Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Government Uses Zero Days for “Offense”

eff.org

Post reply on HN
Print view View original

51–60 of 111 posts

Re: The Government Uses Zero Days for “Offense”

#51

Post by Ankaios »

frozenport wrote: post #47
peteretep wrote: post #46

Earlier quoted context omitted.

Are you seriously suggesting you don't think the security services have decades of experience in weighing the pros and cons of information release?

Whats good for one agency may be bad for another, for example the State Department might like Tor because it facilitates anonymous informants while the NSA might not like it because they can't read your email. I am not even sure if the NSA's mission extends to defending civilians.

I'm not even sure it extends to defending the government.

At least not fully enough, given the OPM breach.

Re: The Government Uses Zero Days for “Offense”

#52

Post by gnaritas »

jqm wrote: post #37
eropple wrote: post #33

Earlier quoted context omitted.

> If it were all a matter of interpretation we wouldn't need an actual written constitution. This is false, given that there is no settled jurisprudence until interpretation happens. If the Constitution said "there may be no dog-walking on Thursday", the constitutionality of dog-walking on Thursday would rest entirely upon the decisions of the judiciary with regards to its constitutionality (and this is important, as…

I don't disagree that legally you are correct. But I think you might be missing my point. The constitution is on display in the nations capital. Copies hang on the walls of courtrooms around the country. It is taught to school children. It is (in theory) the supreme law of the land. If it were meant strictly for closed door interpretation by qualified individuals I doubt this would be the case. It would be like the b…

It is a purposely vague document outlining the basic form of government leaving out all important detail and deferring that to said government and courts; it is by design intended to be interpreted by qualified individuals. The notion that it's some clear simple document anyone can read and properly understand is simply contrary to history and contrary to how law operates even back then. It was never the supreme law of the land so much as the supreme framework of the law to be later implemented by the land.

> If it were all a matter of interpretation we wouldn't need an actual written constitution.

That sentence quite literally makes no sense; all writing is a matter of interpretation, writing something down doesn't remove interpretation without great effort; in fact that's what legalese is, an attempt to remove all possible interpretation (which still fails continually; thus judges) and the constitution is not written in that manner because it's a general outline, not an attempt at really creating practical law.

Re: The Government Uses Zero Days for “Offense”

#54

Post by eliteraspberrie »

Animats wrote: post #48

Now the question is, are vendors deliberately putting in security flaws at NSA's instigation? Intel's "system management mode" and code need to be viewed with extreme suspicion. So do network controllers which accept management commands from the network side. It would be so easy to add some system management passwords to a network controller that don't show up when you list them. (In fact, if you're willing to have t…

I doubt the NSA needs to instigate much. There is so much bad code in the world, and it just keeps growing, they would be in business forever just sitting on their thumbs.

Re: The Government Uses Zero Days for “Offense”

#55

Post by jqm »

gnaritas wrote: post #52
jqm wrote: post #37

Earlier quoted context omitted.

I don't disagree that legally you are correct. But I think you might be missing my point. The constitution is on display in the nations capital. Copies hang on the walls of courtrooms around the country. It is taught to school children. It is (in theory) the supreme law of the land. If it were meant strictly for closed door interpretation by qualified individuals I doubt this would be the case. It would be like the b…

It is a purposely vague document outlining the basic form of government leaving out all important detail and deferring that to said government and courts; it is by design intended to be interpreted by qualified individuals. The notion that it's some clear simple document anyone can read and properly understand is simply contrary to history and contrary to how law operates even back then. It was never the supreme law…

What exactly is vague about this?

"No Person shall be a Representative who shall not have attained to the Age of twenty five Years, and been seven Years a Citizen of the United States, and who shall not, when elected, be an Inhabitant of that State in which he shall be chosen."

or this?

"All Bills for raising Revenue shall originate in the House of Representatives; but the Senate may propose or concur with Amendments as on other Bills"

or this?

"Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction."

Now, I agree in portions such as this:

"The Privilege of the Writ of Habeas Corpus shall not be suspended, unless when in Cases of Rebellion or Invasion the public Safety may require it."

That what comprises "public safety" is open to some degree of interpretation.

But the document, as a whole is not that opaque.

The intent is to be a transparent set of rules. Ones that you and I, as participants in a democracy can view and insist are followed. We can't just say "oh, judges know better" and leave it at that. That isn't a democracy, isn't representative and leads to a very bad place. We have to demand representation and a rule of law. We can't allow the law to be bent to the point it really isn't law anymore. We, as citizens, must be in control of our government. To do that, we must individually be able to read and judge the rules and ascertain if they are or are not being followed. And elect those who agree to uphold rather than subvert the process.

