repples

It's most probable that Russia (or perhaps other adversarial state actors) would have given all the most sensationalist, newsworthy, and reputation-damaging material to Wikileaks, but kept the really juicy zero day exploits to itself.

If this is true, I expect the CIA and/or other agencies will have gone into defense mode and tipped off the relevant vendors, giving details of vulnerabilities they either know to be leaked or have observed to be used in active attacks.

In doing that, I can't really see the CIA revealing any more than is strictly necessary, and to a very limited set of people. Certainly not dumping a whole load of compromising material to Wikileaks.

If "_key2" is an public key embedded within Windows, then presumably there exists one or more holders of the private key somewhere - what exactly are they able to do with this key?

I've seen a lot of concern about "_key2" and "_NSAKEY" being expressed over the years, but scant technical detail.

Totally agree with you on this.

I was responding to the Quora link (where the question was "is there any evidence for backdoors in Windows or other client software for the NSA/CIA?")

That Quora post is pretty bad. Actual evidence is requested, but the top answer is a list of wild conjecture.

The responder prefaces most of their comment with "it is widely believed that" and "it is likely that", states without any explanation that the Malicious Software Removal Tool is somehow a backdoor, and that "everyone who knows about [the backdoors] is under NDA", with no evidence to support that statement either.

You really don't want to do that. Any exit node could be recording or tampering with your network traffic, e.g. using sslstrip or worse.

On the plus side, at least he didn't litter the piece with childish 'meme' images, as seems to be in vogue these days.

There's nothing stopping you from compiling https://github.com/Microsoft/ChakraCore and checking if Chakra.dll matches that which is distributed with Edge.

As Chakra is part of Edge, then Edge is not fully closed source.

Actually the JavaScript engine of Edge is open source.

Surprising as the Windows upgrade process may be to some, that's no excuse for not having backups of your data. If the plaintiffs' data was indeed "destroyed", that's on them, not Microsoft.

It's a reasonable concern that Trump may try to abuse his power in this area as well, given his rhetoric and behavior so far.

Nothing wrong with pointing that concern out, to give the article some context about the potential domestic power of this agency.

The problem with privacy extremists is that they are ruining the ideal of justice with their hardline stance on keeping things secret from the authorities. In effect, this stance is just pandering to child abusers, terrorists, etc. while offering very little positive to society in return. Everyone needs some level of personal transparency to the rest of society, for the collective good of society.

But the guy clearly had a massive stash of child pornography to hide, so I'm not really sure what your point is.

The court accepted evidence that he'd downloaded and shared all manner of such filth, including both technical evidence and testimony from his sister.

Please note that his sister testified against him:

> As part of their investigation, the Delaware County law enforcement officers also interviewed Doe’s sister, who had lived with Doe during 2015. She related that Doe had shown her hundreds of images of child pornography on the encrypted external hard drives. She told the investigators that the external hard drives included “videos of children who were nude and engaged in sex acts with other children.”

There's no racial conspiracy here, the guy is just a disgusting paedophile.

An encrypted drive will typically contain metadata identifying it as such, so no.

Or, you know, just be a decent person and don't download huge swathes of child pornography.

To be honest, it's quite disgusting that you're most concerned with how to hide such horrendous material.

Unless you've been engaging in online noncery and have amassed a gigantic collection of photographs and videos of child abuse like the scumbag described in the article has evidenced, you should be absolutely fine. It's certainly not the judge's behaviour that is sickening here.

The JavaScript engine is open source:

https://github.com/Microsoft/ChakraCore