4 ms·

I wonder if the NSA will open source their server architecture?

mindcrime 13y ago
Believe it or not, they do open source some of their stuff, sometimes. See, for example, Accumulo.[1][2] [1]: http://en.wikipedia.org/wiki/Apache_Accumulo http://en.wikipedia.org/wiki/Apache_Accumulo [2]: http://accumulo.apache.org/ http://accumulo.apache.org/
- sliverstorm 13y ago
  Another classic example, SELinux.[1] [1]: http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overview http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overvie...
  - jlgaddis 13y ago
    SELinux saved my ass years ago, preventing exploitation of an outdated/vulnerable PHP application. Since then, it gets installed on every production server I deploy. Those who simply turn it off because it's a PITA are doing themselves a huge disservice.
    - daned 13y ago
      Would love to hear details on how it protected you.
      - jlgaddis 13y ago
        An outdated version of a PHP application (which had a public vulnerability) was attacked, allowing arbitrary code execution. The "exploit" attempted to download and execute a remote file via TFTP. Ultimately, a "remote shell" would end up being installed on the server. SELinux, however, prevented the TFTP transfer from happening. We saw this in the audit logs, investigated, and discovered what had happened (and, of course, updated the PHP application). If the attack had succeeded, I'm convinced that it eventually would have ended up as a full ("root-level") compromise.
- snowwrestler 13y ago
  I believe NSA has a dual mandate. We are hearing a lot lately about their efforts to discover and use intelligence via electronic means, but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications--this is where efforts like SELinux and the guide to securing OS X come from.
  - fnordfnordfnord 13y ago
    >but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications How can anyone find them credible in such a role with such huge glaring conflicts of interests, and their demonstrated lack of trustworthiness?
    - toomuchtodo 13y ago
      One hand doesn't know what the other hand is doing. Just because the DOD bombs civilians with drones in far off doesn't mean we should hold the National Park Service in the same light.
      - fnordfnordfnord 13y ago
        The National Park Service isn't a division of the DOD.
        toomuchtodo 13y ago
        They're all a part of the US government.
        fnordfnordfnord 13y ago
        So all US government agencies are in effect one? What am I to make of the GAO constantly finding fraud and waste? A clever subterfuge?

Believe it or not, they do open source some of their stuff, sometimes. See, for example, Accumulo.[1][2] [1]: http://en.wikipedia.org/wiki/Apache_Accumulo http://en.wikipedia.org/wiki/Apache_Accumulo [2]: http://accumulo.apache.org/ http://accumulo.apache.org/

sliverstorm 13y ago
Another classic example, SELinux.[1] [1]: http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overview http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overvie...
- jlgaddis 13y ago
  SELinux saved my ass years ago, preventing exploitation of an outdated/vulnerable PHP application. Since then, it gets installed on every production server I deploy. Those who simply turn it off because it's a PITA are doing themselves a huge disservice.
  - daned 13y ago
    Would love to hear details on how it protected you.
    - jlgaddis 13y ago
      An outdated version of a PHP application (which had a public vulnerability) was attacked, allowing arbitrary code execution. The "exploit" attempted to download and execute a remote file via TFTP. Ultimately, a "remote shell" would end up being installed on the server. SELinux, however, prevented the TFTP transfer from happening. We saw this in the audit logs, investigated, and discovered what had happened (and, of course, updated the PHP application). If the attack had succeeded, I'm convinced that it eventually would have ended up as a full ("root-level") compromise.
snowwrestler 13y ago
I believe NSA has a dual mandate. We are hearing a lot lately about their efforts to discover and use intelligence via electronic means, but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications--this is where efforts like SELinux and the guide to securing OS X come from.
- fnordfnordfnord 13y ago
  >but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications How can anyone find them credible in such a role with such huge glaring conflicts of interests, and their demonstrated lack of trustworthiness?
  - toomuchtodo 13y ago
    One hand doesn't know what the other hand is doing. Just because the DOD bombs civilians with drones in far off doesn't mean we should hold the National Park Service in the same light.
    - fnordfnordfnord 13y ago
      The National Park Service isn't a division of the DOD.
      - toomuchtodo 13y ago
        They're all a part of the US government.
        fnordfnordfnord 13y ago
        So all US government agencies are in effect one? What am I to make of the GAO constantly finding fraud and waste? A clever subterfuge?