4 ms·

This has been going on for years. It's a program that Microsoft created for passing along 0days to AV Vendors and companies so they could create detection mecha

This has been going on for years. It's a program that Microsoft created for passing along 0days to AV Vendors and companies so they could create detection mechanisms for it. http://www.microsoft.com/security/msrc/collaboration/mapp.aspx# http://www.microsoft.com/security/msrc/collaboration/mapp.as...

giardini 13y ago
Nonetheless, it's significance increases in the light of the current NSA revelations. After all, previously one could justify Microsoft's actions by claiming they were notifying the NSA of flaws in Windows so that the NSA could patch their systems ASAP. Now we would likely infer a more sinister justification.
- danielweber 13y ago
  in the light of the current NSA revelations "It fits the narrative, so it must be true." HN is getting into the same Ouroboros that Dan Rather found himself in.
- chc 13y ago
  Or, to give a less charitable phrasing, "Reposting it now causes us to draw illogical inferences due to the context at the top of our minds."
ihsw 13y ago
The difference is AV vendors use it for defensive purposes while the USG uses it for offensive (read: destructive) purposes.
- untog 13y ago
  It gives the ability for the government to use it for offensive purposes. I don't see any evidence that they've used it for such purposes.
  - danielweber 13y ago
    Right. Disclosing to some people first before you blow the patch out to the public can be of great defensive benefit. But it has to be people you trust not to blab about it, deliberately or accidentally. Apparently USG is in that category. This may allow the USG to also perpetrate attacks. But we really need some evidence of that.
  - kryten 13y ago
    Would you know or be able to provide evidence that it hasn't been used? Probably not.
    - untog 13y ago
      You're asking if I can prove a negative? No, I cannot. I think that dolphins are actually secret arsonists who set fire to oil rigs. Prove me wrong.
      - im3w1l 13y ago
        1. Oil rig fires actually occur with the same frequency in water without dolphins (making data up to go along with your example). 2. I can not see what motive dolphins could have for torching oil rigs (usg has a motive) 3. I don't think they are able to do it, we have never seen evidence them being able to harness the power of fire. (usg has access to 0days) 4. Dolpins have no record of performing other crimes or acts of sabotage before (usg has)
        untog 13y ago
        1. Doesn't prove anything. Correlation != causation. 2. Because they like fire. Prove me wrong. 3.Just because you haven't seen it doesn't mean it doesn't happen. They've had a lot of time to figure it out (they don't even have jobs) 4. They're clever animals. How can you say they wouldn't? ...to be more serious about it, I was using an extreme example to make a point. It is next to impossible to prove that someone has never done something, so when you start arguing on a basis like that you just descend into an abyss of unanswerable mess.
cududa 13y ago
Not all members of this program receive vulnerabilities at the same time.

giardini 13y ago

Nonetheless, it's significance increases in the light of the current NSA revelations. After all, previously one could justify Microsoft's actions by claiming they were notifying the NSA of flaws in Windows so that the NSA could patch their systems ASAP. Now we would likely infer a more sinister justification.

danielweber 13y ago
in the light of the current NSA revelations "It fits the narrative, so it must be true." HN is getting into the same Ouroboros that Dan Rather found himself in.
chc 13y ago
Or, to give a less charitable phrasing, "Reposting it now causes us to draw illogical inferences due to the context at the top of our minds."

ihsw 13y ago

The difference is AV vendors use it for defensive purposes while the USG uses it for offensive (read: destructive) purposes.

untog 13y ago
It gives the ability for the government to use it for offensive purposes. I don't see any evidence that they've used it for such purposes.
- danielweber 13y ago
  Right. Disclosing to some people first before you blow the patch out to the public can be of great defensive benefit. But it has to be people you trust not to blab about it, deliberately or accidentally. Apparently USG is in that category. This may allow the USG to also perpetrate attacks. But we really need some evidence of that.
- kryten 13y ago
  Would you know or be able to provide evidence that it hasn't been used? Probably not.
  - untog 13y ago
    You're asking if I can prove a negative? No, I cannot. I think that dolphins are actually secret arsonists who set fire to oil rigs. Prove me wrong.
    - im3w1l 13y ago
      1. Oil rig fires actually occur with the same frequency in water without dolphins (making data up to go along with your example). 2. I can not see what motive dolphins could have for torching oil rigs (usg has a motive) 3. I don't think they are able to do it, we have never seen evidence them being able to harness the power of fire. (usg has access to 0days) 4. Dolpins have no record of performing other crimes or acts of sabotage before (usg has)
      - untog 13y ago
        1. Doesn't prove anything. Correlation != causation. 2. Because they like fire. Prove me wrong. 3.Just because you haven't seen it doesn't mean it doesn't happen. They've had a lot of time to figure it out (they don't even have jobs) 4. They're clever animals. How can you say they wouldn't? ...to be more serious about it, I was using an extreme example to make a point. It is next to impossible to prove that someone has never done something, so when you start arguing on a basis like that you just descend into an abyss of unanswerable mess.

cududa 13y ago

Not all members of this program receive vulnerabilities at the same time.