5 ms·

Last sentence reads: "Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabiliti

Last sentence reads: "Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities." So, should the NSA decide that there is a national security interest or law enforcement need, they will not disclose such vulnerabilities. Given their past behavior and explanations for what was considered acceptable compromise for national security, I am not particularly reassured by this statement. Yes, it's good that they weren't hoarding this particular exploit. But, they have clearly not denied being in possession of other exploits; they've only said that the ones they might hold would be because of national security or law enforcement need.

fredgrott 13y ago
the problem is that they will always claim a need
deleted 13y ago
[deleted]
ipsin 13y ago
Their statement would carry much more weight if they could point to one example of an exploitable zero-day they've actually disclosed. I don't particularly trust the NSA, but this example probably exists.
- eliteraspberrie 13y ago
  With regard to the Linux kernel, for example, their policy was to not look for vulnerabilities and only contribute features: Did you try to fix any vulnerabilities? No, we did not look for or find any vulnerabilities in the course of our work. We only changed enough to add our new mechanisms. http://www.nsa.gov/research/selinux/faqs.shtml#I16 http://www.nsa.gov/research/selinux/faqs.shtml#I16
ntaylor 13y ago
I suppose "need" is synonymous with "desire" or "usefulness".
malandrew 13y ago
It's unfortunate that they have chosen an interpretation base on any current or future need. That wildcard approach means that pretty much everything qualifies. The law should restrict things to "any current specific known need". Need should be singular and said need must be related to a specific issue or case already under investigation or surveillance. Any language more loose than that leaves open far too much room for interpretation. They should literally maintain a list of targets they want to infiltrate and that list of targets needs to be open to being audited at some point in the future shortly after the related mission for a target is complete. They should not be allow to apply the vulnerability to any new target identified after the date upon which vulnerability was discovered. These countermeasures would go a long way to prevent abuse since they can't now look at it as a weapon in their arsenal to exploit as they see fit for any future mission.

fredgrott 13y ago

the problem is that they will always claim a need

deleted 13y ago

[deleted]

ipsin 13y ago

Their statement would carry much more weight if they could point to one example of an exploitable zero-day they've actually disclosed. I don't particularly trust the NSA, but this example probably exists.

eliteraspberrie 13y ago
With regard to the Linux kernel, for example, their policy was to not look for vulnerabilities and only contribute features: Did you try to fix any vulnerabilities? No, we did not look for or find any vulnerabilities in the course of our work. We only changed enough to add our new mechanisms. http://www.nsa.gov/research/selinux/faqs.shtml#I16 http://www.nsa.gov/research/selinux/faqs.shtml#I16

ntaylor 13y ago

I suppose "need" is synonymous with "desire" or "usefulness".

malandrew 13y ago

It's unfortunate that they have chosen an interpretation base on any current or future need. That wildcard approach means that pretty much everything qualifies. The law should restrict things to "any current specific known need". Need should be singular and said need must be related to a specific issue or case already under investigation or surveillance. Any language more loose than that leaves open far too much room for interpretation. They should literally maintain a list of targets they want to infiltrate and that list of targets needs to be open to being audited at some point in the future shortly after the related mission for a target is complete. They should not be allow to apply the vulnerability to any new target identified after the date upon which vulnerability was discovered. These countermeasures would go a long way to prevent abuse since they can't now look at it as a weapon in their arsenal to exploit as they see fit for any future mission.