Should have just driven to Ft Meade and had "Dave" meet you at the gate. It's only a 3 1/2 hour drive...
The NSA called me after midnight and requested my source code (2018)
151–160 of 219 posts
Re: The NSA called me after midnight and requested my source code (2018)
#152Earlier quoted context omitted.
I am in Norway, so the First Amendment carries little weight around here; our equivalent is 'Article 100' (of the Constitution) stating pretty much the same thing as the First Amendment. (This is hardly relevant; I just grasped the opportunity to stress that the HN crowd resides in the most peculiar places...)
Now, I definitely am biased, being a norwegian myself. But I see people mentioning themselves being norwegians everywhere here on HN. I don’t recall seeing half as many people going around saying, «I’m a dane» or similar; this seems peculiar, Norway is small. I wonder if it actually is at it seems to me, or if I just miss these seemingly non–but—actually-not–non-existant remarks.
> The frequency illusion is that once something has been noticed then every instance of that thing is noticed, leading to the belief it has a high frequency of occurrence (a form of Selection bias). The Baader–Meinhof phenomenon is the illusion where something that has recently come to one's attention suddenly seems to appear with improbable frequency shortly afterwards. The Baader–Meinhof phenomenon is sometimes conflated with frequency illusion and the recency illusion.
Re: The NSA called me after midnight and requested my source code (2018)
#153Earlier quoted context omitted.
I doubt it. For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? But also, if they did want to do that, they could probably backdoor it pretty easily just by patching the binary a bit. Reverse engineering and changing binaries is way easier than cracking encryption, and they probably have some of the world's top reverse engineers. The…
> how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? Man in the Middle attacks work even if one goes to the official site. It could have looked something like this. 1) User attempts to go to the official site https://.. . 2) NSA intercepts the message, downgrades to http and sends back a dummy site with the malicious binary [1]. 3) The user d…
Just to be clear, no web browser has ever (AFAIK) allowed a navigation for https:// to downgrade to http://. It's only when the protocol is not explicit (i.e. typing only "domain.com") do problems really arise.
Re: The NSA called me after midnight and requested my source code (2018)
#154Since the source code could not help with decryption and the file was trivial to decrypt anyway, the NSA was either playing four dimensional chess that requires making a pointless midnight phone call or it's actually fallible. Rather than fairly justified suspicion of the NSA, we might want to apply Hanlon's razor in this case.
I think the NSA was rather asking him if there was a backdoor. A phone call will always be cheaper and faster than bruteforcing [current decade] cryptography.
Re: The NSA called me after midnight and requested my source code (2018)
#155Earlier quoted context omitted.
Source availability helps in crafting successful exploits in the real world. Providing the source of a closed source project to an adversary so that they can break your software is nefarious. If the author's justification was... "My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's se…
So you’re saying open source projects are less secure than closed source. You might be the only person around here to ever try that argument in public.
That's not what I'm saying at all.
Most people who argue that open source is equally or more secure than close source software do not argue that access to source code provides zero benefit to attackers. Instead, they argue that the benefit gained by the many additional sets of eyes belonging to researchers and other "good guys" outweighs the detrimental effect of letting the "bad guys" see as well.
The question in this instance is not whether the closed-source-superior or open-source-superior security camps is correct. The only related question is: "Does access to source code provide any benefit whatsoever to an attacker?"
I don't think I'm the "only person around here" who would argue that yes, it does. And that if you're taking the closed-source route, like this project's author, you can't provide copies of your source code to one specific attacker when they ask. If you do that, you're _definitely_ worse off (from a security perspective) than the people in the open source camp. I'm sure the closed-source-superiority people would agree.
Re: The NSA called me after midnight and requested my source code (2018)
#156Adam Savage (Myth Busters) once got a call from FBI because of a Star Wars movie prop (thermal detonator) he was making for a project.
He meant to call his supervisor to leave a voicemail regarding the thermal detonator prop used in Star Wars, but apparently it was left at a wrong number. And that random person called FBI because he heard thermal detonator in the voicemail.
Here's the link :) https://youtu.be/ZjpPgv9XtJA?t=1008
Re: The NSA called me after midnight and requested my source code (2018)
#157Earlier quoted context omitted.
Source availability helps in crafting successful exploits in the real world. Providing the source of a closed source project to an adversary so that they can break your software is nefarious. If the author's justification was... "My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's se…
So you’re saying open source projects are less secure than closed source. You might be the only person around here to ever try that argument in public.
Not necessarily - the normal argument for open source being secure is that the source code can be reviewed by the community and any security issues will be noticed and patched. In this case the parent specifically mentions source code the community doesn't have access to.
Re: The NSA called me after midnight and requested my source code (2018)
#158I drew the ire of our security services in a much dumber way sometime in the early nineties; after having seen Wargames, I set up my MicroVAX, rescued from a dumpster at the local bank, to ID as a DoD box whenever any of my friends dialled into it. A few weeks into this, I get a summons to get down to the local police station ASAP. The commissioner then gives me a good verbal beating for being such a stupid kid; appa…
I miss the days when you could do stuff like this without ending up in prison.
Re: The NSA called me after midnight and requested my source code (2018)
#159I would have demanded, at a minimum, to be told exactly how the NSA located me in exchange for my source code.
Re: The NSA called me after midnight and requested my source code (2018)
#160Certainly doesn't make me want to use any software made by this guy.
Better not use any software by Microsoft then. Also definitely none of that scary open source stuff by people who’ll just hand over the code to anyone who asks.
Kind of missing the point, it's not about the source code. It's about the authors willingness to cooperate just because an NSA agent implied "it's important".