3 ms·
There's an important difference between an opaque "trust us" recommendation where it's broadly impossible to verify the claim (e.g., Dual_EC_DRBG), and one such
by dgacmu 3y ago
There's an important difference between an opaque "trust us" recommendation where it's broadly impossible to verify the claim (e.g., Dual_EC_DRBG), and one such as this which is fairly anodyne and merely intended to put more weight behind getting people to move forward in their choice of implementation languages.
The NSA's split offensive/defensive responsibility is bad but that doesn't affect recommendations such as this.
- elromulous 3y agoSure. The problem is that externally one is left guessing which team something came from. I agree that this is a decent recommendation, but it would be much easier if those two responsibilities (offensive vs defensive) were two distinct agencies.