71–80 of 111 posts
91% could also pretty misleading because not all vulnerabilities are equal. It's easy to let 9 potential segfaults or memory corruption issues get disclosed if you get to hold on to the 1 iOS Zero Day/Shellshock type attack/etc...
Now the question is, are vendors deliberately putting in security flaws at NSA's instigation? Intel's "system management mode" and code need to be viewed with extreme suspicion. So do network controllers which accept management commands from the network side. It would be so easy to add some system management passwords to a network controller that don't show up when you list them. (In fact, if you're willing to have t…
Now the question is, are vendors deliberately putting in security flaws at NSA's instigation? Intel's "system management mode" and code need to be viewed with extreme suspicion. So do network controllers which accept management commands from the network side. It would be so easy to add some system management passwords to a network controller that don't show up when you list them. (In fact, if you're willing to have t…
I doubt the NSA needs to instigate much. There is so much bad code in the world, and it just keeps growing, they would be in business forever just sitting on their thumbs.
Earlier quoted context omitted.
Since you mention decades of experience and information releases... A book I just read about the history of the KGB and GRU listed techniques they used to unmask CIA spies. Choice stuff. If the cultural atttache has three assistants, and two of them has offices next to the cultural attache but the third has an office in the maximum-security area, which one is the spy? If that third assistant was hired at the age of 3…
> The CIA knew about it in 1964 (probably not in detail) but the Soviets still used thee techniques to unmask three CIA spies per week in 1980. If you're the CIA and you know the Soviets are using this technique, you don't fix the problem, you use it to your advantage by letting the Soviets unmask the identities of lesser spies while not putting your most important spies on the employee list.
Earlier quoted context omitted.
That point is so important that I hesitated to add a distraction but I think it's also worth remembering that the NSA has a defensive role, too. It's been much neglected in recent decades but the entire country would be better off if the NSA helped patch things. They're hoping some suspected bad guy doesn't get patched but odds are high that many Americans, particularly important IP-heavy businesses, are going to get…
Are you seriously suggesting you don't think the security services have decades of experience in weighing the pros and cons of information release?
There hasn't been any significant counterbalance for protecting the public. This is also something of a new threat analysis model for them: software usually fails completely and globally, whereas there's never been an equivalent where someone in Russia figured out something like how to shutdown every GE industrial generator in the world without physical access. If you are used to thinking of the world in the era before pervasive internet connectivity you're going to underestimate the cost of not fixing something.
Nobody has been fired for keeping information secret or using national security as an excuse to mislead the public and even the Congress, and there's been no penalty for using those laws to conceal mistakes or abuse. That speaks of a culture which values secrecy over almost any other concern.
So, yes, they have decades of experience – but I would argue those are decades of experience with the wrong understanding and incentives.
Earlier quoted context omitted.
We have repeated proof of the opposite – Congress had to rush to retroactively legalize the mass surveillance programs, and much of what's been disclosed since is clearly unconstitutional. What they are extremely good at is using security claims to avoid ever having to see a real court. Most of the cases have been thrown out for lack of standing because it's hard to prove that you've been spied on when all of the det…
Clearly unconstitutional according to whom? It is valid to criticize the state secrets defense which keeps the NSA out of court – it's not valid to unilaterally decide what is and is not clearly unconstitutional.
https://ecf.dcd.uscourts.gov/cgi-bin/show_public_doc?2013cv0...
There's a simple rule I use for this: are they trying to prevent a court from discussing the mechanism?
You never see e.g. the FBI trying to argue that it'll endanger national security to acknowledge that they have the technical capacity to wiretap phones because that's clearly legal as long as they have a warrant. They might try to keep specific instances sealed (e.g. mob cases where retaliation is likely) but the capability and process is not secret.
As with the NSA, however, that changes once they exceed their legal authority and you see that when they do things like drop charges against known criminals rather than discuss how they used a Stingray to intercept cell-phone traffic. There's no reason to do that unless you know that the system isn't designed to follow the legal rules and thus would never survive a real court.
Earlier quoted context omitted.
"Nick, our programming ecosystem barely satisfies the basic principles of software fault tolerance, much less self-healing systems. High assurance? Multiple independent levels of security (MILS)? Covert channel resistance? Completely out of the question!" Original high assurance systems were done with Pascal, etc. Not much required in terms of programming past type and memory safety, esp strong interface checks. Plus…
The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure. Recursive restartability, microrebooting, state transfer to stable storage, event logs for fault recovery and piecewise determinism via replay o…
One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede...). I think that's most because of the government's obviously ineffectual domestic response to 9/11 and Obama's indifference to all that and inimical attitudes towards us bitter clingers (I see no signs of a "180", just dishonesty in 2008), and e.g. Bush telling us our most important duty was to go shopping. But the post-9/11 expansions of the security state are a factor.
