Hacker News Reader

Comment by kbenson | Hacker News Reader

The same was said of selinux. I think perhaps the NSA is slightly more complicated with more complex goals than you describe.

View on HN

Are people really so quick to forget?

https://www.miracl.com/press/backdoors-in-nist-elliptic-curv...

Their goals are at the very least nationalist.

As a non US citizen why should I trust them at all?

Their main directive errodes my privacy on most levels in most sense of the words.

All I said is that they may have complex goals, while pointing out selinux was also contributed primarily by them. I take it that means your position is that they only contribute code for the purpose of exploiting people for national security, and selinux is also suspect?

I mean, being primarily contributed by the NSA is a great reason to not use SELinux, especially if you're outside of the US. AppArmor exists and does a lot of the same job, so why not use the safer option?

The chief problem with AppArmor is that its primary mechanism of identifying objects in the system (to which relevant policy rules are applied) relies on paths. In Linux, paths are not usable as strong identifiers because Linux provides a variety of ways to alias those objects. Additionally, some objects that deserve scrutiny from a mandatory access control perspective don't map cleanly to paths.

They're a spy agency, they're presumably capable of not signing their work.

Their two missions are Signals Intelligence and Information Assurance. The contributions they make to security technology and standards are going to be equally as effective no matter what country you’re a citizen of. If you think the work they release is motivated by an intention to compromise your security, then you must also believe they are trying to do the same thing to the US federal government. A goal which hardly seems very nationalist.

Did you already forget how long they knew of EternalBlue instead of immediately forcing patches?

Both of those missions are at odds with improving security. Try harder.

Information Assurance is not at odds with improving security. It is literally the NSAs mandate to improve the security of the federal government (and other US entities).

You’re making an assumption that in order to gather signals intelligence, that they need to trick people into using compromised cryptography.

A fact that is not in dispute is that huge portions of the US federal government implement NSA recommendations and standards. For your assumption to be true, the NSA must be intentionally weakening federal systems. Nothing about that seems nationalistic to me.

Has that changed? A decade ago when I looked at their charter they were supposed to strengthen security; not weaken it.

lmao at trusting their "charters" to gauge their real aims

Reply on news.ycombinator.com