4 ms·

> But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,” Or a law enforcement need? So this is almost pointless then.

> But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,” Or a law enforcement need? So this is almost pointless then. Don't expect regular iPhone or Android bugs to be reported, because law enforcement uses them all the type to tap people, so of course in their view there's a "need" for them. He should've just left it to NSA only, and for very specific cases, if at all. Everyone else (FBI, police, DHS, etc) should be reporting the exploits. As it is, don't expect them to reveal more than one relatively major bug every 2 years or so - and even that sounds optimistic, I think.

maldeh 13y ago
Call it paucity of imagination on my part, but I was wondering if somebody could make explicit some legitimate examples of situations involving a "clear national security need"? It's not like they're just making a legal exception for a "Blockbuster" scenario, where terrorists are about to nuke a city and a lone hacker saves the day by breaking SSH, right? Is this supposed to apply to instances where the flaw affects the competition more than civilians -- say, a security flaw that somehow disproportionately affects Iran, China and Russia over the US? (there are obvious reasons why the government cannot explicitly acknowledge this, but I'm wondering if this is a direct implication)
- XorNot 13y ago
  The NSA would monitor hacker message boards and the various black market websites for exploits like this. If they find something which they don't see any chatter about on any of these sources, then it's reasonable to presume no one has found it. Moreover, actually exploiting heartbleed would leave a signature. You can fake SSL certificates, but eventually someone has to lose their money, or some innovation has to come out of the blue. MitM's involve traffic diversions unless they're conducted at a government level. Espionage always leaves a trail - even if you don't know where someone gets their intel, you can always tell they must be getting it somehow.

maldeh 13y ago

Call it paucity of imagination on my part, but I was wondering if somebody could make explicit some legitimate examples of situations involving a "clear national security need"? It's not like they're just making a legal exception for a "Blockbuster" scenario, where terrorists are about to nuke a city and a lone hacker saves the day by breaking SSH, right? Is this supposed to apply to instances where the flaw affects the competition more than civilians -- say, a security flaw that somehow disproportionately affects Iran, China and Russia over the US? (there are obvious reasons why the government cannot explicitly acknowledge this, but I'm wondering if this is a direct implication)

XorNot 13y ago
The NSA would monitor hacker message boards and the various black market websites for exploits like this. If they find something which they don't see any chatter about on any of these sources, then it's reasonable to presume no one has found it. Moreover, actually exploiting heartbleed would leave a signature. You can fake SSL certificates, but eventually someone has to lose their money, or some innovation has to come out of the blue. MitM's involve traffic diversions unless they're conducted at a government level. Espionage always leaves a trail - even if you don't know where someone gets their intel, you can always tell they must be getting it somehow.