3 ms·

Or, they have a MAPP[1] subscription. You too could have information about bugs in Microsoft software before the fix has been released, if you could become a MA

by munin 13y ago

Or, they have a MAPP[1] subscription. You too could have information about bugs in Microsoft software before the fix has been released, if you could become a MAPP partner or subscriber. 1. http://www.microsoft.com/security/msrc/collaboration/mapp.aspx http://www.microsoft.com/security/msrc/collaboration/mapp.as...

x0x0 13y ago
If you're in the MAPP program, you promise (on application, and presumably contractually upon membership as well), to: Do you agree to publish monthly protections derived from MAPP information only after Microsoft’s public security update release? I'm doubting the NSA / military hackers make, or honor, any such agreement.
- munin 13y ago
  This is very different from your original (hysterical, sensational) claim that MSFT is giving the government "zero days" to "hack people with".
  - x0x0 13y ago
    not really what does msft think they're doing with them?
    - munin 13y ago
      "The Government" is a huge employer with a massive installation base of Windows systems, many of which contain sensitive information wanted by well motivated attackers. They would be keenly interested in new threats to those systems, the same way that any large corporation with a similar installation base and threat model would. Ask yourself, if you receive information via MAPP, you have some information which could be turned into an exploit, but it will not be useful towards a goal of hacking other peoples computers for long because, by definition, it is going to be patched soon. "Make hay while the sun shines" perhaps? The same window of opportunity is open to governments and corporations around the world (many Chinese companies are MAPP subscribes, the one leak of a MAPP exploit happened perhaps because of a Chinese company).
- superuser2 13y ago
  The NSA is not known to publish things.
  - waterlesscloud 13y ago
    Don't forget their internal 'zine, Cryptolog. There was a story here(1) about how it was recently declassified. Heavily redacted, but still very cool. http://www.nsa.gov/public_info/declass/cryptologs.shtml http://www.nsa.gov/public_info/declass/cryptologs.shtml (1) https://news.ycombinator.com/item?id=5407036 https://news.ycombinator.com/item?id=5407036
- coopdog 13y ago
  That just says you can't publish exploits derived from the ones they've told you about until they've published the original ones themselves. It doesn't say you can't use, abuse and defend against them yourself. You're effectively buying zero days.

by munin 13y ago

x0x0 13y ago

If you're in the MAPP program, you promise (on application, and presumably contractually upon membership as well), to: Do you agree to publish monthly protections derived from MAPP information only after Microsoft’s public security update release? I'm doubting the NSA / military hackers make, or honor, any such agreement.

munin 13y ago
This is very different from your original (hysterical, sensational) claim that MSFT is giving the government "zero days" to "hack people with".
- x0x0 13y ago
  not really what does msft think they're doing with them?
  - munin 13y ago
    "The Government" is a huge employer with a massive installation base of Windows systems, many of which contain sensitive information wanted by well motivated attackers. They would be keenly interested in new threats to those systems, the same way that any large corporation with a similar installation base and threat model would. Ask yourself, if you receive information via MAPP, you have some information which could be turned into an exploit, but it will not be useful towards a goal of hacking other peoples computers for long because, by definition, it is going to be patched soon. "Make hay while the sun shines" perhaps? The same window of opportunity is open to governments and corporations around the world (many Chinese companies are MAPP subscribes, the one leak of a MAPP exploit happened perhaps because of a Chinese company).
superuser2 13y ago
The NSA is not known to publish things.
- waterlesscloud 13y ago
  Don't forget their internal 'zine, Cryptolog. There was a story here(1) about how it was recently declassified. Heavily redacted, but still very cool. http://www.nsa.gov/public_info/declass/cryptologs.shtml http://www.nsa.gov/public_info/declass/cryptologs.shtml (1) https://news.ycombinator.com/item?id=5407036 https://news.ycombinator.com/item?id=5407036
coopdog 13y ago
That just says you can't publish exploits derived from the ones they've told you about until they've published the original ones themselves. It doesn't say you can't use, abuse and defend against them yourself. You're effectively buying zero days.