Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures.

NSA does not need Microsoft's help to break into computers.

It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.

Which specific statement did I make that you disagree with? I'm happy to go into more depth.

Do you know more than I do about Microsoft's disclosures to the US Government (effectively nothing) or is it an educated guess that what they receive is comparable with MAPP?

Did I say something above that you disagree with?

MAPP customers do get proof-of-concept code to trigger the vulnerability, sometimes months in advance. That is a huge head start towards a functional exploit, and has been converted to a fully functional remote code-exec exploit prior to disclosure in at least one case that was fairly public.

Though I do not think this story has anything to do with MAPP.

Depending on the vulnerability, a crash POC might be a day's work away from an exploit, or it might be months of work.

MAPP or no MAPP, Microsoft does not have the technical capability to produce reliable exploits for all of the vulnerabilities it's made aware of.

Also, we both know NSA has a (less-well-known) charter for coordinating vulnerability response and computer security across the agencies; NSA has a public huge defensive interest in this stuff as well.

NSA doesn't need Microsoft to enable it to break into arbitrary Windows machines. But it might need their help to keep up with every attack vector on Microsoft code, which is what you need to do if you're doing defensive work.

Seems like microsoft have that expertises:

http://www.techdirt.com/articles/20130614/02110223467/micros...

This is going to sound dickish, but technically it's "the NSA," not just "NSA".

"National Security Administration doesn't need Microsoft to break into computers." vs "The National Security Administration doesn't need Microsoft to break into computers."

Too much of a tangent, perhaps?

Tangent or not I'm interested. I think its less settled than you think. In fact I was always on the opposite team; its "NSA/DoD/DoE did x" just like it is "IBM did x" and not "the IBM did x."

I did enough research to conclude that it was not a settled issue. Its clear that if the initials were lower case and referred to a generic agency that deals with national security it would be "the national security agency" similar to the "the fishing tackle section of a sporting goods store." On the other hand a gander at DoD's style guide[1] makes it clear that they do not like the "the."

I'd love to see why you think its opposite. That's not dickish, that's a desire to answer a question that's been nagging me for a long time.

[1] http://www.dtic.mil/whs/directives/corres/writing/Writing_St...

From the english.SX:

"Is it proper to use “the” before the name of a government organization?" http://english.stackexchange.com/questions/76976/is-it-prope...

"Using the definite article with acronyms and initialisms" http://english.stackexchange.com/questions/30596/using-the-d...

"Definite article with proper nouns, titles followed by a common noun" http://english.stackexchange.com/questions/2327/definite-art...

"The definite article usage with objects that have names" http://english.stackexchange.com/questions/16988/the-definit...

"Capitalising the definite article in names" http://english.stackexchange.com/questions/84288/capitalisin...

Maybe it is clearer if we note this as proper usage: "the IBM corporation."

Similarly, "the Department of Defense", "the National Security Agency".

Frankly that does not make it any clearer to me. Which could be because I am bad at the nitty gritty of english syntax. But most importantly, with all due respect you are not Strunk and White. I am looking to a clear definitive reference and in the future I cant say "I know it is written this way because hga said so."

Well, you can start here for a well referenced treatment of these nouns: http://en.wikipedia.org/wiki/Proper_noun

The reason your comment did little to clear things up is because it relied on spelling the agencies/organizations names out. It is clear that the rules change for acronyms and abbreviations.

DoD vs. DOD is a big enough debate :)

Not true. It's a proper noun, like "McDonald's". It just happens to also sound like a descriptive phrase. You'll find that, inside the agency, it is just "NSA" and not "the NSA". This is true for most "three letter agencies".

Don't believe it? See what the agency calls itself on its website: http://www.nsa.gov/

National Security Agency, not Administration ;)

Doesn't sound dickish. You're probably right. Force of habit.

I believe NSA refers to themselves without the article when the organization's name is abbreviated.

Only the official confirmation is new, word that she thought her computer(s) were compromised has been out for a while.

I'm not at all sure Linux is the solution; the only plausible culprit for whom that would be a barrier is a non-state actor doing a modern variety of "Will no one rid me of this turbulent priest" (http://en.wikipedia.org/wiki/Thomas_Becket). But the reported sophistication of the attack makes that less likely that previously speculated, and I assume that "Linux" is not a high enough barrier to a state actor.

Assuming that the NSA doesn't possess quantum computers, perhaps 4096-bit PGP email hosted on a local mail server, along with SELinux, full disk encryption and a strong firewall that blocks all incoming connections, should do the trick. Am I correct?

It's the setup I'm using now.

Do you have 24/7 control over the access to your computer? Or at least something that cannot be bypassed that would make tampering evident?

If not, you're subject to a "black bag" job that could easily bypass all your protections, e.g. a physical key logger that would pick up your password/pass phrase that unlocks your disk encryption so you can use it.

Otherwise, do you surf the net from it? I don't take all your precautions, but I do run my browsers in a dedicated VM that has limited access to the rest of my infrastructure.

> Do you have 24/7 control

Pretty much. It's a single user MacBook Air, and I carry it with me at all times, never leaving it out or in the open, or even at home. For suspicious individuals, the CIA can obtain a warrant without notifying the individual, and search his/her apartment/home at convenient times when away, so I never leave it at home, either.

It's pretty much the only computing device I have that has highly sensitive data on it. I don't really care if they take my Kindle Fire; the only stuff on that is books and personal email.

I think 99.8% of us have seen this, but perhaps you haven't.

http://xkcd.com/538/

I've seen it.

It doesn't really matter, because I've also set up a randomizing encryption passcode generator that only works with a synthetic amino acid solution that corresponds to my genome that I carry in a vial around my neck. If under duress, all I have to do is break the vial, and the system will be impenetrable. I also have another sample of the synthesis in my home, but government people can only access it with a warrant -- which they probably won't have.