Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA OSS Technologies

nationalsecurityagency.github.io

Post reply on HN
Print view View original

71–80 of 114 posts

Re: NSA OSS Technologies

#71

Post by LunaSea »

jamesfe wrote: post #36
SomeStupidPoint wrote: post #9

There's a lot of neat things there. (This one looks interesting: https://iadgov.github.io/goSecure/ ) Also interesting is splitting the repos: that the NSA and IAD have different repos, and that one seems focused on defensive tech while the other is publishing analysis tools. I know there's a lot of people who aren't fans of the NSA (or what they do), but I think most of us can see a need for a military-grade organiz…

I think you're right. It's sad to see many people are looking at these tools and performing a sort of "Allegory of the Cave" by extrapolating, then, the evils that can be done with these tools. Something, mostly common sense, tells me that we will not find some smoking gun to a crime here in these OSS repos...if anyone wanted that, they can refer to any number of leaks. Ultimately, I'm happy to see this stuff shared,…

There's multiple reasons why you wouldn't want to use these newly released open-source projects. First one is, like you said, the danger of a backdoor. The second one is that due to the very long list of non-ethical and illegal practices of the organisation you don't want to contribute or depend on them.

Re: NSA OSS Technologies

#72

Post by marcosdumay »

voltagex_ wrote: post #3

https://github.com/ozoneplatform/owf-framework looks very interesting - NSA wrote their own BI tool?

With the selling point being that it tracks you less than other tools. In fact, avoiding tracking seems to be a prevalent line on those projects...

Yes, it's understandable, but still ironic.

Re: NSA OSS Technologies

#74

Post by ccrush »

e12e wrote: post #33
alpb wrote: post #26

Earlier quoted context omitted.

I wonder why https://www.iad.gov (linked at https://github.com/iadgov ) is not using a TLS certificate trusted in normal browsers. I cannot visit the webpage as it uses DoD Root CA, which is not installed on my computer.

Having the US department of defense be able to forge certificates for every site world-wide, in every major browser - out of the box - might be a little too much, even with the CA system as broken as it is. On the other hand, if you run your own CA and mostly care about your own users - using a cert signed by your own CA makes sense - to a certain extent.

I think the question was "why aren't they running this public website with a cert signed by a widely trusted CA"?

Re: NSA OSS Technologies

#75

Post by wfunction »

Can someone explain how some of projects can be MIT-licensed (or anything-else-licensed) as they claim? Aren't they necessarily in the public domain given that they're works of the U.S. Government?

Re: NSA OSS Technologies

#76

Post by dagw »

wfunction wrote: post #75

Can someone explain how some of projects can be MIT-licensed (or anything-else-licensed) as they claim? Aren't they necessarily in the public domain given that they're works of the U.S. Government?

Certain government agencies and subsidiaries are exempt from having their work considered "government work" and can thus claim copyright if they want. I'm guessing the NSA is such and agency. Also if the work was actually done by a contractor then there are other exemptions.

Re: NSA OSS Technologies

#77

Post by wfunction »

dagw wrote: post #76
wfunction wrote: post #75

Can someone explain how some of projects can be MIT-licensed (or anything-else-licensed) as they claim? Aren't they necessarily in the public domain given that they're works of the U.S. Government?

Certain government agencies and subsidiaries are exempt from having their work considered "government work" and can thus claim copyright if they want. I'm guessing the NSA is such and agency. Also if the work was actually done by a contractor then there are other exemptions.

Thanks, but I'm not sure that's it. For example, when I look at at [1], I see an apparent contradiction with [2]. It almost seems like they don't know what they're doing, but surely that's because I'm misunderstanding what's going on?

[1] https://github.com/NationalSecurityAgency/DCP/blob/21c8d3efe...

[2] https://github.com/NationalSecurityAgency/DCP/blob/496402fa9...

Re: NSA OSS Technologies

#78

Post by api »

One of my favorites is the Speck cipher, which has been released before:

https://en.wikipedia.org/wiki/Speck_(cipher)

I'd be very interested in more public cryptanalysis of this. It's a damn simple cipher to implement, and if it were at least as secure as say Salsa20/12 it'd be very nice for all kinds of applications.

Re: NSA OSS Technologies

#79

Post by kingbirdy »

nautilus12 wrote: post #67

Does the fact that many of these havent been updated in months or years mean that these are really old projects that effectively hold no value to the NSA and arent close to any of their core operations?

Or they've received updates that make them too important to release? But likely it's just that they haven't had any major updates, and NSA internal bugfixes aren't important enough to push out, or aren't given out due to worries that that would be a national security issue somehow
Post reply on HN