Hacker News Reader

Comment by anfilt | Hacker News Reader

It could also be the NSA does not trust proprietary firmware for similar reasons people are working on open source firmware to begin with.

The problem is NSA really only knows their motives.

The other problem with the NSA is that they have two goals. One is to protect the US and US entities security and the other is subvert foreign entities. If they start publicy recommending coreboot for what they deem senstive installations then their intentions are obviously not malicous. Problem is the NSA may never publicy specify that its for senstive installtions and may only ever be an internal guideline.

View on HN

Their MO seems to be to improve the overall IT security of the nation such that it's less vulnerable to less sophisticated actors but still vulnerable to them.

This is likely tacit recognition that UEFI is such a dumpster fire that it's not only vulnerable to them.

"Their MO seems to be to improve the overall IT security of the nation such that it's less vulnerable to less sophisticated actors but still vulnerable to them."

That's exactly what they do. How they rate and evaluate their high-security products (Type 1 or EAL6+) vs majority of market (EAL4 or less) under Common Criteria corroborates your claim. EAL4, which Linux and others top out at, says it's only trusted to stop "casual or inadvertant attempts to breach security." Anything prolonged or well-funded will breach it.

I've seen this play out a few times recently in NIST standards/"guidelines" or other protocols since Dual_EC_DRBG and have the opinion that there's two very opposed competing forces within not just the NSA but other agencies in general. There's plenty of publicly employed individuals who work hard to secure stuff properly, it's their entire remit. While I disagree with the pervasive surveillance state the west is creating for itself, this is not a terrible situation to have and I wish those fighting the good fight all the best.

It's for the rest of the us to work out who is who though! Cryptographers seem to be suitably aware though.

> While I disagree with the pervasive surveillance state the west is creating for itself...

The West? Really?

I think your overlooking the elephant in the room, who just happens to be Chinese and is concerned about his "social credit".

China is a dictatorship. I expect dictatorships to be evil. I hope democracies can do better.

It's possible to be concerned about both, and I am. But this discussion is about the NSA and their activities.

It's worth noting that it's even worse than that - some of the NSA employees contributing might not be aware of the motives involved if any are concealed.

From what I have read of how compartmentalized that organization is; could be no ill intent exists for now. Later however, the knowledge they gain could be used for a different purpose.

> no ill intent exists for now. Later however, the knowledge they gain

The thing is, if there's no ill intent now, there shouldn't be any backdoor to allow them to have any sort of special knowledge later. Unless you mean familiarity with the codebase in general. If they however do insert a backdoor, even without using it for anything now, "just in case", than that in itself is ill intent.

I do mean familiarity. Also, there is connections with other people in the project.

> If they start publicy recommending coreboot for what they deem senstive installations then their intentions are obviously not malicious.

How can you know that? If they actually did install a backdoor into coreboot, they'd obviously just patch it out of their own installations.

Other government agencies likely use NSA recommendations. If the NSA is recommending software that they have a backdoor to, then that would cause some.majoe problems if it came out.

I imagine senators would not like finding that they've been subject to that.

You don’t even need to get this speculative. All of the standards that both private and public sector systems must comply with are publicly available. I’ve worked with Fedramp service providers that handle varying levels of sensitive government information, they comply with the same NIST standards that you and I can download from their website. The NSA is mandated the inform large portions of those standards under their Information Assurance mission. If the NSA is tricking you and I into using compromised crypto, then they are also forcing huge amounts of federal systems to do the same.

Operation BULLRUN said they were both backdooring systems and weakening standards to ensure they could get in. There's also been attacks facilitated by their activities. Thanks to Snowden, we don't have to speculate: NSA, FBI, and CIA are enemies of the state if our cybersecurity is concerned. They must always be assumed hostile.

One exception I make is defense contractors that take money from them to build OSS tech. In that case, one can just scrutinize the tech itself. Most of the positive contributions in this area come from Galois Inc. Cryptol language is an example. On proprietary side, Rockwell Collins SHADE toolkit and AAMP7G CPU were likely NSA-funded to large degree.

On the contrary, the NSA's motives are clear and transparent. Try to make the system secure against anyone else and breakable by us.

Reply on news.ycombinator.com