NSA revelations could hurt collaboration with 'betrayed' hackers • Hacker News Board

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#51

Post by mcguire » Fri, Aug 09, 2013, 3:47 PM UTC

Interesting paragraph from the Reuters article:

"Some security experts remain supportive of the government. NSA Director Keith Alexander's talk at the Black Hat conference was well received on Wednesday, despite a few hecklers.

"...Alexander took a conciliatory tone during his Black Hat speech, defending the NSA but saying he looked forward to a discussion about how it could do things better."

The article portrays Black Hat as the more "professional" conference, as opposed to Def Con.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#52

Post by Helianthus » Fri, Aug 09, 2013, 3:56 PM UTC

neutronicus wrote: post #31

DevX101 wrote: post #3

Earlier quoted context omitted.

I don't think there will be droves of people leaving because of recent scandals. But it sure will make it harder to answer a smart college grad who asks "Why should I work for the NSA?" when he/she has options at private tech companies.

The answer is easy. I like money, I like job security, I like playing for a winner, I like being on the bleeding edge. Were I crypto guy, I would snatch up a vacated-on-principle spot at the NSA in a heartbeat.

I guess at least you know your price.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#53

Post by rgbrgb » Fri, Aug 09, 2013, 4:10 PM UTC

rdl wrote: post #43

tptacek wrote: post #29

The most dangerous and stupid meme percolating in pop tech culture is that the people engaged with tech culture have a unique claim to computer science, electrical engineering, cryptography, information security, and privacy technology. The Slashdot diaspora genuinely believes that most of the world's computer engineering talent reads their comments. The reality is that not only does money do a fine job of buying tal…

Generally I'd agree except for two points. 1) From what I've seen, at least on the military side, the "training people" concept was actually one of the things they've sacrificed over the past decade or so (and even in the late 1990s) -- it's still obviously done in areas where it's "inherently military or governmental" like flying fighter aircraft, but contractorization has caused the government sphere to revert to m…

> Think about how fucked up a tech company would be if it got to the scale of Microsoft or Google but without being able to hire non-citizens, have people enter/leave freely, hire anyone with at all a shady background, interact much with the outside world, etc.

Not to mention not hiring anyone who smokes marijuana. That would eliminate like 60% of the best CS grads I know.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#54

Post by rdl » Fri, Aug 09, 2013, 4:11 PM UTC

I'm certainly not a TAO offensive security type, but maybe I'm somewhat representative of median people in the security space. I was certainly more than willing to work for USG at one point, but the "crypto wars" of the 1990s (as well as the end of the cold war and lack of a mission) convinced me not to go to NSA then (I was going to do ROTC -> NSA). Post-9/11, I fully supported both the USG infosec mission and the use of sigint/etc. to go after specific foreign terrorist groups, and worked as a defense contractor with what that entails (although doing nothing so glamorous as NSA/TAO/etc., but at least not running a helpdesk for ITT either. I envied INSCOM/ISA so much.).

Now, I'd have a really hard time doing anything more contractory than selling totally standardized COTS products to the USG, even something non-threatening like a better teleconferencing system, until/unless there is re-established effective elected oversight (i.e. congress, as a whole, and not just 15 committee members with little interest, expertise, or competence) over these programs. Not really holding my breath on that.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#55

Post by WettowelReactor » Fri, Aug 09, 2013, 4:11 PM UTC

mjolk wrote: post #32

tptacek wrote: post #29

The most dangerous and stupid meme percolating in pop tech culture is that the people engaged with tech culture have a unique claim to computer science, electrical engineering, cryptography, information security, and privacy technology. The Slashdot diaspora genuinely believes that most of the world's computer engineering talent reads their comments. The reality is that not only does money do a fine job of buying tal…

>In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications. Math is math and it's relatively easy to implement decent encryption -- it is possible to pass data securely from end to end. The larger issue with these projects is that they're usually proposed by someone that can sling a bit of Ruby and fashions him/herself a cyber r…

You make it seem like crypto is a solved domain. Implementation of crypto is incredibly difficult to do right even when the underlying "math" is provably secure.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#56

Post by tptacek » Fri, Aug 09, 2013, 4:12 PM UTC

rgbrgb wrote: post #53

rdl wrote: post #43

Earlier quoted context omitted.

Generally I'd agree except for two points. 1) From what I've seen, at least on the military side, the "training people" concept was actually one of the things they've sacrificed over the past decade or so (and even in the late 1990s) -- it's still obviously done in areas where it's "inherently military or governmental" like flying fighter aircraft, but contractorization has caused the government sphere to revert to m…

> Think about how fucked up a tech company would be if it got to the scale of Microsoft or Google but without being able to hire non-citizens, have people enter/leave freely, hire anyone with at all a shady background, interact much with the outside world, etc. Not to mention not hiring anyone who smokes marijuana. That would eliminate like 60% of the best CS grads I know.

It's the "CS grads you know" thing that is the problem. There's plenty of Venn overlap between hardcore CS and ROTC, too. They're just not the people we hang out with.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#57

Post by rdl » Fri, Aug 09, 2013, 4:13 PM UTC

rgbrgb wrote: post #53

rdl wrote: post #43

Earlier quoted context omitted.

Generally I'd agree except for two points. 1) From what I've seen, at least on the military side, the "training people" concept was actually one of the things they've sacrificed over the past decade or so (and even in the late 1990s) -- it's still obviously done in areas where it's "inherently military or governmental" like flying fighter aircraft, but contractorization has caused the government sphere to revert to m…

> Think about how fucked up a tech company would be if it got to the scale of Microsoft or Google but without being able to hire non-citizens, have people enter/leave freely, hire anyone with at all a shady background, interact much with the outside world, etc. Not to mention not hiring anyone who smokes marijuana. That would eliminate like 60% of the best CS grads I know.

