5 ms·

When people are labeled geniuses, independent evidence is important, especially when they've become a cause célèbre. Geniuses generally have a body of work to

by Edmond 13y ago

When people are labeled geniuses, independent evidence is important, especially when they've become a cause célèbre. Geniuses generally have a body of work to stand on, not just a friend/family/colleague opinion.

geetee 13y ago
Body of work? Perhaps you may have heard about his NSA leaks?
louthy 13y ago
Independent evidence is clearly going to be thin on the ground if he was doing work for the NSA. As mentioned before, it's the opinion of his co-worker. Now that co-worker may have been an incompetent and saw everything that Snowden did as 'genius'. Or, it may be the case that he really was one. Who knows, but at least it's a slightly different viewpoint on the thing.
jonknee 13y ago
I would say being a self-taught computer expert who out-smarted the most technically advanced intelligence agency in the history of the world at their own game would lend itself to being a body of work. He also outmaneuvered the State Department and as a lone actor has been able to thumb his nose at the most powerful people in the world while his data has been front page news in dozens of countries around the world for months. It's all quite surreal and I would not underestimate the man.
- chris_mahan 13y ago
  His achievements, in so short a life, are nothing less than astounding.
- simoncion 13y ago
  > ...out-smarted the most technically advanced intelligence agency in the history of the world at their own game... The lifting of sensitive NSA documents smells to me of gross incompetence. It troubles me that this hasn't gotten more discussion. Snowden was working for Booz Allen Hamilton in Hawaii. While working for this government contractor, he managed to copy a great many secrets that were probably supposed to be very inaccessible to him. 1) Why does the NSA outsource IT work (and, more critically, the storage of extremely sensitive information) to a third party? (Or do I misunderstand BAH's role in the matter?) 2) One of the NSA's missions is to provide computer security to USGov and the nation as a whole. How good at that job could they possibly be if they can't keep their secrets from insiders who wish to obtain them? 3) Snowden has not been outed as black, white, or grey-hat hacker. It has been claimed that Snowden asked other co-workers with greater access for their credentials and used those to copy sensitive data. Either that claim is true, or BAH seriously fucked up their SELinux permissions and gave sysadmins read access to everything. Either way, the documents were likely not obtained through technical wizardry, but were likely acquired through exploitation of human incompetence. Snowden may be a very skilled individual, but it seems very likely that his skills had nothing to do with the acquisition of that document cache.
  - jessaustin 13y ago
    You seem to think that exploiting human weakness is somehow out-of-bounds for attackers. Do you, by any chance, set policy for the NSA?
    - simoncion 13y ago
      Exploiting human weakness is totally fair game. I am not an NSA policy setter. I have never directly worked for any government agency, but I have worked as a computer security auditor. If you don't account for human weakness in the threat models for your high value assets, you've already lost. While there are no silver bullets, there are auditing policies [0] and technological mechanisms [1] that attempt to prevent improper use of credentials or improper access of information, and can detect instances of the same after the fact. Yes, this sort of thing requires a lot of thought to set up, personnel to maintain, political capital to keep going, and regular objective and honest reevaluations to ensure continued effectiveness. However, I don't see any other way to do this if you've data that you need to protect from your enemies. If protecting the NSA's highly sensitive information isn't worth all that trouble, is it actually worth protecting? [0] Such as daily inspection of badge-in, badge-out, log-in, log-out, and document/resource access logs to verify physical presence and ensure that one isn't reading things that one's not supposed to have access to. [1] Such as proper use of SELinux for fine-grained access control, WORM logging devices for tamper-resistant logging, account lockouts on detection of data access or log-in irregularities to minimize damage from account "spoofing" [You're at lunch, but you logged in to another computer? You badged-out for the day, but pulled some document from backup at the office? Instant lockout, termination of all of your processes across all systems, and message to facility security.], etc. etc..
      - malandrew 13y ago
        Exactly. Exploiting the human elements of a system is often the best way into any system that is trying to be secure. It's been that way since forever. There's even an entire book on the subject by Kevin Mitnick that is very well known, "The Art of Deception: Controlling the Human Element of Security"

by Edmond 13y ago

geetee 13y ago

Body of work? Perhaps you may have heard about his NSA leaks?

