4 ms·
“I know from firsthand communications that a number of people at N.I.S.T. feel betrayed by their colleagues at the N.S.A.,” Mr. Green said in an interview Tuesd
by s_q_b 13y ago
“I know from firsthand communications that a number of people at N.I.S.T. feel betrayed by their colleagues at the N.S.A.,” Mr. Green said in an interview Tuesday.
That's the understatement of the century. NIST is pissed off. Many of these guys move fluidly back and forth from NSA, and clearly they were kept in the dark.
- mcguire 13y ago"Many of these guys move fluidly back and forth from NSA..." This isn't regarded as a problem?
- influx 13y agoPart of the NSA's job is securing the United States cyber infrastructure, and the people tasked in that job take it just as seriously as the collection part. They sponsored SELinux, and their security guides are quite good: http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml http://www.nsa.gov/ia/mitigation_guidance/security_configura...
- devx 13y agoLet's see how they dramatically improve the process then. I hope they don't think statements like "we didn't do it, trust us" are enough. But it's probably best to just forget about NIST and start from scratch with a new standards body with zero influence from the government - any government(how it should be).
- zeckalpha 13y agoAlmost by definition, a standards organization would have some form of government (lowercase g) running it. What would you suggest as an alternative? Wikistandards? Even a wiki has government.
- ganeumann 13y agoThey can't fix it. As the article noted, they are required by law to consult with the NSA. While the NSA is an expert on cryptography, they are obviously (and were, obviously, at the time that law was written) conflicted. That the law says that NIST has to consult with the NSA means that the law-writers, our government, want NIST to allow NSA to weaken cryptography standards. This is not conspiracy-thinking, anyone who thought through the consequences of this law would see that this is what the NSA would try to do. Why would the cryptography community ever again cooperate with NIST while the requirement to consult with the NSA is in place? It's not a question of feeling betrayed, it's simply irrational to try to create a strong cryptography standard when the NSA is in the room. They can do that work outside of NIST.
- reinhardt 13y agoNitpicking but why understatement? Feeling betrayed sounds more serious that just pissed off.
- dhimes 13y agoJust semantics- 'feeling betrayed' is passive; 'are pissed off' is active. Probable reality- the betrayal has pissed them off.
- s_q_b 13y agoThe actual words I wanted to use wouldn't be appropriate in daily conversation. The most accurate substitutes would be incensed, enraged, livid. "Feeling betrayed" implies skulking about with a sad expression. In reality, from what I hear, I imagine it's more like senior NIST officials roaming the halls at Fort Meade looking for somebody at whom to scream strings of obscenities.