3 ms·

That's how they're supposed to operate, not how they actually operate. They've been hoarding zero-days for years, and they have even worked surreptitiously to u

That's how they're supposed to operate, not how they actually operate. They've been hoarding zero-days for years, and they have even worked surreptitiously to undermine encryption by endorsing algorithms that they had already compromised. They couldn't give a single fuck about protecting US infrastructure if it comes at the cost of their offensive weapons portfolio.

throwaway0x7E6 4y ago
case in point https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue and that's just a glimpse into how bad things really are
- sitkack 4y ago
  There should have been a commission formed about the p0wn goal that was EternalBlue. Microsoft charging for security patches should get the execs thrown in jail. The NSA should be disclosing big RCEs like this to the vendor and figuring out how to ensure that everyone is patched. https://en.wikipedia.org/wiki/EternalBlue#Responsibility https://en.wikipedia.org/wiki/EternalBlue#Responsibility
  - kingaillas 4y ago
    A commission would find that there was no problem whatsoever. Almost everybody misunderstands NSA's defensive mandate. They aren't corporate America's QA department, they don't have a "let's find and report exploits" mission - their defensive mission applies to "national security systems" and other "defense industrial base" ones. Those are computers/networks running fairly specific tasks; they are generally not internet connected, and sitting in secure buildings with 24 hour security and surveillance, so securing them revolves around a lot of physical security and controlled access. YOU don't have one of these systems, corporation XYZ doesn't have one, there is no requirement NSA disclose jack shit to anybody unless they want to. And in the ETERNALBLUE case one of their tools leaked so they helped head off a lot of problems by voluntarily telling Microsoft about it. As for who is responsible for this - I thought all the people here are free market worshipers. If Silicon Valley tech companies, one of the richest class of private enterprises in the world, need what are effectively government subsidies to cover their bug ridden insecure products, well that sounds like multiple market failures to me.
qzx_pierri 4y ago
This Computerphile video is what convinced me something fishy was going on https://www.youtube.com/watch?v=nybVFJVXbww https://www.youtube.com/watch?v=nybVFJVXbww
- alrlroipsp 4y ago
  Thanks for sharing that video.
- veqq 4y ago
  NIST Dual EC DRBG never really gained adoption. As far as I could find, some did use it for FIPS conformity until 2014. The attempt is still egregious though.
jnwatson 4y ago
You act as if the NSA is one monolithic hive mind. They have offensive cats and defensive cats, and they don’t talk to each other as much as you’d think they do.
afarrell 4y ago
You have far greater faith in the ability of a leader to create organizational alignment than I do. Are you sure there isn’t some part of the NSA which is on an ego-driven mission to prioritize national security?
- notjoemama 4y ago
  I think it doesn't require organizational alignment or faith in a leader for bad acting to occur. While I agree reality is more often obvious and mundane, the NSA has demonstrably not operated in the USA's best interests. The Snowden leak proves its inefficiencies, lack of oversight, and lack of access governance. History supports your point, but it also supports counter productive actions and nefarious self and private interests by individuals and small groups within those government agencies. It only takes a few minutes searching for leaks that made it to the main stream media to show both statements are true. While this topic is about the NSA I feel this are relevant questions: Why do we still have a FDA given they fail so regularly to catch food and drugs that harm people? Why do we still have a FTC given they've fail so regularly to prevent monopolistic behavior from telecoms? Why do we still have a FBI given they fail so regularly to prevent mass shootings and domestic terror attacks? Why do we still have a NSA given they fail so regularly at sharing information allowing foreign entities penetrating our financial and tech sectors? Surely you recognize at some point inefficiency must give way to the question, has this been done intentionally? Especially since that is supported historically.
  - shepherdjerred 4y ago
    What are you saying? Those organizations aren't doing a good enough job, so we may as not have them at all?
  - afarrell 4y ago
    Oh I'm sure bad acting does occur. That is not the question at hand. The question at hand is: Is a recommendation to use memory-safe programming languages evidence that those languages are less safe than we previously thought? There are two competing notions: A. This being announced now is evidence that the NSA has recently succeeded in finding a way to subvert the security guarantees of rust. B. This being announced now is evidence that the good actors (or actors who want to appear good) in the NSA have finally gotten through the red tape to do what is nominally their jobs.

