Security Breach and Spilled Secrets Have Shaken the N.S.A. • Hacker News Board

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#111

Post by Canada » Mon, Nov 13, 2017, 1:02 AM UTC

cm2187 wrote: post #37

natch wrote: post #17

One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also capable of leaking the most sensitive and private information they collect on people. Perhaps this has not yet happened, or perhaps it has (someone will no doubt point out any known incidents here if there are any) but the idea is unnerving. Maybe my wording is…

Agree, though the only thing that gives me any comfort (and it is the same with google, gmail, facebook, etc) is that the amount of data they collect is nearly impossible to ex filtrate because of its sheer size.

Once upon a time movies were too big to download, and now look.

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#112

Post by ganoushoreilly » Mon, Nov 13, 2017, 1:05 AM UTC

appleflaxen wrote: post #40

The biggest indictment of the NSA is the fact that there has been no visible internal dissent after Snowden regarding mass surveillance. Their willingness to overlook the constitution because it's inconvenient is a far bigger problem than leaks, IMO.

I think it’s because there’s way more context to All of the stories we’ve been exposed to. We can’t judge their opinions or thoughts when we don’t know the additional details they have that would skew or change context.

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#113

Post by pm90 » Mon, Nov 13, 2017, 1:19 AM UTC

ethbro wrote: post #56

Zelphyr wrote: post #48

Earlier quoted context omitted.

Just because a lot of countries have done it doesn't make it any less shameful.

It does mean it's not universally held to be shameful.

I don't think that's the case either. Its more of a "ain't broken so why fixit" problem which hasn't affected people on a personal level just yet, so it isn't regulated as much.

Its astonishing to me that in the US it requires a court order to tap someone's phone and yet the NSA collects and analyzes the online data of US citizens...

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#114

Post by devonkim » Mon, Nov 13, 2017, 1:23 AM UTC

Spooky23 wrote: post #80

Wonnk13 wrote: post #44

Living in Maryland, I've met several young people who put in a few years at the agency (including TAO) who then left for industry. Millenials don't care about a government pension, especially when you're in a windowless SCIF hacking Perl. The US Government as a whole has a massive talent retention problem. Only the mediocre will stay at NSA / CIA now and we'll probably see more of these leaks / hacks.

Federal pay sucks by design. If you want to work for .gov, you want state/local government. The Feds want to contract out for anything they can. So you work for Lockheed or whatever and get most of the attributes of government employment.

It sucks by design compared to current markets and our job functional areas. Back in the 70s it was absolutely awesome pay in a region that wasn’t terribly expensive, but when the top n% of intelligence community engineers could easily go to a Big Tech company paying twice or three times as much it’s factors like ideology, mismatch of skills, or family that keep people in these jobs. In many other areas of government jobs, private sector pay is abysmal and the government jobs attract the best and brightest.

In my indirect experience with Lockheed, their pay wasn’t that much better than being federal (they’re still a huge federal contractor and aren’t exactly boutique). It seems like a lot when you’re used to $80-90k as a senior engineer though for years to bump into $110k on a whim (this is without being particularly special or niche, the over-funded “cyber” contracts get anyone that can read and write shellcode $140k+ which is a ton of people at NSA).

The much bigger problem hitting defense as a whole is that smaller contractors that specialized in being nimble and elite are basically being driven out of business due to federal contracting trend shifts post-sequester. Myself and many others have permanently left the IC out of exasperation with contractors now getting oftentimes less than their federal counterparts and a severe drought of technologically interesting contracts that make business sense.

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#115

Post by ilikeATMs » Mon, Nov 13, 2017, 1:34 AM UTC

a-dub wrote: post #70

This is why friends don't let friends run Windows. It's not that hard.

More than one exploit released by the shadow brokers was specifically targeted at Linux/Unix/Cisco and other operating systems... Its naive to think that other operating systems are somehow invulnerable to nation-state attackers.

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#116

Post by iamben » Mon, Nov 13, 2017, 2:16 AM UTC

natch wrote: post #17

One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also capable of leaking the most sensitive and private information they collect on people. Perhaps this has not yet happened, or perhaps it has (someone will no doubt point out any known incidents here if there are any) but the idea is unnerving. Maybe my wording is…

I'm surprised this isn't used in privacy arguments more often. Every time governments and politicians suggest tracking everything we do for our safety with the assurance our data is safe, surely it's prudent to point out that if (arguably) the most secret and advanced cyber command in the world can't keep their weapons and secrets safe, what chance do you have?

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#117

Post by cryoshon » Mon, Nov 13, 2017, 2:23 AM UTC

mnm1 wrote: post #83

Great. I hope this continues. The more the NSA has problems, the better off the rest of the rest of us are. It's unlikely the institution is even lawful--its practices certainly aren't. At the very least, it proves that the government cannot itself keep secrets, so it really needs to shut up about trying to put backdoors into software when it can't protect its own most vital software assets from leaking. I guarantee…

agreed entirely.

we need to stop thinking of maladaptive institutions as features of society gone askew, but rather as dark patterns that have emerged as a result of historical pressures.

what's the best way to stop a dark pattern at the large scale? trip it up at the small scale, where it can't react with its weight.

leak their information. jam their systems. turn off their water supply. make them show their hand for something that isn't quite worth it.

the shadow war with russia can be brough to peace later-- they know the boundary of the game we play.

for now, we must clean our own house.

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#118

Post by someguydave » Mon, Nov 13, 2017, 3:22 AM UTC

chickenbane wrote: post #67

dasil003 wrote: post #14

I don't think it's exactly right to say they should have focused on defense. The first mistake was focusing on installing a surveillance apparatus and using fear mongering to sell it politically while giving short thrift to the actual principles justifying the decision. In doing so they lost the moral high ground and opened the door for Snowdens and worse. I'm not saying the NSA has ever been a paragon of ethics, but…

I disagree; it's a focus of their existence that appears to be abandoned by the NSA - and that's dearly needed right now. From the front page of nsa.gov: "Defending our Nation. Securing the Future." The second point from their What we do page - "Defends vital networks". In the opening paragraph of Wikipedia: "The NSA is also tasked with the protection of U.S. communications networks and information systems". Etc. For…

Yeah but think about it - imagine government employees shift their entire focus onto "securing US networks". What would they do, exactly? Build their own open-source chip designs from scratch? Because that's pretty much step one.

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#119

Post by forapurpose » Mon, Nov 13, 2017, 3:39 AM UTC

Spooky23 wrote: post #105

forapurpose wrote: post #99

Earlier quoted context omitted.

> Federal pay sucks by design. If you want to work for .gov, you want state/local government State and local government employees are paid well? Where? Which ones?

Many state governments pay much better than the Federal government and offer better benefits, and don’t require that you live in the DC crazy corridor. Local governments depend on the locality — big counties and cities pay ok. It all depends on what is valuable to you.

> Many state governments pay much better than the Federal government and offer better benefits

Not to my knowledge. Which ones for what jobs, do you happen to know?

Re: Security Breach and Spilled Secrets Have Shaken the N.S.A.

#120

Post by floofyfloofer » Mon, Nov 13, 2017, 3:51 AM UTC

Has anyone done a TCO of the NSA? Like, if the NSA takes $X bn / year to run, and has $Y bn / year in negative externalities for US companies by leaking their malware, then just how much have they cost the US economy?