3 ms·
It's reads pretty obviously IMHO. "Any 0day has an obvious national security interest in being responsibly disclosed and fixed". That's not a very direct affi
by mpyne 13y ago
It's reads pretty obviously IMHO.
"Any 0day has an obvious national security interest in being responsibly disclosed and fixed".
That's not a very direct affirmation though, merely an "interest"... the caveats show up at the end, but even that is at least honest.
You'd be crazy if you thought NSA would disclose a server 0day that e.g. affects only websites running under a Russian locale, when those websites are known to be used by the Russian armed forces bordering Ukraine. That's the type of thing which could be useful to NSA while having practically nil effect on U.S. infrastructure.
- cyphunk 13y agoI would agree with you except that they added the "rather than". It is a debate between the 0days value as a weapon through holding secret vs value of release to everyone else. If there was any merit to them holding any bias toward the latter we would see at least ONE public disclosure of a vulnerability by them.