2 ms·
Not necessarily, this might actually be an approved ass-covering leak. You may think it's awful that the NSA knew for 2 years, and didn't push fixes... but the
by gojomo 13y ago
Not necessarily, this might actually be an approved ass-covering leak.
You may think it's awful that the NSA knew for 2 years, and didn't push fixes... but their funders and overseers, in Congress and the DoD, would be more likely angry if, given the NSA's massive budget and mission, the NSA didn't know about this bug right away via code audit/analysis. Knowing vulnerabilities first is the whole job of the "Cyber Command".
And, the best defense isn't necessarily a panicked fire-drill of preemptive patching ASAP, if you're sure you're the only ones who know. It could make tactical and economic sense to simply prepare contingency plans, and wait for the first evidence of a 2nd-discoverer.
- malandrew 13y agoA possible smoking gun in this case would be to check if most of the NSA's and the DOD systems over which it has oversight were not vulnerable this entire time while the private sector remained vulnerable. If they truly didn't know about this, you'd expect that a lot of the US government infrastructure has also been vulnerable this entire time. I've seen the Alexa top 1000 list showing who was vulnerable. I wonder if there is a similar list for the top 1000 computer systems and networks over which the NSA has security oversight.