3 ms·

> ...any time they pushed an update that sent data somewhere new... So you think making the NSA (or any govt agency) the gatekeeper for all data, public and pr

by beambot 12y ago

> ...any time they pushed an update that sent data somewhere new... So you think making the NSA (or any govt agency) the gatekeeper for all data, public and private, would be a good idea? As if there's no way that could be abused? No thanks.

derefr 12y ago
The data wouldn't go through them, nor would they be responsible for auditing the algorithms themselves. The comparison with the FDA was exact: they would simply require the company to execute a study proving (to peer review) the data-integrity of each change they were going to make. The one interesting thing is that this would likely enforce an open-core-SOA software development model: companies would be incentivized to build a "trust kernel" of services that the government regs apply to, exposing an API with stringent access controls; and then a view layer that consumes that API, which can have whatever sloppy code they wish. The trust kernel would then have to be at least shared-source to enable the peer review necessary for study. (The company couldn't just pass the code around within a cabal of trusted peer companies, since those peers might be unfairly positively-biased.)
- gajomi 12y ago
  Sorry, I tried to write what I imagined was a clarifying comment, at least along the lines of what I thought you were trying to say. But while I was typing it you (who I imagine is the real authority on your own opinion) did exactly the same, but better.
- convivialdingo 12y ago
  That's fairly analogous to the current NIST regulations. Unfortunately, NIST has been dragging 140-3 in draft form on for years. 140-2 was written in the 1980's and reflects very badly on current hardware and software practices. Another area you could look into is Common Criteria. I find these certifications to be much more modern. I've taken products through both processes. If you're going for more than the basic levels they can be quite rigorous and thorough.
gajomi 12y ago
The parent comment is not suggesting that they are the gatekeepers of the data, but rather that they act as a third party to authenticate data transmission. For example, company X says it wants to get you data, pass it through service Y and return Z, with the claim that the sensitive parts be secure. The role of the NSA would be to provide an audit of this process to determine whether or not security was in place. So if a service passed this hypothetical NSAs test they would actually never see any private information. The only danger is that the NSA withhold information about known insecurities, but that isn't any different from the current situation, and does not amount to "gatekeeping".

by beambot 12y ago

derefr 12y ago

The data wouldn't go through them, nor would they be responsible for auditing the algorithms themselves. The comparison with the FDA was exact: they would simply require the company to execute a study proving (to peer review) the data-integrity of each change they were going to make. The one interesting thing is that this would likely enforce an open-core-SOA software development model: companies would be incentivized to build a "trust kernel" of services that the government regs apply to, exposing an API with stringent access controls; and then a view layer that consumes that API, which can have whatever sloppy code they wish. The trust kernel would then have to be at least shared-source to enable the peer review necessary for study. (The company couldn't just pass the code around within a cabal of trusted peer companies, since those peers might be unfairly positively-biased.)

gajomi 12y ago
Sorry, I tried to write what I imagined was a clarifying comment, at least along the lines of what I thought you were trying to say. But while I was typing it you (who I imagine is the real authority on your own opinion) did exactly the same, but better.
convivialdingo 12y ago
That's fairly analogous to the current NIST regulations. Unfortunately, NIST has been dragging 140-3 in draft form on for years. 140-2 was written in the 1980's and reflects very badly on current hardware and software practices. Another area you could look into is Common Criteria. I find these certifications to be much more modern. I've taken products through both processes. If you're going for more than the basic levels they can be quite rigorous and thorough.

gajomi 12y ago

The parent comment is not suggesting that they are the gatekeepers of the data, but rather that they act as a third party to authenticate data transmission. For example, company X says it wants to get you data, pass it through service Y and return Z, with the claim that the sensitive parts be secure. The role of the NSA would be to provide an audit of this process to determine whether or not security was in place. So if a service passed this hypothetical NSAs test they would actually never see any private information. The only danger is that the NSA withhold information about known insecurities, but that isn't any different from the current situation, and does not amount to "gatekeeping".