Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA OSS Technologies

nationalsecurityagency.github.io

Post reply on HN
Print view View original

91–100 of 114 posts

Re: NSA OSS Technologies

#91

Post by ganoushoreilly »

wfunction wrote: post #77
dagw wrote: post #76

Earlier quoted context omitted.

Certain government agencies and subsidiaries are exempt from having their work considered "government work" and can thus claim copyright if they want. I'm guessing the NSA is such and agency. Also if the work was actually done by a contractor then there are other exemptions.

Thanks, but I'm not sure that's it. For example, when I look at at [1], I see an apparent contradiction with [2]. It almost seems like they don't know what they're doing, but surely that's because I'm misunderstanding what's going on? [1] https://github.com/NationalSecurityAgency/DCP/blob/21c8d3efe... [2] https://github.com/NationalSecurityAgency/DCP/blob/496402fa9...

It could also be based upon patent rights, I know that employees get a 50% ownership of all patents, maybe that's part of it?

Re: NSA OSS Technologies

#92

Post by ganoushoreilly »

voltagex_ wrote: post #8
killjoywashere wrote: post #6

Earlier quoted context omitted.

OWF came up in a meeting recently -- may not be as awesome as NSA wants you to believe.

Can you share any other info?

The Ozone Widget Framework is horrible, you have to build your application sets to function standalone as well as in a modular compatibility with other widgets. Things break frequently and for the longest time Silverlight was a requirement too (well after it was canceled). It was absolutely horrible when I used it.

Re: NSA OSS Technologies

#93

Post by ganoushoreilly »

tptacek wrote: post #57
Animats wrote: post #16

Earlier quoted context omitted.

NSA has an offense side and a defense side, and they're not that tightly coordinated.

They also have several offense sides, none of which are tightly coordinated. :)

At least they merged / are merging IAD and SID, less confusion more chaos! https://www.washingtonpost.com/world/national-security/natio...

Re: NSA OSS Technologies

#94

Post by ganoushoreilly »

LunaSea wrote: post #71
jamesfe wrote: post #36

Earlier quoted context omitted.

I think you're right. It's sad to see many people are looking at these tools and performing a sort of "Allegory of the Cave" by extrapolating, then, the evils that can be done with these tools. Something, mostly common sense, tells me that we will not find some smoking gun to a crime here in these OSS repos...if anyone wanted that, they can refer to any number of leaks. Ultimately, I'm happy to see this stuff shared,…

There's multiple reasons why you wouldn't want to use these newly released open-source projects. First one is, like you said, the danger of a backdoor. The second one is that due to the very long list of non-ethical and illegal practices of the organisation you don't want to contribute or depend on them.

Bleach has been used in bombs around the world, should I not use it because there's a chance it's been used for (perceived) evil?

Re: NSA OSS Technologies

#95

Post by ganoushoreilly »

zby wrote: post #41
forgottenacc57 wrote: post #37

Why are people so welcoming to the filthy spies invading citizen privacy?

Army is created to do arguably worse things than spies. There are people who completely reject the idea of military - but the bulk of society tend to accept it as a unavoidable and tries to control it and make it least evil possible. Some spying is probably unavoidable in the current world - and just like with the army we need to think how to control it and make it civilized. Getting on a high moral horse only makes…

Side note *The Army/Navy/Marines/Af/and Coast Guard share employees with the NSA. As in, close to half the NSA employees are D.o.D Military.

Re: NSA OSS Technologies

#96

Post by angry_octet »

dfox wrote: post #81
sneak wrote: post #18

Earlier quoted context omitted.

"military-grade" doesn't mean anything in the context of crypto. We all use "military-grade" crypto every day. If your argument is that somehow the armed forces are better at computer security than the rest of us, because "military", then I reject it wholeheartedly. They are criminals and should be disbanded. The US intel community is full of cheats and liars, straight to the top. http://www.hasjamesclapperbeenindict…

In my experience what military-grade crypto really means is crypto that complies to requirements stipulated by various laws and directives related to protection of state secrets. This includes widely used cryptographic primitives (AES, SHA...), various NATO, or NATO member specific primitives (often with weird interfaces, eg. DES-like checksums in keys and such), complete cryptosystems for particular usecase (often w…

Well that is a bit uninformed. Military grade (at least the US context) means algorithms and implementations analyzed and approved for use by the NSA. Today this means 'Suite B' crypto like AES, RSA, ECDH, etc. It should also mean dedicated hardware or certified implementations, physical key fill, etc. However, the words 'military grade' are frequently abused by sales to mean a badly performing variable time noise spewing implementation of AES.

