4 ms·

Who manages the foundation, and won't tinfoil hatters just assume the foundation is being corrupted? Especially if its primary benefactors are the large corpor

Who manages the foundation, and won't tinfoil hatters just assume the foundation is being corrupted? Especially if its primary benefactors are the large corporate entities that they're already extremely afraid of?

pyre 13y ago
How would the foundation get corrupted? If someone found a vulnerability, and wanted to disclose it to them, then they would just go public if there was any "funny business" (e.g. refusing to pay-out, trying to keep the vulnerability to themselves, etc).
- michaelt 13y ago
  You could insist on a long secrecy period "to get the fix tested and rolled out", sell the vulnerability to the NSA and delay the fix for it as long as practically possible. Or the NSA could just read the vulnerability from your e-mails. It's not like the NSA needs to pay.
- nuclear_eclipse 13y ago
  I agree with you completely. Just saying that the involvement with corporate sponsors will bring out the conspiracy theorists in droves.
- rprospero 13y ago
  I think that the NSA's game plan would be the other way around. 1) Write a patch the implements a subtle security flaw in GPG. 2) Kidnap Bruce Schneier's dog 3) Send ransom note to Bruce Schneier with instructions 4) Bruce Schneier announces fake security hole in GPG and submits tainted patch to foundation 5) Foundation rejects tainted patch 5.5) Have Schneier make a big stink about the foundation not fixing the (non-existent) bug or implementing the (tainted) patch 6) Assassinate Schneier to keep him quiet 7) Mainstream declares it ridiculous that the NSA would have killed Schneier 8) Start rumor that the NSA hijacked the foundation and killed Schneier for trying to patch a critical bug. 9) The foundation's report on the security of the original code is now discredited. 10) Previously secure individuals now install the tainted NSA patch to protect themselves from a non-existent bug 11) If anyone points out the flaw in the patch or the non-existence of the original bug, hire sock-puppets to accuse them of being NSA sock-puppets.

pyre 13y ago

How would the foundation get corrupted? If someone found a vulnerability, and wanted to disclose it to them, then they would just go public if there was any "funny business" (e.g. refusing to pay-out, trying to keep the vulnerability to themselves, etc).

michaelt 13y ago
You could insist on a long secrecy period "to get the fix tested and rolled out", sell the vulnerability to the NSA and delay the fix for it as long as practically possible. Or the NSA could just read the vulnerability from your e-mails. It's not like the NSA needs to pay.
nuclear_eclipse 13y ago
I agree with you completely. Just saying that the involvement with corporate sponsors will bring out the conspiracy theorists in droves.
rprospero 13y ago
I think that the NSA's game plan would be the other way around. 1) Write a patch the implements a subtle security flaw in GPG. 2) Kidnap Bruce Schneier's dog 3) Send ransom note to Bruce Schneier with instructions 4) Bruce Schneier announces fake security hole in GPG and submits tainted patch to foundation 5) Foundation rejects tainted patch 5.5) Have Schneier make a big stink about the foundation not fixing the (non-existent) bug or implementing the (tainted) patch 6) Assassinate Schneier to keep him quiet 7) Mainstream declares it ridiculous that the NSA would have killed Schneier 8) Start rumor that the NSA hijacked the foundation and killed Schneier for trying to patch a critical bug. 9) The foundation's report on the security of the original code is now discredited. 10) Previously secure individuals now install the tainted NSA patch to protect themselves from a non-existent bug 11) If anyone points out the flaw in the patch or the non-existence of the original bug, hire sock-puppets to accuse them of being NSA sock-puppets.