louthy 13y ago

Independent evidence is clearly going to be thin on the ground if he was doing work for the NSA. As mentioned before, it's the opinion of his co-worker. Now that co-worker may have been an incompetent and saw everything that Snowden did as 'genius'. Or, it may be the case that he really was one. Who knows, but at least it's a slightly different viewpoint on the thing.

jonknee 13y ago

I would say being a self-taught computer expert who out-smarted the most technically advanced intelligence agency in the history of the world at their own game would lend itself to being a body of work. He also outmaneuvered the State Department and as a lone actor has been able to thumb his nose at the most powerful people in the world while his data has been front page news in dozens of countries around the world for months. It's all quite surreal and I would not underestimate the man.

chris_mahan 13y ago
His achievements, in so short a life, are nothing less than astounding.
simoncion 13y ago
> ...out-smarted the most technically advanced intelligence agency in the history of the world at their own game... The lifting of sensitive NSA documents smells to me of gross incompetence. It troubles me that this hasn't gotten more discussion. Snowden was working for Booz Allen Hamilton in Hawaii. While working for this government contractor, he managed to copy a great many secrets that were probably supposed to be very inaccessible to him. 1) Why does the NSA outsource IT work (and, more critically, the storage of extremely sensitive information) to a third party? (Or do I misunderstand BAH's role in the matter?) 2) One of the NSA's missions is to provide computer security to USGov and the nation as a whole. How good at that job could they possibly be if they can't keep their secrets from insiders who wish to obtain them? 3) Snowden has not been outed as black, white, or grey-hat hacker. It has been claimed that Snowden asked other co-workers with greater access for their credentials and used those to copy sensitive data. Either that claim is true, or BAH seriously fucked up their SELinux permissions and gave sysadmins read access to everything. Either way, the documents were likely not obtained through technical wizardry, but were likely acquired through exploitation of human incompetence. Snowden may be a very skilled individual, but it seems very likely that his skills had nothing to do with the acquisition of that document cache.
- jessaustin 13y ago
  You seem to think that exploiting human weakness is somehow out-of-bounds for attackers. Do you, by any chance, set policy for the NSA?
  - simoncion 13y ago
    Exploiting human weakness is totally fair game. I am not an NSA policy setter. I have never directly worked for any government agency, but I have worked as a computer security auditor. If you don't account for human weakness in the threat models for your high value assets, you've already lost. While there are no silver bullets, there are auditing policies [0] and technological mechanisms [1] that attempt to prevent improper use of credentials or improper access of information, and can detect instances of the same after the fact. Yes, this sort of thing requires a lot of thought to set up, personnel to maintain, political capital to keep going, and regular objective and honest reevaluations to ensure continued effectiveness. However, I don't see any other way to do this if you've data that you need to protect from your enemies. If protecting the NSA's highly sensitive information isn't worth all that trouble, is it actually worth protecting? [0] Such as daily inspection of badge-in, badge-out, log-in, log-out, and document/resource access logs to verify physical presence and ensure that one isn't reading things that one's not supposed to have access to. [1] Such as proper use of SELinux for fine-grained access control, WORM logging devices for tamper-resistant logging, account lockouts on detection of data access or log-in irregularities to minimize damage from account "spoofing" [You're at lunch, but you logged in to another computer? You badged-out for the day, but pulled some document from backup at the office? Instant lockout, termination of all of your processes across all systems, and message to facility security.], etc. etc..
    - malandrew 13y ago
      Exactly. Exploiting the human elements of a system is often the best way into any system that is trying to be secure. It's been that way since forever. There's even an entire book on the subject by Kevin Mitnick that is very well known, "The Art of Deception: Controlling the Human Element of Security"