3 ms·

So your argument is "If the NSA is any good, they must know about every vulnerability in the world before the private sector- otherwise they are incompetent"?

venomsnake 12y ago
With the amount of money they spend, I would suggest that the US taxpayer should get some value out of it. So while not every - at least a lot.
- scintill76 12y ago
  Right. I agree it's not reasonable to expect any one entity to know every possible vulnerability in the world. But with all the money and brains they have, how huge this particular target was (for both defensive and offensive purposes), and how high the stakes are (as they remind us whenever we challenge them), you'd think they'd have static code analysis flagging these kinds of things the moment they're checked in to a public repository of any notoriety, fuzzers running 24/7, "shadow" code review against things like OpenSSL by their best hackers, etc., at which point it does almost become incompetence that they either don't have that, or it failed. At least, I'm wondering what all that money is for. No, it doesn't really prove incompetence, but on the other hand "we released a trivial patch for an issue the private sector already found and fixed"* doesn't prove competence either, or inspire any sympathy from me. These are the types of people who trot out imagery like "cyber Pearl Harbor" when they're telling us why they need to be granted more power to protect us, yet their go-to public example of fixing a critical vulnerability in the national digital infrastructure is laughably irrelevant. * Depending on what time of day it was, the official fix may or may not have been publicly released when NSA did whatever they're claiming they did.
SwellJoe 12y ago
I don't believe the NSA are incompetent. I believe they are malevolent, in that they prioritize spying on American citizens (indirectly, of course) over finding and fixing these kinds of vulnerabilities. They expend vastly more on spying, cataloging, and archiving information about people than they do on figuring out when the software that runs the Internet is vulnerable. If they are to exist on the taxpayer dime, they should serve the taxpayer first and foremost. They like to brag about this kind of thing, because it makes them look good (and maybe allows them to believe they are "good people", as I often see folks who defend the NSA say of them) but it isn't actually their priority, and it is not something they have a history of doing. For example, this is the kind of thing the NSA actually spends significant money on: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center That same money would have employed a number of excellent security researchers, and the tools they need to help make the Internet a safer, more secure place, for all Americans. In short, this kind of article is misdirection, and people in our industry should not be snowed by those tactics. We should know better, based on their historical behavior.

venomsnake 12y ago

With the amount of money they spend, I would suggest that the US taxpayer should get some value out of it. So while not every - at least a lot.

scintill76 12y ago
Right. I agree it's not reasonable to expect any one entity to know every possible vulnerability in the world. But with all the money and brains they have, how huge this particular target was (for both defensive and offensive purposes), and how high the stakes are (as they remind us whenever we challenge them), you'd think they'd have static code analysis flagging these kinds of things the moment they're checked in to a public repository of any notoriety, fuzzers running 24/7, "shadow" code review against things like OpenSSL by their best hackers, etc., at which point it does almost become incompetence that they either don't have that, or it failed. At least, I'm wondering what all that money is for. No, it doesn't really prove incompetence, but on the other hand "we released a trivial patch for an issue the private sector already found and fixed"* doesn't prove competence either, or inspire any sympathy from me. These are the types of people who trot out imagery like "cyber Pearl Harbor" when they're telling us why they need to be granted more power to protect us, yet their go-to public example of fixing a critical vulnerability in the national digital infrastructure is laughably irrelevant. * Depending on what time of day it was, the official fix may or may not have been publicly released when NSA did whatever they're claiming they did.

SwellJoe 12y ago

I don't believe the NSA are incompetent. I believe they are malevolent, in that they prioritize spying on American citizens (indirectly, of course) over finding and fixing these kinds of vulnerabilities. They expend vastly more on spying, cataloging, and archiving information about people than they do on figuring out when the software that runs the Internet is vulnerable. If they are to exist on the taxpayer dime, they should serve the taxpayer first and foremost. They like to brag about this kind of thing, because it makes them look good (and maybe allows them to believe they are "good people", as I often see folks who defend the NSA say of them) but it isn't actually their priority, and it is not something they have a history of doing. For example, this is the kind of thing the NSA actually spends significant money on: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center That same money would have employed a number of excellent security researchers, and the tools they need to help make the Internet a safer, more secure place, for all Americans. In short, this kind of article is misdirection, and people in our industry should not be snowed by those tactics. We should know better, based on their historical behavior.