Hacker News Reader

Forget surveillance data -- we have a veritable treasure trove of zero-day exploits. The US Gov (and many other's) are very active in the zero-day market with an impressive stockpile.

We have so much effort into offence that we ended up forgetting about defence, and losing the latter makes the former largely ineffective. This completely destroys the credibility of the NSA's argument that they deserve ever-more expanding powers to reach around the globe, especially given that we will have hands following the neat trail that we have behind ourselves.

Why do we give them the power to act with impunity and without oversight, trusting them to reach around the globe, when we expose ourselves the whole length of the way?

It's like leaving the door open at Fort Knox because we're too busy spying on our neighbours.

Give them the power? No that's not how it works in the USA.

Companies have free reign to do what they will, its up to us the people to demonstrate why / decide what they are doing is illegal and demand laws around it.

I think the question is why aren't more people pissed off about this? Some would say its apathy, I would say its simple lack of knowledge and understanding. Nobody wants to be spied on.

This isn't an argument in favor of the espionage state, upfront clarification. People typically aren't afraid of things they haven't yet personally been given a reason to be afraid of.

Americans are told the spying makes them safer. Americans fear terrorism, and they're told the focus of the spying is terrorism. Very, very, very few Americans have seen negative repercussions from the spying (so far as they personally notice or 'feel' going about their daily lives). So far, to that typical American, it's almost all theoretically helpful and not harmful.

I agree that a lack of understanding - properly comprehending the full historical scope and risks of such power - is at the root of why it's tolerated. I think inside of most Americans, you'll find a belief that their government can't be fundamentally evil (thus they don't fear the really bad potential outcome scenarios of such spying), even if it occasionally does something bad.

You've noted something very interesting. People in the West seem to have forgotten the essence of government. Government is not a charity. For better or for worse, it's a monopoly on violence. Any action it takes is ultimately predicated on the threat (or use) of force. IMHO the sooner people realize this, the better.

Under mass surveillance no-one voices dissent.

Pew reports most Americans have modified their online behaviour since Snowden.

An illusion of consent produced by fear.

I imagine the zero days, or at least their existence, are also vulnerable to this group.

Point is that if a group breaks-in and steals all the zero days, backdoor access, etc. - they very might be able to end the world if they wanted to do so. Further, by not focusing on defense, which is assumed by the fact that APT6 was able to get in, there's the remote chance that this might happen; hell Snowden likely could have done this if he wanted, but didn't.

How can you call them zero-day exploits when the people who "have them" can't even keep their "top secrets" secret?

I expect the other guys have them as well.

We count from when the majority of the good guys hear about them, not from when some bad guys do. The term is about response time, not exploit time.

Uncle Sam has the power to obtain all American citizen's data with relative ease, but what's worse is Uncle Sam's servers (which are numerous and disorganized[1]) are hacked even easier. [1]

TLS is cat & mouse game at this point, and we count on closed-sourced systems like Whisper to be the holy grail. It's a sad sate of affairs.

[1] http://www.zone-h.org/archive/special=1?zh=1

How do we know the NSA wan't compromised? They would never admit it voluntarily.

You can safely assume the NSA was compromised. Now what do you do differently?

Well at least you can trust them to be honest? Man, that just raises more questions.

> (and arguably in violation of the constitution)

There's nothing arguable about it.

> You may trust the US government with your data, but what if they can't protect your data once they've obtained it?

I've never understood this idea. The US government is dangerous to anyone located in the US. The Russian government is not. It will never matter to you if the Russian government has your data; it can matter a lot if the US does.

> It will never matter to you if the Russian government has your data

How do you figure that? Aside from the obvious credit card data/identity theft, there is also freedom of speech persecutions that can routinely happen should a foreign actor have your data and you traveled to their country.

Example: you are openly gay on your social media posts, and want to vacation in a foreign country that bans homosexuality. Maybe you are critical of the current Chinese leadership but still want to see the Great Wall. These are just low-hanging-fruit examples.

It's misguided to be so careless with your personal data, especially with regards to foreign actors.

> Example: you are openly gay on your social media posts, and want to vacation in a foreign country that bans homosexuality. Maybe you are critical of the current Chinese leadership but still want to see the Great Wall. These are just low-hanging-fruit examples.

It's much more likely that they will use your to arrest their own citizens for being guilty by association... which is shitty, but far less dangerous than if your own government knows your "dirty" secrets.

At worst maybe Malaysia profiles a pot-smoking Washingtonian, but even then that person still has to break the law through possession...

> even then that person still has to break the law through possession

Oh yeah, because police never plant drugs.

Until the next presidential candidate that Russia doesn't like has all his porn and affairs and other secrets dumped online. But yes it doesn't seem like the worst thing in the world.

> I've never understood this idea. The US government is dangerous to anyone located in the US. The Russian government is not. It will never matter to you if the Russian government has your data; it can matter a lot if the US does.

It does if I have to visit Moscow airport on my way somewhere.

There is one main law in Russia - don't mess with Putin and his goons. So if you don't intend to do that - you are completely safe from being a target.

Not true. Being gay doesn't mess with anyone. Still dangerous for you in Russia.

Tell that to Alexander Litvinenko.

That poor poor Soviet Spy turned traitor. Spilling state secrets - legitimate target for assassination.

And his mistake was trusting a friend. Not some data collection Russian operation.

If you enter that game - you know the risks.

"If you enter that game - you know the risks"

That's a poor justification for executing somebody without trial.

He was a rogue traitor - what kind of trial would you like him to get?

A fair one. Like everybody else.

He was in UK. Generally speaking Russia has no jurisdiction there even if it owns most of inner london.

Fill in your own special circumstances. Going just based on his name, he sounds like he had a severely elevated risk of exposure to the Russian government. I'm pretty sure he knew about it. None of that applies to actsasbuffoon.

As an American in the US, my special circumstances dictate that the US government is very dangerous, and the largest, possibly only, risk that I'd suffer from the Russian government getting my data is that they'd share it with the US government.

The reason it matters is because foreign actors can use that data to coerce someone into doing something they may not otherwise do.

>It will never matter to you if the Russian government has your data

That is a painfully naive declaration.