Re: The Government Uses Zero Days for “Offense”

#56

Post by DGAP »

xenadu02 wrote: post #25

Let's just keep writing operating systems and security-sensitive code in C. I'm sure this time we'll have even better development practices. This time we'll do better code reviews. This time the static analysis tools will catch more problems. If we all close our eyes and wish really hard we can avoid inconveniencing a few programmers, save a few CPU cycles, and keep using C. After all, the performance is totally wort…

It seems somewhat absurd to blame the existence of bugs and zero day vulnerabilities on one language, especially when that language is one of the best supported and most powerful. Unless you can figure out a way to remove humans from both the creation and use of software, I anticipate we'll have issues like these for the foreseeable future.

Of course, HN commenters like you probably think if we all switched to Go or Swift there'd never be any bugs ever again...

Re: The Government Uses Zero Days for “Offense”

#57

Post by eliteraspberrie »

nickpsecurity wrote: post #8

It's good news to me. The NSA's mission means they're going to have to get in somehow . FBI, too. Bulk collection and subversion have huge issues. Targeted collection with 0-days in endpoints that we know are insecure is much closer to Constitution than most of what they do. If people want that to go away, they could always apply methods for building secure systems from ground up. I've posted plenty here and elsewher…

I'm glad you brought this up. I know people who benefit from secure software today (they actually exist) and they are all customers. I don't know many users who can say the same.

For example, I've heard rumours about a formally-verified and usable replacement for PGP. Great... until the conversation turns to price:

PGP sucks!

Would you pay $10 for something better?

Heck no! PGP is free.

I think of security in terms of interests. Your interests, the developers' interests, and whether they align. I'm convinced the only scenario where our interests as users align with those of the developers is if we pay them directly. Not with ads, not with donations, not through foundations.

Re: The Government Uses Zero Days for “Offense”

#58

Post by Kalium »

frozenport wrote: post #47
peteretep wrote: post #46

Earlier quoted context omitted.

Are you seriously suggesting you don't think the security services have decades of experience in weighing the pros and cons of information release?

Whats good for one agency may be bad for another, for example the State Department might like Tor because it facilitates anonymous informants while the NSA might not like it because they can't read your email. I am not even sure if the NSA's mission extends to defending civilians.

In practice it does, because protecting civilian software systems is generally a good way for them to protect their own systems.

Re: The Government Uses Zero Days for “Offense”

#59

Post by techdragon »

peteretep wrote: post #46
acdha wrote: post #17

Earlier quoted context omitted.

That point is so important that I hesitated to add a distraction but I think it's also worth remembering that the NSA has a defensive role, too. It's been much neglected in recent decades but the entire country would be better off if the NSA helped patch things. They're hoping some suspected bad guy doesn't get patched but odds are high that many Americans, particularly important IP-heavy businesses, are going to get…

Are you seriously suggesting you don't think the security services have decades of experience in weighing the pros and cons of information release?

Their history has shown a trend toward less and less disclosure over time. Each successive "war" takes longer and longer for things to be declassified.

I've got extremely detailed material in my library published within years of the end of WW1 the sorts of detail I honestly never expect to see again.

The long cold war "taught" them to not trust the public, and the global media environment and the Internet only multiply their concerns.

Even if they have reasons to release... Those are increasingly washed away by their fear. We the public grow to accept "infinite secrecy" inch by inch, it's the Overton Window and sadly it works.

Re: The Government Uses Zero Days for “Offense”

#60

Post by akshatpradhan »

acdha wrote: post #17
facetube wrote: post #13

Earlier quoted context omitted.

Against Americans? Yes. The rule of law demands it.

That point is so important that I hesitated to add a distraction but I think it's also worth remembering that the NSA has a defensive role, too. It's been much neglected in recent decades but the entire country would be better off if the NSA helped patch things. They're hoping some suspected bad guy doesn't get patched but odds are high that many Americans, particularly important IP-heavy businesses, are going to get…

The NSA knows little about defense. They keep saying Defense in Depth but even they don't know what that means. Its Security Compliance guys! Defense in depth (Castle Approach) is Security Compliance because the Security Controls are defined in ISO 27002, FEDRAMP, CCM!
Post reply on HN