3 ms·

I don't see what's wrong with speculating about this. It seems to be a completely valid concern given the recent news that Microsoft has, in the past, shared 0-

I don't see what's wrong with speculating about this. It seems to be a completely valid concern given the recent news that Microsoft has, in the past, shared 0-days with the NSA. It is not an outlandish conspiracy theory to think that, after being informed of a vulnerability, Microsoft could pass it on to intelligence agencies in advance of Patch Tuesday, giving them up to 2 weeks' time to make use of the exploits. "Past behavior is the best predictor of future behavior", and all that. [edit]Link for reference, if anyone missed that particular news: http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t... [/edit]

tptacek 13y ago
Microsoft passes information about vulnerabilities to all sorts of companies prior to Patch Tuesday, not just government agencies. That's not news; it only seems like news because the people paying attention to the NSA stories don't generally pay attention to how security patch management works. NSA does not need Microsoft's help to break into Windows boxes. What's wrong with speculating that the Microsoft Bug Bounty is an NSA-influenced plot to funnel zero-day to the government is that that's a stupid conspiracy theory. It's elaborate and complicated in ways that the NSA doesn't need to deal with. It also casts aspersions on the people at Microsoft --- who are actual people who you can actually talk to --- who worked very hard to make this program happen after Microsoft spent years being criticized for not doing this.
- benregenspan 13y ago
  "Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials" From this and other assertions made in the Bloomberg piece, it seems very fair not to read this as conventional patch management, but as a special arrangement with intelligence agencies. And to read this as, yes, from time to time Microsoft's help does get the NSA into Windows boxes. Now, we all know that tech reporting often leaves something to be desired. If you're saying the officials were wrong or quoted out of context, then that's fine. But it's not reasonable to dismiss this out of hand as some outlandish Alex Jonesian conspiracy theory. BTW, obviously I'm not saying that Microsoft's bug bounty program is an NSA plot. It's a good program that every major company should have. I'm also not saying that they don't share bugs with other partners ahead of time, they obviously do. Just that from what the sources in this article (which again, did not originally appear on infowars.com) say, Microsoft does have a special arrangement with intelligence agencies and from time to time has shared bugs knowing they might be exploited by said agencies. The bug bounty program could find the sort of bugs that would (incidentally) be shared as part of this arrangement.

tptacek 13y ago

Microsoft passes information about vulnerabilities to all sorts of companies prior to Patch Tuesday, not just government agencies. That's not news; it only seems like news because the people paying attention to the NSA stories don't generally pay attention to how security patch management works. NSA does not need Microsoft's help to break into Windows boxes. What's wrong with speculating that the Microsoft Bug Bounty is an NSA-influenced plot to funnel zero-day to the government is that that's a stupid conspiracy theory. It's elaborate and complicated in ways that the NSA doesn't need to deal with. It also casts aspersions on the people at Microsoft --- who are actual people who you can actually talk to --- who worked very hard to make this program happen after Microsoft spent years being criticized for not doing this.

benregenspan 13y ago
"Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials" From this and other assertions made in the Bloomberg piece, it seems very fair not to read this as conventional patch management, but as a special arrangement with intelligence agencies. And to read this as, yes, from time to time Microsoft's help does get the NSA into Windows boxes. Now, we all know that tech reporting often leaves something to be desired. If you're saying the officials were wrong or quoted out of context, then that's fine. But it's not reasonable to dismiss this out of hand as some outlandish Alex Jonesian conspiracy theory. BTW, obviously I'm not saying that Microsoft's bug bounty program is an NSA plot. It's a good program that every major company should have. I'm also not saying that they don't share bugs with other partners ahead of time, they obviously do. Just that from what the sources in this article (which again, did not originally appear on infowars.com) say, Microsoft does have a special arrangement with intelligence agencies and from time to time has shared bugs knowing they might be exploited by said agencies. The bug bounty program could find the sort of bugs that would (incidentally) be shared as part of this arrangement.