3 ms·

Nothing you've uttered refutes the point - that Microsoft hand over vulnerabilities to the NSA, and delay fixing them. Read the docs.

tptacek 13y ago
Feel free to cite the document that shows Microsoft delaying fixes for NSA.
- fit2rule 13y ago
  Do your own homework, you know how to use Google - so go use it .. a simple query "Microsoft collaborates with NSA" turns up enough reading material .. of course, unless you don't want it to be so easy to enlighten yourself on the issue, in which case no document is going to convince you of your position.
  - Phlarp 13y ago
    I love seeing Tptacek being proven wrong as much as the rest of us; but this is just weak.
    - fit2rule 13y ago
      I have no idea who Tptacek is, but - is it really so hard to pay attention? Microsoft collaborates with the NSA. Its in the docs, its been news for months.
      - Phlarp 13y ago
        For something so obviously well known you seem to have difficulty providing evidence of your specific allegation (microsoft giving NSA advance notice of unpatched zero days.) I don't doubt it happens, so much as I expect extraordinary claims be backed with extraordinary evidence.
        fit2rule 13y ago
        Start your homework engine: http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t... http://arstechnica.com/security/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ http://arstechnica.com/security/2013/06/nsa-gets-early-acces...
        tptacek 13y ago
        I don't understand. Does the way your argument work rely on people not having read the other comments on this thread? Because neither of those two articles back up the claim made about NSA and Microsoft, and both appear to describe a publicly-known documented program run by Microsoft. And, both of those points have already been made on the thread.
      - diminoten 13y ago
        I'm a little slow, my Googling skills suck, and I've been living under a rock for... let's just say "months". Can you spoon-feed me the exact article, line, and phrase where you got this idea that Microsoft delays fixing vulnerabilities at the NSA's behest?
  - balthazar 13y ago
    These guys are focusing narrowly on your choice of words ("delay fixes"). It was outed by the Guardian that Microsoft actively circumvents the security of some major products (Outlook, Skype) for the NSA. The Guadrian never released the Snowden doc for Microsoft collaboration [0]. Therefore, we don't the specifics of how. We just know that Microsoft backdoors its products for the federal government without telling its customers. "Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;" [1] [0] https://twitter.com/ggreenwald/status/355391355939340288 https://twitter.com/ggreenwald/status/355391355939340288 [1] http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...
    - tptacek 13y ago
      No, you just introduced an entirely different concern than the one introduced by the thread. The root comment suggests that Microsoft arranges to provide NSA with vulnerabilities that they deliberately do not patch so as to maximize their value to NSA. There is no evidence that anything like this has ever happened. Your message is a red herring; I could debate your conclusions, but what would be the point? I'm sure you've got 10 more red herrings up your sleeve.
      - balthazar 13y ago
        My message is not a red herring. I did not make any conclusions of my own for you to debate. I was trying to add context (note that I replied to fit2rule, I wasn't challenging you). I quoted the Guardian and gave the reason there is no public Snowden document on the Microsoft NSA issue. Therefore, we don't know the specifics of their collaboration/cooperation. I do not dispute what you said about delayed patches, but it is meaningless without that context. To be fair, there is not much daylight between: 'The root comment suggests that Microsoft arranges to provide NSA with vulnerabilities that they deliberately do not patch' and what the Guardian reported about Outlook. At least to me, but I'm not a security expert. Is it not considered a 'vulnerability' if Microsoft hands over the keys so to speak? Also on a side note, it is rude to call me out like you did. I don't have herrings up my sleeves. I don't care about internet points. I just wanted to contribute more information to the discussion.
- gregsq 13y ago
  The only official response from Microsoft that I can find is in reply to a question from Bloomberg [1] on this question. Frank Shaw, lead communications for Microsoft, responded by email to the question that, according to Bloomberg, information regarding 0day or other exploits are provided to a number of government agencies as an "early start", prior to public announcement. The original email text is unavailable as far as I can see. It of course makes perfect sense that, at least under certain circumstances, and this was the sense of limit inferable from the email, that government agencies should be given the opportunity to assess whether the item being notified about has some security implication. The claim is made by Bloomberg, by reference to "two unnamed government officials", that Microsoft is aware that such information might be applied for reasons not primarily connected to domestic defensive security. But this is only an unsubstantiated assertion. The number of potential exploits that are known only to Microsoft at the time of notification to those agencies would be, at a lazy guess, somewhat proportional to their exploit assessment man hours, compared to the overall exploit discovery effort. I would think that would be the much smaller proportion. 1. http://mobile.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://mobile.bloomberg.com/news/2013-06-14/u-s-agencies-sai...
superuser2 13y ago
You read the docs. http://technet.microsoft.com/en-us/security/dn467918 http://technet.microsoft.com/en-us/security/dn467918 This is a publicly disclosed, publicly available program. Implying that it's somehow a government conspiracy is lying.

