Hacker News Reader

Comment by sacrosanct | Hacker News Reader

> One of the goals of the National Security Agency (NSA) is to advance the state of cybersecurity

Don't forget the NSA does both offense and defense. More so offense from what I've gathered. Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0]

[0] https://en.wikipedia.org/wiki/NOBUS

View on HN

To be fair, a lot of the people involved in the offensive side find their forever homes in defensive cybersecurity orgs in the private sector. If you take a long view of it, the offensive/defensive split is a lot less ominous.

The tools are similar too. There’s a very thin line between defensive cyber tools and malware sometimes.

>Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0]

A bit like spinning off many military/space technological advances for civilian applications while keeping the juicy bits secret, no?

I like GPS. I also like that the US has the best GPS-guided munitions.

  > Millions of innocent civilians in the middle east aren't as happy about it though.

In the interest of both sides there's a much more real and concrete Vulnerabilities Equities Process, that has been used to report zero days.

https://en.m.wikipedia.org/wiki/Vulnerabilities_Equities_Pro...

https://www.wired.com/story/nsa-windows-10-vulnerability-dis...

It's important to remember this because those two subgroups are often in contention with one another. This is why you see high ranking members of the NSA (or other groups) advocating for strong encryption as well as high ranking members advocating against encryption. It is always clear who is who by what they are advocating for. But we definitely have a bias for hearing red team instead of blue team. I hope that shifts, because blue team is far more important (and a substantially more difficult problem).

Reply on news.ycombinator.com