throwaway0x7E6 4y ago

case in point https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue and that's just a glimpse into how bad things really are

sitkack 4y ago
There should have been a commission formed about the p0wn goal that was EternalBlue. Microsoft charging for security patches should get the execs thrown in jail. The NSA should be disclosing big RCEs like this to the vendor and figuring out how to ensure that everyone is patched. https://en.wikipedia.org/wiki/EternalBlue#Responsibility https://en.wikipedia.org/wiki/EternalBlue#Responsibility
- kingaillas 4y ago
  A commission would find that there was no problem whatsoever. Almost everybody misunderstands NSA's defensive mandate. They aren't corporate America's QA department, they don't have a "let's find and report exploits" mission - their defensive mission applies to "national security systems" and other "defense industrial base" ones. Those are computers/networks running fairly specific tasks; they are generally not internet connected, and sitting in secure buildings with 24 hour security and surveillance, so securing them revolves around a lot of physical security and controlled access. YOU don't have one of these systems, corporation XYZ doesn't have one, there is no requirement NSA disclose jack shit to anybody unless they want to. And in the ETERNALBLUE case one of their tools leaked so they helped head off a lot of problems by voluntarily telling Microsoft about it. As for who is responsible for this - I thought all the people here are free market worshipers. If Silicon Valley tech companies, one of the richest class of private enterprises in the world, need what are effectively government subsidies to cover their bug ridden insecure products, well that sounds like multiple market failures to me.

qzx_pierri 4y ago

This Computerphile video is what convinced me something fishy was going on https://www.youtube.com/watch?v=nybVFJVXbww https://www.youtube.com/watch?v=nybVFJVXbww

alrlroipsp 4y ago
Thanks for sharing that video.
veqq 4y ago
NIST Dual EC DRBG never really gained adoption. As far as I could find, some did use it for FIPS conformity until 2014. The attempt is still egregious though.

jnwatson 4y ago

You act as if the NSA is one monolithic hive mind. They have offensive cats and defensive cats, and they don’t talk to each other as much as you’d think they do.

afarrell 4y ago

You have far greater faith in the ability of a leader to create organizational alignment than I do. Are you sure there isn’t some part of the NSA which is on an ego-driven mission to prioritize national security?

notjoemama 4y ago
I think it doesn't require organizational alignment or faith in a leader for bad acting to occur. While I agree reality is more often obvious and mundane, the NSA has demonstrably not operated in the USA's best interests. The Snowden leak proves its inefficiencies, lack of oversight, and lack of access governance. History supports your point, but it also supports counter productive actions and nefarious self and private interests by individuals and small groups within those government agencies. It only takes a few minutes searching for leaks that made it to the main stream media to show both statements are true. While this topic is about the NSA I feel this are relevant questions: Why do we still have a FDA given they fail so regularly to catch food and drugs that harm people? Why do we still have a FTC given they've fail so regularly to prevent monopolistic behavior from telecoms? Why do we still have a FBI given they fail so regularly to prevent mass shootings and domestic terror attacks? Why do we still have a NSA given they fail so regularly at sharing information allowing foreign entities penetrating our financial and tech sectors? Surely you recognize at some point inefficiency must give way to the question, has this been done intentionally? Especially since that is supported historically.
- shepherdjerred 4y ago
  What are you saying? Those organizations aren't doing a good enough job, so we may as not have them at all?
- afarrell 4y ago
  Oh I'm sure bad acting does occur. That is not the question at hand. The question at hand is: Is a recommendation to use memory-safe programming languages evidence that those languages are less safe than we previously thought? There are two competing notions: A. This being announced now is evidence that the NSA has recently succeeded in finding a way to subvert the security guarantees of rust. B. This being announced now is evidence that the good actors (or actors who want to appear good) in the NSA have finally gotten through the red tape to do what is nominally their jobs.