In days past the 'commercial grade' crypto was often not real crypto, like voice scramblers, using 40-bit DES (when govt was using Triple-DES), XORing against a non-cryptographic PRNG keystream repeatedly, all sorts of rubbish.

Re: NSA OSS Technologies

#97

Post by Cryptoholic »

I wonder if all the people who are really suspicious of it in here realize that this (releasing their projects as OSS) has been a thing for a while.

SELinux

Accumulo (a popular NoSQL distributed key-value store)

Apache NiFi (data processing system)

etc.

Re: NSA OSS Technologies

#98

Post by dfox »

angry_octet wrote: post #96
dfox wrote: post #81

Earlier quoted context omitted.

In my experience what military-grade crypto really means is crypto that complies to requirements stipulated by various laws and directives related to protection of state secrets. This includes widely used cryptographic primitives (AES, SHA...), various NATO, or NATO member specific primitives (often with weird interfaces, eg. DES-like checksums in keys and such), complete cryptosystems for particular usecase (often w…

Well that is a bit uninformed. Military grade (at least the US context) means algorithms and implementations analyzed and approved for use by the NSA. Today this means 'Suite B' crypto like AES, RSA, ECDH, etc. It should also mean dedicated hardware or certified implementations, physical key fill, etc. However, the words 'military grade' are frequently abused by sales to mean a badly performing variable time noise sp…

That is mostly what I meant. Military-grade means approved by NSA or it's equivalent in given state. What I tried to point out is that such approval does not necessarily mean that such cryptosystem is secure for your application (eg. various tactical radio encryption systems, "military DRM"...) or even secure and meaningful at all ("data diode", various NATO TS approved quantum cryptography things...).

Re: NSA OSS Technologies

#99

Post by SomeStupidPoint »

LunaSea wrote: post #71
jamesfe wrote: post #36

Earlier quoted context omitted.

I think you're right. It's sad to see many people are looking at these tools and performing a sort of "Allegory of the Cave" by extrapolating, then, the evils that can be done with these tools. Something, mostly common sense, tells me that we will not find some smoking gun to a crime here in these OSS repos...if anyone wanted that, they can refer to any number of leaks. Ultimately, I'm happy to see this stuff shared,…

There's multiple reasons why you wouldn't want to use these newly released open-source projects. First one is, like you said, the danger of a backdoor. The second one is that due to the very long list of non-ethical and illegal practices of the organisation you don't want to contribute or depend on them.

One thing to remember is that the NSA isn't a monolith: there are factions and differing opinions inside of the agency.

It's likely someone spent a fair amount of political capital to draw attention to the agency by emphasizing their public projects and trying to engage with the wider public. If there's a negative response to that, it only lends weight to the voices inside the agency who are against that sort of thing.

I, for one, prefer the NSA to be working on defensive technologies in collaboration with the tech community to any number of things they could be spending the resources on -- and think we badly need their expertise and help to secure domestic assets.

So I'm going to say "good job!" when they're doing things I like and save my criticism of their other behaviors for more appropriate moments.

I think collaboration is fundamentally more powerful an instrument of change than shunning is.

Re: NSA OSS Technologies

#100

Post by Cakez0r »

Spearchucker wrote: post #56
raverbashing wrote: post #51

Earlier quoted context omitted.

Are AMRAs kinda like "stored procedures" then?

AMRAs are like physical documents with an instruction to the information guardian, with a signature from the information owner, authorising access. A lot of it is electronic these days, and is automated to the point that an individual authorises access by clicking a link in an email that calls an endpoint that in turn releases a token and URL to the requestor to view the appropriate records.

So like OAuth?
Post reply on HN