Did you not know one of the NSA mandates is to improve security? It's a dual personality organization to say the least.

They suggested a change to a crypto algorithm to protect it from differential cryptanalysis before that was a public attack. This resulted in a weird dilemma of decided which arm of the NSA was 'helping' because the purpose wasn't public. It wasn't until much later that it turned out to be good.

So what? The IAD part of NSA helped invent INFOSEC, did some of best stuff in COMSEC for long time, did TEMPEST sheilding, evaluated early high-assurance systems (some never broken), made guides for securing many COTS tech, funded work like Galois Inc’s that regularly gets FOSS’d, and some other stuff Im probably forgetting.

They’ve done far more good in IAD than bad with the one subversion that was probably NOBUS in practice. They also published methods to build stuff they can’t beat most of the time under TCSEC B3/A1 and Common Criteria EAL6/7 High Robustness. If we’re being honest, the FOSS and commercial developers ignoring such advice from NSA and others in high-assurance security for decades did more for NSA SIGINT division than TAO subversions ever did. NSA just finds the avoidable problems people leave in there.

So, this meme of “Oh, it’s NSA!” needs to stop unless they’re supplying a closed-source solution or asking for backdoors/escrow. Anything else should simply be rigorously analyzed by 3rd parties like every other source. Funny enough, that’s one of NSA’s certification requirements.

Yeah, a lot of what Galois does is funded by government grants of one sort or another. While my general opinion of the NSA is not favorable, I think that funding basic research in computer security is a legitimate part of their mission. Since Galois is blogging about it, I presume that the NSA isn't hoarding the technology for themselves. So, I see no immediate issue with them accepting money from the NSA.

Yes, everybody noticed. Let us praise NSA for this virtuous act of trying to make the computing more secure.