Hacker News Reader

I would argue that such a clear conflict in these two priorities should necessitate having a bespoke separate governmental organization for SIGSEC, so that the NSA can freely focus on SIGINT.

View on HN

What is the conflict in priorities that you mean?

I ask because I considered code breaking and code making complimentary, in the sense they debug one another somewhat.

My guess is that this chance to debug one another motivates their coresidence in a single agency.

Disclosing vulnerabilities.

They should definitely disclose vulnerabilities in American made software for SIGSEC. If it’s foreign then not disclosing it would be SIGINT

The problem with that is there's a lot of software that's American made that is also used by potential targets of SIGINT.

If the software is foreign made and used in US, americans are still vulnerable. And opensource isn't American/national

The SIGINT arm of the NSA has an incentive to take any exploitable vulnerabilities in existing software and keep them secret, so they can use them against their enemies, rather than disclosing them so they can be fixed.

Reply on news.ycombinator.com