Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA OSS Technologies

nationalsecurityagency.github.io

Post reply on HN
Print view View original

81–90 of 114 posts

Re: NSA OSS Technologies

#81

Post by dfox »

sneak wrote: post #18
SomeStupidPoint wrote: post #9

There's a lot of neat things there. (This one looks interesting: https://iadgov.github.io/goSecure/ ) Also interesting is splitting the repos: that the NSA and IAD have different repos, and that one seems focused on defensive tech while the other is publishing analysis tools. I know there's a lot of people who aren't fans of the NSA (or what they do), but I think most of us can see a need for a military-grade organiz…

"military-grade" doesn't mean anything in the context of crypto. We all use "military-grade" crypto every day. If your argument is that somehow the armed forces are better at computer security than the rest of us, because "military", then I reject it wholeheartedly. They are criminals and should be disbanded. The US intel community is full of cheats and liars, straight to the top. http://www.hasjamesclapperbeenindict…

In my experience what military-grade crypto really means is crypto that complies to requirements stipulated by various laws and directives related to protection of state secrets. This includes widely used cryptographic primitives (AES, SHA...), various NATO, or NATO member specific primitives (often with weird interfaces, eg. DES-like checksums in keys and such), complete cryptosystems for particular usecase (often with questionable security under security models used by academic cryptographers) and various utter nonsense that only exists in order to comply with aforementioned legal framework (eg. various "solutions" for connecting two systems with different security classification without actually connecting them)

In other words, military-grade means used by military, which has no meaningful correlation to security.

Re: NSA OSS Technologies

#82

Post by angry_octet »

nautilus12 wrote: post #67

Does the fact that many of these havent been updated in months or years mean that these are really old projects that effectively hold no value to the NSA and arent close to any of their core operations?

For every one of these projects someone spent a considerable effort do the paperwork to get it pushed out, have it signed off as sanitized, non-embarassing, etc. It is a lot of work to get that done in bureaucratic and risk-averse organisations.

If there had been a community contributing back I expect that there would have been more activity, but if it seems like noone will, would you spend your time pushing out regular updates?

Re: NSA OSS Technologies

#84

Post by angry_octet »

sneak wrote: post #20
blazespin wrote: post #19

I suspect there are a lot of very incredible computer programmers at the NSA and they're probably using just regular open source non security related tools every day. It's good to see that they're contributing back to the OS community what they can.

Let's not forget: these people may be skilled, but they are working against every principle of our community. https://www-androidauthority-com.cdn.ampproject.org/i/www.an...

And you pasted an amp link? Was that deep sarcasm?

The world is full of shades of grey, and black and white 'they are all evil!' is just pointless and dumb.

Re: NSA OSS Technologies

#85

Post by zitterbewegung »

rdtsc wrote: post #12

This caught my eye: > https://github.com/apache/incubator-pirk > Employing homomorphic encryption techniques, PIR enables datasets to remain resident in their native locations while giving the ability to query the datasets with sensitive terms. I can imagine a few scenarios there. One perhaps is when db admin should not find out what someone, possibly working on a classified project is querying. Or say one compartmen…

So looking at the apache incubator project pirk is retired due to inactivity [1]. Is anyone interested in reviving the project? [1] http://incubator.apache.org/projects/index.html#pirk

Re: NSA OSS Technologies

#86

Post by angry_octet »

ccrush wrote: post #74
e12e wrote: post #33

Earlier quoted context omitted.

Having the US department of defense be able to forge certificates for every site world-wide, in every major browser - out of the box - might be a little too much, even with the CA system as broken as it is. On the other hand, if you run your own CA and mostly care about your own users - using a cert signed by your own CA makes sense - to a certain extent.

I think the question was "why aren't they running this public website with a cert signed by a widely trusted CA"?

Well it is widely trusted by everyone on NIPRnet...

So TLS (X.509) only allows serving a single certificate. You have to choose to serve one trusted by people you need not to be hacked (your own CA) or a commercial one to reduce in general the likelihood of being hacked. I can see why they chose the first option.

Obviously if websites were not signed by one of the 'root trust' paths but by several, and the reputation of each of those trust paths, and the host itself, was tracked in a decentralised secure database where trust was built over time, that would be better.

Oops, I just suggested blockchain snake oil would solve something.

Re: NSA OSS Technologies

#87

Post by angry_octet »

ArneBab wrote: post #50
SomeStupidPoint wrote: post #9

There's a lot of neat things there. (This one looks interesting: https://iadgov.github.io/goSecure/ ) Also interesting is splitting the repos: that the NSA and IAD have different repos, and that one seems focused on defensive tech while the other is publishing analysis tools. I know there's a lot of people who aren't fans of the NSA (or what they do), but I think most of us can see a need for a military-grade organiz…

A danger is that if you use their tech, you might become dependent on their tools.

What, like Microsoft?

Re: NSA OSS Technologies

#88

Post by corpMaverick »

This is nice. It should all be about protecting electronic systems. To help individuals and companies build resilient systems. It protects the USA and the world economy as a whole. It should never be about spying people or even catching criminals IMHO.

Re: NSA OSS Technologies

#89

Post by dangerlibrary »

0xADADA wrote: post #59
r3bl wrote: post #48

Fun sidenote: I was the very first civilian to contribute to their GitHub project back in July 2015, when SIMP was the only project they had up on GitHub. It was literally a one letter change in the README file, but I still have the privilege to call myself the very first civilian to contribute to the NSA's open source project: https://github.com/NationalSecurityAgency/SIMP/pull/1

great job collaborating with what is, in essence; the American version of the Stasi.

There's something .. out of proportion when equating fixing a capitalization error with "collaborating." Collaborating with the Stasi often meant compromising the safety of one's friends, family, and fellow citizens - to the tune of seeing them killed or cruelly imprisoned.

Changing "Github" to "GitHub" in a text file isn't even close to the same scale, and using that language is pretty tone-deaf.

Re: NSA OSS Technologies

#90

Post by ganoushoreilly »

wfunction wrote: post #77
dagw wrote: post #76

Earlier quoted context omitted.

Certain government agencies and subsidiaries are exempt from having their work considered "government work" and can thus claim copyright if they want. I'm guessing the NSA is such and agency. Also if the work was actually done by a contractor then there are other exemptions.

Thanks, but I'm not sure that's it. For example, when I look at at [1], I see an apparent contradiction with [2]. It almost seems like they don't know what they're doing, but surely that's because I'm misunderstanding what's going on? [1] https://github.com/NationalSecurityAgency/DCP/blob/21c8d3efe... [2] https://github.com/NationalSecurityAgency/DCP/blob/496402fa9...

It could also be based upon patent rights, I know that employees get a 50% ownership of all patents, maybe that's part of it?
Post reply on HN