4 ms·

You have far greater faith in the ability of a leader to create organizational alignment than I do. Are you sure there isn’t some part of the NSA which is on an

You have far greater faith in the ability of a leader to create organizational alignment than I do. Are you sure there isn’t some part of the NSA which is on an ego-driven mission to prioritize national security?

notjoemama 4y ago
I think it doesn't require organizational alignment or faith in a leader for bad acting to occur. While I agree reality is more often obvious and mundane, the NSA has demonstrably not operated in the USA's best interests. The Snowden leak proves its inefficiencies, lack of oversight, and lack of access governance. History supports your point, but it also supports counter productive actions and nefarious self and private interests by individuals and small groups within those government agencies. It only takes a few minutes searching for leaks that made it to the main stream media to show both statements are true. While this topic is about the NSA I feel this are relevant questions: Why do we still have a FDA given they fail so regularly to catch food and drugs that harm people? Why do we still have a FTC given they've fail so regularly to prevent monopolistic behavior from telecoms? Why do we still have a FBI given they fail so regularly to prevent mass shootings and domestic terror attacks? Why do we still have a NSA given they fail so regularly at sharing information allowing foreign entities penetrating our financial and tech sectors? Surely you recognize at some point inefficiency must give way to the question, has this been done intentionally? Especially since that is supported historically.
- shepherdjerred 4y ago
  What are you saying? Those organizations aren't doing a good enough job, so we may as not have them at all?
- afarrell 4y ago
  Oh I'm sure bad acting does occur. That is not the question at hand. The question at hand is: Is a recommendation to use memory-safe programming languages evidence that those languages are less safe than we previously thought? There are two competing notions: A. This being announced now is evidence that the NSA has recently succeeded in finding a way to subvert the security guarantees of rust. B. This being announced now is evidence that the good actors (or actors who want to appear good) in the NSA have finally gotten through the red tape to do what is nominally their jobs.
  - darksaints 4y ago
    And to be able to discern between the two possibilities, you just have to ask yourself the question: has specific NSA technology recommendation consistently been provided in our best interest? Their track record is spotty at best, and has only gotten worse over time. So to the extent that they are recommending using memory safe languages, that's great...it's advice that would be corroborated by other institutions, researchers, and practitioners. But the moment they recommend a specific set of technologies to use, that should give you pause. That being said, the report doesn't specifically recommend just those specific languages, and merely provides them as examples...so as long as I'm not in charge of securing an adversarial nation/state's infrastructure, I'm not gonna worry about the potential nefariousness of this recommendation.
- dtech 4y ago
  Those questions are stupid, it's like asking why bother having software if it so regularly has bugs? There must a nefarious plan behind the software development sector!
darksaints 4y ago
It has nothing to do with leadership, just incentives. If you're a world class hacker, your most prominent options are: 1) do black hat shit and risk prison time for gains that are hard to realize 2) work in white hat security and get paid a ton of money 3) work for the government and make very little money, but get to do black hat shit with impunity It's pretty easy to imagine that the people submitting applications to work for the NSA have no interest in protecting the US from big bad overseas hackers.
- afarrell 4y ago
  People can have multiple motives. I have a two cousins who joined the army national guard. It is simultaneously true that they: 1. Enjoy shooting guns and driving fast. 2. Have an interest in protecting the US.

notjoemama 4y ago

I think it doesn't require organizational alignment or faith in a leader for bad acting to occur. While I agree reality is more often obvious and mundane, the NSA has demonstrably not operated in the USA's best interests. The Snowden leak proves its inefficiencies, lack of oversight, and lack of access governance. History supports your point, but it also supports counter productive actions and nefarious self and private interests by individuals and small groups within those government agencies. It only takes a few minutes searching for leaks that made it to the main stream media to show both statements are true. While this topic is about the NSA I feel this are relevant questions: Why do we still have a FDA given they fail so regularly to catch food and drugs that harm people? Why do we still have a FTC given they've fail so regularly to prevent monopolistic behavior from telecoms? Why do we still have a FBI given they fail so regularly to prevent mass shootings and domestic terror attacks? Why do we still have a NSA given they fail so regularly at sharing information allowing foreign entities penetrating our financial and tech sectors? Surely you recognize at some point inefficiency must give way to the question, has this been done intentionally? Especially since that is supported historically.

shepherdjerred 4y ago
What are you saying? Those organizations aren't doing a good enough job, so we may as not have them at all?
afarrell 4y ago
Oh I'm sure bad acting does occur. That is not the question at hand. The question at hand is: Is a recommendation to use memory-safe programming languages evidence that those languages are less safe than we previously thought? There are two competing notions: A. This being announced now is evidence that the NSA has recently succeeded in finding a way to subvert the security guarantees of rust. B. This being announced now is evidence that the good actors (or actors who want to appear good) in the NSA have finally gotten through the red tape to do what is nominally their jobs.
- darksaints 4y ago
  And to be able to discern between the two possibilities, you just have to ask yourself the question: has specific NSA technology recommendation consistently been provided in our best interest? Their track record is spotty at best, and has only gotten worse over time. So to the extent that they are recommending using memory safe languages, that's great...it's advice that would be corroborated by other institutions, researchers, and practitioners. But the moment they recommend a specific set of technologies to use, that should give you pause. That being said, the report doesn't specifically recommend just those specific languages, and merely provides them as examples...so as long as I'm not in charge of securing an adversarial nation/state's infrastructure, I'm not gonna worry about the potential nefariousness of this recommendation.
dtech 4y ago
Those questions are stupid, it's like asking why bother having software if it so regularly has bugs? There must a nefarious plan behind the software development sector!

darksaints 4y ago

It has nothing to do with leadership, just incentives. If you're a world class hacker, your most prominent options are: 1) do black hat shit and risk prison time for gains that are hard to realize 2) work in white hat security and get paid a ton of money 3) work for the government and make very little money, but get to do black hat shit with impunity It's pretty easy to imagine that the people submitting applications to work for the NSA have no interest in protecting the US from big bad overseas hackers.

afarrell 4y ago
People can have multiple motives. I have a two cousins who joined the army national guard. It is simultaneously true that they: 1. Enjoy shooting guns and driving fast. 2. Have an interest in protecting the US.