FWIW, NSA doesn't hire people who "smoke" marijuana, but probably doesn't have a huge problem now (extrapolating from the past) with people who "smoked" marijuana. It's probably below "has a foreign spouse" on their rejection criteria, provided it was "a college thing".

FBI and other LEOs had a much more serious antidrug screening than DOD or IC.

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#58

Post by smtddr » Fri, Aug 09, 2013, 4:14 PM UTC

seiji wrote: post #42

mjolk wrote: post #32

Earlier quoted context omitted.

>In fact, I think it's likely that they're significantly smarter than any of us. Bear that in mind when you design your NSA-proof email applications. Math is math and it's relatively easy to implement decent encryption -- it is possible to pass data securely from end to end. The larger issue with these projects is that they're usually proposed by someone that can sling a bit of Ruby and fashions him/herself a cyber r…

Math is math Physics is physics. We all know time is fixed, the universe has been around forever, and atoms are the smallest indivisible component of matter. The world, under the guise of "everybody is created equal," has fallen under the spell of "everybody has the same intellectual capacity" (which is clearly wrong). Yahoo isn't paying a high school dropout $100 million + $80 million because of his snazzy FU-my-mom…

> The world, under the guise of "everybody is created equal," has fallen under the spell of "everybody has the same intellectual capacity" (which is clearly wrong). Yahoo isn't paying a high school dropout $100 million + $80 million because of his snazzy FU-my-mom-dresses-me haircut — they're paying him that because he's different. He's better. He's done more in five years than you've done in 20. You can't train that. People just are.

Don't agree. I don't like the idea that knowing some fancy-trendy-computer skill is equal to "He's different", "He's better.". Computer skills don't make you better than a plumber. It's just a skill. A skill that turns out to be in ridiculously high-demand today, but it doesn't make you better than the plumber or the janitor or the cashier at Starbucks. I know when I decided to get a BS in computer-science, I had the full intention of being a videogame developer barely making ends meet in a cockroach-filled apartment. I had absolutely no idea this whole Bay Area trendy-"web2.0"-linux-cloud-opensource movement was going to happen at all. I surely didn't plan to make even half the salary I'm getting now. This make my family incredibly fortunate, but not better than anyone else. I think HN-folks in general need reminders that we're not some group of superior beings, we're just insanely lucky we won the "career-lottery" for being in the right place at the right time with the right skills.

P.S. I don't know how we'd measure intellect, but I do believe that all healthy human beings do have the same potential for the amount of knowledge they can consume, at least at birth. And I'm not even sure how to define "healthy", Stephen Hawking probably doesn't meet most people's definition of healthy but he's very smart, right? And is he smart in all subjects? Or just physics, cosmology, astrophysics and other universe-related things? What subjects do you need to be well-versed in to be considered smart?

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#59

Post by bazillion » Fri, Aug 09, 2013, 4:19 PM UTC

tptacek wrote: post #48

krek wrote: post #45

Earlier quoted context omitted.

> NSA, which has been ~10 years ahead of private industry for the last couple decades, before which time they were even further ahead. Do you have anything to back this up other than the old rumor that NSA (specifically their crypto) was ahead of private industry by 10 years, something even Bill Binney said is probably not accurate any more. And mind you, this old "10 year ahead" phrase was always specific about cryp…

Yes, I do have things to back it up. No, I'm not simply referring to cryptography. NSA is a very large organization; Bill Binney's say-so doesn't mean a whole lot to me. Look at the kinds of people that "graduate" from NSA TAO, and note that that's the program they let us know about . If you want to be wishful about this point, I won't stop you.

All of the truly remarkable intelligences I met, I met at NSA. There are certainly people that aren't (as with any organization), but the NSA is probably the only meritocracy in the USG. The pipeline for advancement is one of either taking a technical route or a management route. This means that you can reach the highest levels of the organization and pay grades simply by being good at what you do in an analytical sense or a leadership sense.

The thing that the average HN reader doesn't realize is how much responsibility is on the shoulders of those who choose to spend their time in service to the country (this could be for any country). I couldn't imagine the comments that I've seen about blacklisting former government workers and publicly shaming service men and women coming from anyone who has carried this kind of responsibility.

My sidelining aside, you're definitely correct about TAO people being very skilled. I would have definitely loved to join their ranks. They wanted to swap a couple bodies to trade for me, but my division head wouldn't let me go =\

Re: NSA revelations could hurt collaboration with 'betrayed' hackers

#60

Post by rdl » Fri, Aug 09, 2013, 4:21 PM UTC

krek wrote: post #50

tptacek wrote: post #48

Earlier quoted context omitted.

Yes, I do have things to back it up. No, I'm not simply referring to cryptography. NSA is a very large organization; Bill Binney's say-so doesn't mean a whole lot to me. Look at the kinds of people that "graduate" from NSA TAO, and note that that's the program they let us know about . If you want to be wishful about this point, I won't stop you.

> Yes, I do have things to back it up. Such as? Bill Binney, having actually been one of the top mathematicians at NSA for 30 years, carries more weight than you do, unless you want to share specifics that back up the regurgitation of the "10 year ahead" phrase.

Binney and Wiebe left NSA at what I think was the low point of the agency, after losing political battles internally and getting marginalized.

TAO, the shift to attacking IP networks, the shift to active attacks on commercial technologies (vs. spending years to defeat a decade-long-lifecycle foreign comm or cryptosystem), etc. mostly happened after they'd left.