Live data from Hacker News

The Government Uses Zero Days for “Offense”

eff.org

31–40 of 111 posts

Re: The Government Uses Zero Days for “Offense”

#31

Let's just keep writing operating systems and security-sensitive code in C. I'm sure this time we'll have even better development practices. This time we'll do better code reviews. This time the static analysis tools will catch more problems. If we all close our eyes and wish really hard we can avoid inconveniencing a few programmers, save a few CPU cycles, and keep using C. After all, the performance is totally wort…

I don't get if you are sarcastic or not.

Re: The Government Uses Zero Days for “Offense”

#32

Let's just keep writing operating systems and security-sensitive code in C. I'm sure this time we'll have even better development practices. This time we'll do better code reviews. This time the static analysis tools will catch more problems. If we all close our eyes and wish really hard we can avoid inconveniencing a few programmers, save a few CPU cycles, and keep using C. After all, the performance is totally wort…

The issue is not writing such software in some other language. The issue is rewriting such software in some other language. That's a very very large pile of functionality to implement all over again. In the process new bugs will be introduced, including new security bugs. While it's easy enough to write a toy system in some other language and get a paper published, a more fruitful approach for making a real world system secure is to do so incrementally. Look at the L4 family of microkernels for an example.

Re: The Government Uses Zero Days for “Offense”

#33
post #30

Earlier quoted context omitted.

Clearly unconstitutional according to whom? It is valid to criticize the state secrets defense which keeps the NSA out of court – it's not valid to unilaterally decide what is and is not clearly unconstitutional.

If it were all a matter of interpretation we wouldn't need an actual written constitution. If it were all up to judges the constitution wouldn't be on display and would be written in Latin or somesuch. But the constitution is public, readable and fairly plain. Now maybe the constitution is outdated. Maybe it should be changed. I don't know that. But from what the constitution reads at this point a number of these mea…

> If it were all a matter of interpretation we wouldn't need an actual written constitution.

This is false, given that there is no settled jurisprudence until interpretation happens. If the Constitution said "there may be no dog-walking on Thursday", the constitutionality of dog-walking on Thursday would rest entirely upon the decisions of the judiciary with regards to its constitutionality (and this is important, as the court can functionally ignore provisions of the constitution under accepted judicial doctrine; being lashed to two-hundred-year-old thinking is not an inherent good and so plenty of escape hatches have been created over time).

> But from what the constitution reads at this point a number of these measures are manifestly unconstitutional

You speak imprecisely. You think (and maybe I do, too) that those measures are unconstitutional. Until they are ruled unconstitutional by a court (and the decision upheld on appeal, ruled on by the Supreme Court, etc. etc.), the most you can realistically say is that something might be unconstitutional. That's how checks and balances work--only the judiciary can say one way or the other, and that's by design.

Re: The Government Uses Zero Days for “Offense”

#34

Let's just keep writing operating systems and security-sensitive code in C. I'm sure this time we'll have even better development practices. This time we'll do better code reviews. This time the static analysis tools will catch more problems. If we all close our eyes and wish really hard we can avoid inconveniencing a few programmers, save a few CPU cycles, and keep using C. After all, the performance is totally wort…

What do you consider to be a safer language? It seems like in most 'safe' languages you are relying on the language implementer to provide security and the compiler to basically catch the same mistakes that the static analysis tools do. You could consider this a variant of, "don't roll your own" but when a vulnerability is discovered it might be out of your control until the next release.

Re: The Government Uses Zero Days for “Offense”

#35
post #17

Earlier quoted context omitted.

Against Americans? Yes. The rule of law demands it.

That point is so important that I hesitated to add a distraction but I think it's also worth remembering that the NSA has a defensive role, too. It's been much neglected in recent decades but the entire country would be better off if the NSA helped patch things. They're hoping some suspected bad guy doesn't get patched but odds are high that many Americans, particularly important IP-heavy businesses, are going to get…

Okay, so let's say American businesses can't get hacked so easily by nationstates and have their secrets stolen. Also, Iran has successfully tested a nuclear bomb. Is that the world you'd prefer?

Re: The Government Uses Zero Days for “Offense”

#36
post #33
post #30

Earlier quoted context omitted.