tptacek 13y ago

Feel free to cite the document that shows Microsoft delaying fixes for NSA.

fit2rule 13y ago
Do your own homework, you know how to use Google - so go use it .. a simple query "Microsoft collaborates with NSA" turns up enough reading material .. of course, unless you don't want it to be so easy to enlighten yourself on the issue, in which case no document is going to convince you of your position.
- Phlarp 13y ago
  I love seeing Tptacek being proven wrong as much as the rest of us; but this is just weak.
  - fit2rule 13y ago
    I have no idea who Tptacek is, but - is it really so hard to pay attention? Microsoft collaborates with the NSA. Its in the docs, its been news for months.
    - Phlarp 13y ago
      For something so obviously well known you seem to have difficulty providing evidence of your specific allegation (microsoft giving NSA advance notice of unpatched zero days.) I don't doubt it happens, so much as I expect extraordinary claims be backed with extraordinary evidence.
      - fit2rule 13y ago
        Start your homework engine: http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t... http://arstechnica.com/security/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ http://arstechnica.com/security/2013/06/nsa-gets-early-acces...
        tptacek 13y ago
        I don't understand. Does the way your argument work rely on people not having read the other comments on this thread? Because neither of those two articles back up the claim made about NSA and Microsoft, and both appear to describe a publicly-known documented program run by Microsoft. And, both of those points have already been made on the thread.
    - diminoten 13y ago
      I'm a little slow, my Googling skills suck, and I've been living under a rock for... let's just say "months". Can you spoon-feed me the exact article, line, and phrase where you got this idea that Microsoft delays fixing vulnerabilities at the NSA's behest?
- balthazar 13y ago
  These guys are focusing narrowly on your choice of words ("delay fixes"). It was outed by the Guardian that Microsoft actively circumvents the security of some major products (Outlook, Skype) for the NSA. The Guadrian never released the Snowden doc for Microsoft collaboration [0]. Therefore, we don't the specifics of how. We just know that Microsoft backdoors its products for the federal government without telling its customers. "Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;" [1] [0] https://twitter.com/ggreenwald/status/355391355939340288 https://twitter.com/ggreenwald/status/355391355939340288 [1] http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...
  - tptacek 13y ago
    No, you just introduced an entirely different concern than the one introduced by the thread. The root comment suggests that Microsoft arranges to provide NSA with vulnerabilities that they deliberately do not patch so as to maximize their value to NSA. There is no evidence that anything like this has ever happened. Your message is a red herring; I could debate your conclusions, but what would be the point? I'm sure you've got 10 more red herrings up your sleeve.
    - balthazar 13y ago
      My message is not a red herring. I did not make any conclusions of my own for you to debate. I was trying to add context (note that I replied to fit2rule, I wasn't challenging you). I quoted the Guardian and gave the reason there is no public Snowden document on the Microsoft NSA issue. Therefore, we don't know the specifics of their collaboration/cooperation. I do not dispute what you said about delayed patches, but it is meaningless without that context. To be fair, there is not much daylight between: 'The root comment suggests that Microsoft arranges to provide NSA with vulnerabilities that they deliberately do not patch' and what the Guardian reported about Outlook. At least to me, but I'm not a security expert. Is it not considered a 'vulnerability' if Microsoft hands over the keys so to speak? Also on a side note, it is rude to call me out like you did. I don't have herrings up my sleeves. I don't care about internet points. I just wanted to contribute more information to the discussion.
gregsq 13y ago
The only official response from Microsoft that I can find is in reply to a question from Bloomberg [1] on this question. Frank Shaw, lead communications for Microsoft, responded by email to the question that, according to Bloomberg, information regarding 0day or other exploits are provided to a number of government agencies as an "early start", prior to public announcement. The original email text is unavailable as far as I can see. It of course makes perfect sense that, at least under certain circumstances, and this was the sense of limit inferable from the email, that government agencies should be given the opportunity to assess whether the item being notified about has some security implication. The claim is made by Bloomberg, by reference to "two unnamed government officials", that Microsoft is aware that such information might be applied for reasons not primarily connected to domestic defensive security. But this is only an unsubstantiated assertion. The number of potential exploits that are known only to Microsoft at the time of notification to those agencies would be, at a lazy guess, somewhat proportional to their exploit assessment man hours, compared to the overall exploit discovery effort. I would think that would be the much smaller proportion. 1. http://mobile.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://mobile.bloomberg.com/news/2013-06-14/u-s-agencies-sai...

superuser2 13y ago

You read the docs. http://technet.microsoft.com/en-us/security/dn467918 http://technet.microsoft.com/en-us/security/dn467918 This is a publicly disclosed, publicly available program. Implying that it's somehow a government conspiracy is lying.