Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA called me after midnight and requested my source code (2018)

medium.com

Post reply on HN
Print view View original

171–180 of 219 posts

Re: The NSA called me after midnight and requested my source code (2018)

#171

Post by Hnrobert42 »

burrows wrote: post #127
rcoveson wrote: post #125

Earlier quoted context omitted.

If I ran an neighborhood ISP, and the cops asked me to spy on a neighbor (for reasons they wouldn't even provide), then I'd shut down first. If they just wanted to search _my_ stuff, sure. But if the only reason that I'm even capable of assisting the government in spying on somebody is that they are my customer, neighbor, friend, or user then I will not offer that assistance. That would be evil. Don't be evil.

The cops plant CP your servers. Help them spy on Joey Beer or they'll pursue criminal charges against you. Now what?

What are you talking about? What are the odds of this? I mean really, like out of all the CP allegations, how many of them are fabricated by the police?

Re: The NSA called me after midnight and requested my source code (2018)

#172

Post by Hnrobert42 »

Frost1x wrote: post #28
voz_ wrote: post #18

Earlier quoted context omitted.

Wait, why would you not want to use software relied on for national security interests?

Does this jump into the "something/nothing to hide" argument? The idea that there's an intentional backdoor through security for some institution that may or may not be acting in your best interest is enough for me to not want to use it. Just about everyone has something to hide, but what they're hiding and the reasons they're hiding it may only be used as leverage against them and have nothing that's a threat to any…

That’s not the question. The question is, why would opening source to the NSA cause you to lose trust in the quality of work.

You seem to have answered the question, “Why is privacy good?” Your answer, at least to me, seems valid, but if you are answering other questions, I would ask, “Can you imagine situations in which individual liberties are trumped by physical safety of a large number of folks?” How have you reacted to CoVID-19 restrictions? Are those two things really so different?

Re: The NSA called me after midnight and requested my source code (2018)

#173

Post by Hnrobert42 »

Mountain_Skies wrote: post #42
op03 wrote: post #32

July 2000 is I guess a pre-Google world...so how would "Call 411 and ask for the number of main naval base in Bethesda, MD" work? Just curious how the operator did these lookups?

Unless I'm remembering wrong, 411 only gave directory assistance for your area code. To get the phone number for a naval base in another state, he would need to dial that area code plus 555-1212 to contact the local directory assistance for that location. Might be wrong though. Where I grew up there was a charge for using directory assistance so my parent prohibited us from ever using it instead of the phone book.

Haha. I remember phone charges for stuff like that. *69 to see who called you was 50 cents. So many nickel and dime charges. Of course, back then, monthly phone bills weren’t equal to a healthy percentage of a car payment.

Re: The NSA called me after midnight and requested my source code (2018)

#174

Post by Hnrobert42 »

wil421 wrote: post #71
svenfaw wrote: post #55

Earlier quoted context omitted.

Almost everybody was already using Google by late 1999.

No they weren’t yet, you still had Yahoo, Alta Vista, Excite, Ask Jeeves and many others. Yahoo was probably the dominate one. Most households used AOL who just purchased MapQuest. The dot com bubble killed the competition.

I remember my dad telling me about google and me telling him metacrawler.com FTW. This is the same guy who showed me the WWW on a lynx browser, and I scoffed that FTP was where it’s at.

Re: The NSA called me after midnight and requested my source code (2018)

#175

Post by Hnrobert42 »

ebg13 wrote: post #113
bsamuels wrote: post #62

Earlier quoted context omitted.

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

> I'm sorry but if you think the NSA is the shadiest You're right about the detail (probably) and also very wrong to be focusing on that particular detail instead of interpreting it as just barely mild hyperbole. You've gone to "it's not the absolute worst, therefore I dismiss the statement" instead of "it's not the absolute worst, but it's still really fucking bad so I'm going to recognize the premise and move on".

I would argue there is a wide gulf between the two.

Re: The NSA called me after midnight and requested my source code (2018)

#176

Post by Hnrobert42 »

tehjoker wrote: post #114
bsamuels wrote: post #62

Earlier quoted context omitted.

I'm sorry but if you think the NSA is the shadiest government agency on the planet, then you live in an information bubble. Do you think the NSA is shadier than the KGB? What about the Iranian Revolutionary Guard? Or even the CIA? I know people are upset about the Snowden revelations but there are much graver sins that have been committed by other agencies.

You might be able to point to a regional power and say yes, these guys are pretty shady. What you have to remember though, is that the USA is a global power with global reach, so any shadiness is more scalable. Also, don't forget that the US often does stuff like hand people over to another agency knowing they'll be tortured. https://theintercept.com/2017/07/20/cameroonian-troops-tortu... EDIT: Don't forget that NSA…

Often?

Re: The NSA called me after midnight and requested my source code (2018)

#177

Post by GlenTheMachine »

_not_the_nsa_ wrote: post #132
GlenTheMachine wrote: post #44

I have been to the NSA gift shop, and they do sell the blue mugs there. But you have to have the right clearances to even get to where the gift shop is...

This isn't true, unless it's changed in recent years. There's a gift shop at the Cryptologic museum on Ft. Meade. I've taken my folks there before, although I haven't worked there in almost a decade, so maybe it's not there anymore. There are gift shops inside the buildings though, but they sell the same stuff as the other one. You don't necessarily have to be cleared to get to those, you just have to have a reason t…

Touché. I’ve never been to the museum. There’s a gift shop inside NSA proper.

Re: The NSA called me after midnight and requested my source code (2018)

#178

Post by meowface »

iancarroll wrote: post #153
bhelkey wrote: post #121

Earlier quoted context omitted.

> how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? Man in the Middle attacks work even if one goes to the official site. It could have looked something like this. 1) User attempts to go to the official site https://.. . 2) NSA intercepts the message, downgrades to http and sends back a dummy site with the malicious binary [1]. 3) The user d…

Just to be clear, no web browser has ever (AFAIK) allowed a navigation for https:// to downgrade to http:// . It's only when the protocol is not explicit (i.e. typing only "domain.com") do problems really arise.

They may have meant finding a link to it elsewhere from a plaintext site, in which case they could sslstrip it. (Before more modern safeguards, at least.)

Re: The NSA called me after midnight and requested my source code (2018)

#179

Post by meowface »

Libeste wrote: post #148
meowface wrote: post #75

Earlier quoted context omitted.

I doubt it. For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? But also, if they did want to do that, they could probably backdoor it pretty easily just by patching the binary a bit. Reverse engineering and changing binaries is way easier than cracking encryption, and they probably have some of the world's top reverse engineers. The…

>For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? The original is both pay to own and not available outside of the US. So changing either of those things would work.

I suppose, but the actual process of hosting or sharing it seems a little convoluted. And, again, they could do all this without the source code, if their goal was simply to subtly backdoor it.
Post reply on HN