If it were all a matter of interpretation we wouldn't need an actual written constitution. If it were all up to judges the constitution wouldn't be on display and would be written in Latin or somesuch. But the constitution is public, readable and fairly plain. Now maybe the constitution is outdated. Maybe it should be changed. I don't know that. But from what the constitution reads at this point a number of these mea…

> If it were all a matter of interpretation we wouldn't need an actual written constitution. This is false, given that there is no settled jurisprudence until interpretation happens. If the Constitution said "there may be no dog-walking on Thursday", the constitutionality of dog-walking on Thursday would rest entirely upon the decisions of the judiciary with regards to its constitutionality (and this is important, as…

What you have described is the sort of government we have, but it's not one characterized by the rule of law -- or at least not characterized so thoroughly as you imply. If law can be retconned, then we are not ruled by law at all; we are ruled by the ones doing the retconning.

Re: The Government Uses Zero Days for “Offense”

#37
post #33
post #30

Earlier quoted context omitted.

If it were all a matter of interpretation we wouldn't need an actual written constitution. If it were all up to judges the constitution wouldn't be on display and would be written in Latin or somesuch. But the constitution is public, readable and fairly plain. Now maybe the constitution is outdated. Maybe it should be changed. I don't know that. But from what the constitution reads at this point a number of these mea…

> If it were all a matter of interpretation we wouldn't need an actual written constitution. This is false, given that there is no settled jurisprudence until interpretation happens. If the Constitution said "there may be no dog-walking on Thursday", the constitutionality of dog-walking on Thursday would rest entirely upon the decisions of the judiciary with regards to its constitutionality (and this is important, as…

I don't disagree that legally you are correct.

But I think you might be missing my point. The constitution is on display in the nations capital. Copies hang on the walls of courtrooms around the country. It is taught to school children. It is (in theory) the supreme law of the land.

If it were meant strictly for closed door interpretation by qualified individuals I doubt this would be the case. It would be like the bible during the dark ages. Only highly trained and qualified priests would be able to correctly understand it and pass their deciphering on to the masses.

The point is that we live in a democracy. We are entitled to read the agreement we are supposed to be living under and to ascertain that it is (or isn't) being followed. In theory, (if anyone gave a shit), we can then elect people who will appoint judges who actually follow the document rather than weaseling around it for who knows what purpose while keeping the masses in the dark.

Now, maybe the system is in need of overhaul for new times. But that is how it is supposed to work. Don't _ever_ feel you aren't qualified to ascertain an injustice or an infraction of the rules. And please don't suggest others don't have this right either. Down that path lies darkness.

Re: The Government Uses Zero Days for “Offense”

#38
post #17

Earlier quoted context omitted.

That point is so important that I hesitated to add a distraction but I think it's also worth remembering that the NSA has a defensive role, too. It's been much neglected in recent decades but the entire country would be better off if the NSA helped patch things. They're hoping some suspected bad guy doesn't get patched but odds are high that many Americans, particularly important IP-heavy businesses, are going to get…

Okay, so let's say American businesses can't get hacked so easily by nationstates and have their secrets stolen. Also, Iran has successfully tested a nuclear bomb. Is that the world you'd prefer?

This is such a laughably typical strawman excuse that is used to shut down all discussion on this topic.

Re: The Government Uses Zero Days for “Offense”

#39

Does the EFF really expect the NSA to publicly detail every time they've used an exploit offensively?

Against Americans? Yes. The rule of law demands it.

Ha. I think we have established that such a silly distinction is clearly not relevant. What about the illegals in the country? Are they subject to being targeted? How about their illegal children born in the commission of a crime? Those aren't Americans, so they can be targeted? Remember, we wisely suspended the Posse Comitatus

Re: The Government Uses Zero Days for “Offense”

#40
post #17

Earlier quoted context omitted.

That point is so important that I hesitated to add a distraction but I think it's also worth remembering that the NSA has a defensive role, too. It's been much neglected in recent decades but the entire country would be better off if the NSA helped patch things. They're hoping some suspected bad guy doesn't get patched but odds are high that many Americans, particularly important IP-heavy businesses, are going to get…

Why do you think the two are mutually exclusive? I was under the impression that the NSA publishes security advisories all the time?

At least one issue is perception of the NSA by the talented people that the NSA needs to recruit. At the time I graduated CS undergrad in 2010, the NSA was still seen as "Sketchy, but good (and reliable) on the balance." Post-Snowden, views have changed. If the NSA can't do a better job of public relations, nobody is going to want to work for them, and then this defensive work won't be done as well.
Post reply on HN