspiracy: The NSA has compromised all those languages' runtimes to spy on whatever is being run and passed through them.
by theandrewbailey 4y ago
> C#, Rust, Go, Java, Ruby or Swift
Conspiracy: The NSA has compromised all those languages' runtimes to spy on whatever is being run and passed through them. After all, that Utah datacenter[0] isn't going to fill itself.
[0] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
Edit: comprised -> compromised
- t-3 4y agoIt's definitely more work than it should be to bootstrap Rust, but we should be able to rule out most "trusting trust" scenarios with a fully bootstrapped compiler, right?
- kibwen 4y agorustc has been successfully subjected to diverse-double-compilation (https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/) via mrustc at various points in its history, which plausibly rules out trusting-trust attacks for those versions.
- drexlspivey 4y agoGNU successfully bootstrapped the Rust compiler https://guix.gnu.org/tr/blog/2018/bootstrapping-rust/ https://guix.gnu.org/tr/blog/2018/bootstrapping-rust/
- freilanzer 4y agoYou mean 'compromised'?
- Verdex 4y agoSo, technically, they probably meant: "unauthorized modification of a security-related system, device or process in order to gain unauthorized access". This being the jargon definition for 'compromised'. You probably should have instead posted something like: "You probably should have instead posted something like: compromised instead of comprised". Now, I know what you're thinking: "Yeah, the definition of 'compromised' is what I meant when I said 'You mean "compromised"?'. Why do you have to be so pedantic?" Perhaps you are correct. Maybe it's better to not correct people on the internet when what they were saying is technically incorrect, but otherwise understandable.
- theandrewbailey 4y agoI'm genuinely grateful that the previous comment asked if I meant 'compromised'. Short, simple, and to the point. I do not read any bad intent into that comment, and point-outs like those seem to be protocol for HN.
- Verdex 4y agoPerhaps you are correct. Maybe it's better to not correct people on the internet when what they were saying is technically incorrect, but otherwise understandable.
- jaywalk 4y agoI think most people appreciate typos being pointed out to them politely. Maybe it's better to not tell people they shouldn't help others.
- theandrewbailey 4y agoD'oh! Yes, I meant 'compromised'. Edited.
- tyingq 4y agoI thought at first that specific list of languages might have just been theregister.com's editorialized list. But it's in the actual document[1]. "These inherent language features protect the programmer from introducing memory management mistakes unintentionally. Examples of memory safe language include C#, Go, Java®, Ruby™, Rust®, and Swift®." I don't think there's any conspiracy, but it is interesting they don't mention JS or Python. [1]https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY.PDF https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI...
- MonkeyMalarky 4y agoI wouldn't put Python on that list because of how many packages are wrapped up C/C++ code. I know the same is done with Java and JNI but the pervasiveness of it is not at the same level.
- tyingq 4y agoTrue, though Ruby made the list, and there's a fair amount of gems linked to native libraries and/or using their own C code.
- MonkeyMalarky 4y agoHah, I had no idea, I don't know anything about Ruby except it also suffers from a Gil? Maybe they're using the other golden rule: All languages starting with a P are old, crusty and should be avoided.
- candiddevmike 4y agoHow?
- chongli 4y agoIt’s part of the NSA’s mission to secure American businesses, communications, and infrastructure against foreign attack.
- peeters 4y agoIt is, but they also have a competing mission to compromise the security of non-American businesses, communications, and infrastructure. Since for the most part, the same software is used by both, these missions often contradict each other. e.g. documents from Snowden revealed that the NSA had broken encryption recommended by NIST. It's difficult to know if NSA recommends something because it makes their defensive mandate easier, or their offensive mandate easier. For this reason, experts like Schneier [1] have long advocated that the NSA be broken up so that these two missions do not fall under the same agency. [1] https://www.schneier.com/blog/archives/2014/02/breaking_up_the.html https://www.schneier.com/blog/archives/2014/02/breaking_up_t...
- kingaillas 4y agoNo it is not. Responsibility (issue advisories) for unclassified, commercial, non-defense internet is a confusing mess split between Commerce (NIST, https://csrc.nist.gov/about https://csrc.nist.gov/about), DHS (CISA, https://www.cisa.gov/cybersecurity https://www.cisa.gov/cybersecurity), Energy (CESER, https://www.energy.gov/ceser/cybersecurity https://www.energy.gov/ceser/cybersecurity if it is related to energy infrastructure), etc. Throw in other agencies like DISA (https://disa.mil/About/Our-Work https://disa.mil/About/Our-Work) as appropriate. NSA's defensive mission is about securing National Security Systems. These have a fairly specific definition, and are not running in the average business.
- webmobdev 4y agoIs there any standard to meet the requirements of being "memory safe" or is it enough for the language to just feature GC and automatic memory management? I thought only Rust and Ada (which is surprisingly not mentioned in the list) were stringent about memory safety as a language feature ... (perhaps Go too?).
- theandrewbailey 4y agoI'm pretty sure that in this context "memory safe" means more than that, like difficult to impossible to have a buffer overflow.
- blululu 4y agoIf you're concerned that Rust has been compromised you should consider where that leaves Python. The NSA is both offensive and defensive. Part of their mandate is to protect American infrastructure for foreign attacks. A switch like this is one of the easier ways to protect against foreign threats and it is something that is routinely advocated for by most large tech companies and cloud providers. As for that Datacenter in Utah - it is a large Government project. The idea that the US Government is efficient with its resources or that its operatives are trying to maximize the use of their resources is not well supported by historical precedent. If the project is written off as yet another make-work job project for a reliably red state then I am sure we can all sleep well knowing that our tax dollars have been well spent.
- darksaints 4y agoThat's how they're supposed to operate, not how they actually operate. They've been hoarding zero-days for years, and they have even worked surreptitiously to undermine encryption by endorsing algorithms that they had already compromised. They couldn't give a single fuck about protecting US infrastructure if it comes at the cost of their offensive weapons portfolio.
- throwaway0x7E6 4y agocase in point https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue and that's just a glimpse into how bad things really are
- sitkack 4y agoThere should have been a commission formed about the p0wn goal that was EternalBlue. Microsoft charging for security patches should get the execs thrown in jail. The NSA should be disclosing big RCEs like this to the vendor and figuring out how to ensure that everyone is patched. https://en.wikipedia.org/wiki/EternalBlue#Responsibility https://en.wikipedia.org/wiki/EternalBlue#Responsibility
- 4y ago
- deleted 4y ago[deleted]
- marcosdumay 4y agoReads like a "the people making this document have experience with those languages" list. But this is the NSA, some amount of suspicion is always healthy.
- gw98 4y agoI wish that was the case. The biggest software risk to companies I have worked at are not the NSA or memory safety. It's their own product management and development staff competence. You can leave a whale sized implementation hole in the finest of Rust applications!
- some_random 4y agoThat certainly is a conspiracy theory alright.
- cryptonector 4y agoThat's hilarious. The reality is that just by not recommending C (or C++), they really are making things safer.
- Rochus 4y ago> The NSA has compromised all those languages' runtimes honi soit qui mal y pense, but I spontaneously had the same thought when I read that.
- pjc50 4y agoThis is an extremely paranoid view that relies on nobody else outside the US spotting it or any of the network traffic that it would have to generate to be useful. I think the only instance of this kind of thing for which there is evidence is the elliptic curve debacle?
- deleted 4y ago[deleted]
- RadixDLT 4y agobetter stick with D then ;)