3 ms·
If the statement is true or not doesn't matter because this gem screams bullshit: it is in the national interest to responsibly disclose the vulnerabi
by cyphunk 13y ago
If the statement is true or not doesn't matter because this gem screams bullshit:
it is in the national interest to responsibly disclose
the vulnerability rather than to hold it for an
investigative or intelligence purpose.
Or to read that differently "The intelligence community would disclose 0days rather than use them as weapons".
- mpyne 13y agoIt's reads pretty obviously IMHO. "Any 0day has an obvious national security interest in being responsibly disclosed and fixed". That's not a very direct affirmation though, merely an "interest"... the caveats show up at the end, but even that is at least honest. You'd be crazy if you thought NSA would disclose a server 0day that e.g. affects only websites running under a Russian locale, when those websites are known to be used by the Russian armed forces bordering Ukraine. That's the type of thing which could be useful to NSA while having practically nil effect on U.S. infrastructure.
- cyphunk 13y agoI would agree with you except that they added the "rather than". It is a debate between the 0days value as a weapon through holding secret vs value of release to everyone else. If there was any merit to them holding any bias toward the latter we would see at least ONE public disclosure of a vulnerability by them.