It sure looked to me that the Church Committee et. al. had an effect for some years, and then there were great debates during the Clinton era over all this (remember the Clipper Chip?). At least they now feel a need to hide, there's a reason for that post-9/11.
Mostly political, I suspect, but it might in part be due to feeling they won't have a secure rear area if they take this too far. People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard, and we have the numbers and the means to trivially swamp them. Fortunately for all concerned, just not the motivation. Yet, and for the foreseeable future. But we are most assuredly preparing.
(And, please, no one handwave about drones et. al. Drone operators have to sleep some time at something resembling "home", there's a huge logistical tail, etc. Think also about scale, e.g. "Three Percent" of the absolute minimum 100 million gun owners in the country. And how we fight things like McCain-Feingold (Citizens United) that suppress our collective action; heck, while our betters are now trying to hide their surveillance efforts, they're quite open about frank abridgment of core political speech, which I find much more worrying.)
And as long as I'm talking about dire subjects, it's long been my considered opinion that we won't get serious about all this until there are serious atrocities coming from less than robust and secure systems. Like a few thousand people dying from such a screwup, instead of the 3 from the Therac-25.
I personally focus more on "robust" than "secure" (I noticed long before HN nickpsecurity's observation that there's no market for the latter, e.g. I was near ground zero for the final stages of the decline and fall of Multics), but they go hand in hand.
Earlier quoted context omitted.
The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure. Recursive restartability, microrebooting, state transfer to stable storage, event logs for fault recovery and piecewise determinism via replay o…
Maybe it's because we largely don't give a shit? One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede... ). I think that's most because of the government's obviously ineffectual domestic response to 9/11 an…
Violence is only permissible to defend property and retaliate against aggression, but it must be contained against the aggressors and not involve any collateral, for the latter would be unjust murder. Rest assured your pipe dreams of "hang the bastards by their entrails" and mass slaughter will only let the samsara continue, as people who approve of killing anyone by association rather than by deed will quite likely reinstate the same authoritarian measures (or worse) themselves. I have noticed that you frequently engage in outlandish Second Amendment vengeance fantasies on this board quite frequently, though. If that's your fetish, so be it, but the fact is most Americans of that persuasion are not libertarian in the slightest, but interventionist theocrats.
I'm not even sure what an "effectual domestic response to 9/11" would have been, other than do nothing, of course.
That said, I do agree it will take some wanton death before fault tolerance becomes a concern. Certainly being armed is always a good precautionary measure, but avoidance of war is a prerogative and then if war commences, it must be directed and not carpet.
Earlier quoted context omitted.
Maybe it's because we largely don't give a shit? One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede... ). I think that's most because of the government's obviously ineffectual domestic response to 9/11 an…
People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard Violence is only permissible to defend property and retaliate against aggression, but it must be contained against the aggressors and not involve any collateral, for the latter would be unjust murder. Rest assured your pipe dreams of "hang the bastards by their entrails" and mass slaughter will only let…
"We don't care."
As for "libertarian in the slightest, but interventionist theocrat", I have no idea what made you think I might be the former, nor am I the latter, nor are most of who I think the "Three Percent" might turn out to be the latter. Your mental model of me is, as far as I can tell, 90+% wrong.
Earlier quoted context omitted.
It is a purposely vague document outlining the basic form of government leaving out all important detail and deferring that to said government and courts; it is by design intended to be interpreted by qualified individuals. The notion that it's some clear simple document anyone can read and properly understand is simply contrary to history and contrary to how law operates even back then. It was never the supreme law…
What exactly is vague about this? "No Person shall be a Representative who shall not have attained to the Age of twenty five Years, and been seven Years a Citizen of the United States, and who shall not, when elected, be an Inhabitant of that State in which he shall be chosen." or this? "All Bills for raising Revenue shall originate in the House of Representatives; but the Senate may propose or concur with Amendments…
Just because you can find a few things that seems specific is in no way an argument against my point; I didn't say it had no specifics, I said much of it is vague and intentionally so. The real law of the land is the U.S. Code which is the actual law derived from the framework the constitution lays out. The notion that anyone can understand the constitution is simply wrong; without a correct legal grounding in common law and precedence you have no idea what the constitution actually means or how law is derived from it. Just because you can read a sentence does not mean you understand it the same way everyone else does nor that everyone agrees on what the words mean. That's why we have judges and precedence and a common law foundation, to guide the interpretation in a direction most can agree on.