51–60 of 120 posts
Is this even a legit website? The NSA makes announcements via their Tumblr now? Doesn't that strike anyone else as strange?
If this is true, and the NSA knew about the Heartbleed vulnerability, then how come the EFF hasn't been getting more log data showing the vulnerability being exploited against sites? How come, so far, only one person has thus far come forward with ANY evidence that might demonstrate a knowledge of this bug before it was discovered? I just find it depressing how ready the media is to jump on the NSA for things they ma…
I don't like journalism and such, but I think it's OK in this case and I don't find it a bit depressing, maybe even otherwise. Why? Because we should be aware. Always. There's no sense in blaming NSA for something. It's stupid to blame spies for spying. There's no sense in saying something they do is immoral, because it couldn't stop them from doing it. So if you care about them doing something wrong the only way to stop it is to make it impossible. If you don't want NSA to know some data that belong to you — you are enemies, because NSA wants to know anything. And it's OK. It's what they are for.
You obviously cannot prevent what already happened, you can only try to fix the consequences and be more careful in the future. So it's always sensible to assume NSA knew about any single security bug discovered for a long time. And nobody can possibly know if something is true about NSA's knowledge (maybe even not NSA themselves). So even if it's not true — spreading rumors about it is completely fine I guess.
Is this even a legit website? The NSA makes announcements via their Tumblr now? Doesn't that strike anyone else as strange?
Is this even a legit website? The NSA makes announcements via their Tumblr now? Doesn't that strike anyone else as strange?
Last sentence reads: "Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities." So, should the NSA decide that there is a national security interest or law enforcement need, they will not disclose such vulnerabilities. Given their past behavior and explanations for what was considered acceptable compromise for national security, I am…
Second:
"When Federal agencies discover a new vulnerability in commercial and open source software – a so-called “Zero day” vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose."
This is demonstrably false. That's not even a point of debate, by their own admission.
The whole statement is worthless.
Last sentence reads: "Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities." So, should the NSA decide that there is a national security interest or law enforcement need, they will not disclose such vulnerabilities. Given their past behavior and explanations for what was considered acceptable compromise for national security, I am…
I don't particularly trust the NSA, but this example probably exists.
Earlier quoted context omitted.
we need to begin putting government officials in prison for this.
Unfortunately that "we" is the government officials themselves.
Unfortunately on HN anything NSA related is going to devolve into conspiracy theory groupthink these days vs. actual rational discussion that the NSA is not all knowing (unlike every other government agency which is apparently incompetent).