News for hackers. Stuff that matters.

A comment on NSA Said to Have Used Heartbleed Bug for at Least Two Years (2014). Parent comment

Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by tareqak on Friday September 20, 2019 @06:04PM (#21031793)
I would argue that such a clear conflict in these two priorities should necessitate having a bespoke separate governmental organization for SIGSEC, so that the NSA can freely focus on SIGINT.
[ Parent | on HN ]
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by jjtheblunt on Friday September 20, 2019 @06:44PM (#21032064)
What is the conflict in priorities that you mean?

I ask because I considered code breaking and code making complimentary, in the sense they debug one another somewhat.

My guess is that this chance to debug one another motivates their coresidence in a single agency.

[ Parent | on HN ]
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by kelnos on Sunday September 22, 2019 @03:37PM (#21043428)
The SIGINT arm of the NSA has an incentive to take any exploitable vulnerabilities in existing software and keep them secret, so they can use them against their enemies, rather than disclosing them so they can be fixed.
[ Parent | on HN ]
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by greendestiny on Friday September 20, 2019 @09:56PM (#21032993)
Disclosing vulnerabilities.
[ Parent | on HN ]
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by blackflame7000 on Saturday September 21, 2019 @07:13PM (#21038492)
They should definitely disclose vulnerabilities in American made software for SIGSEC. If it’s foreign then not disclosing it would be SIGINT
[ Parent | on HN ]
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by ClumsyPilot on Monday September 23, 2019 @12:50PM (#21050724)
If the software is foreign made and used in US, americans are still vulnerable. And opensource isn't American/national
[ Parent | on HN ]
Re:NSA Said to Have Used Heartbleed Bug for at Least Two Yea... by kelnos on Sunday September 22, 2019 @03:37PM (#21043439)
The problem with that is there's a lot of software that's American made that is also used by potential targets of SIGINT.
[ Parent | on HN ]