12 ms·

Whether it's true or not, I think the correct thing for the NSA to do would be to say that they knew about it for years and exploited it. That is their job, af

• mpyne 13y ago
  NSA has two jobs: 1. Gain signals intelligence on specified foreign targets. 2. Protect U.S. signals from having the same done to the U.S. by other states. The second responsibility is why there are things like SELinux, NSA "Suite B" cryptography, etc. It has also led to security bugfixes to open source code (such as X.org) used by NSA or within government. The reason that both duties are held in NSA is because the best way to defend against the best SIGINT hackers in the world is to have the expertise of the best SIGINT hackers in the world. It's why NFL teams have their offense practice against their own defense and vice versa. In this case the flaw is so completely egregious (and relatively easy to spot for other states' spy agencies reviewing commit diffs) that the duty of NSA would quite clearly to have been to get OpenSSL fixed, if only because so much government IT could be affected by this. The bug was introduced pre-Snowden as well, so it's not like NSA didn't have other cyber weapons to use to achieve the effects they need. So if it's true that NSA knew about the bug and let it remain open to protect "methods and sources" then they definitely chose wrong and someone needs to explain how they came to that choice...