Hacker News Reader

Comment by AsyncAwait | Hacker News Reader

So are we not concerned this is coming from the NSA anymore? Genuinely asking, as imo they wouldn't try to sneak something in the very first time it was released, all eyes were on them, but now?

View on HN

Generally, no. Consider that the people who use this tool are probably the best to find malicious things in it.

Except... isn't this a couple of million LoC? Doesn't the mere act of finding malicious things in it require some serious time and effort not likely to be accomplished by individuals?

It's not just individuals using it, though.

Sure, but do you think companies using it can allocate some of their budget to audit the _entire_ codebase?

A fair point. Consider that the NSA has the ability to push code changes faster than the open source community can analyze. Also, it's entirely conceivable that the NSA has the expertise to inject RCE vulns into the codebase, and make it look like an honest mistake.

tbh, I just assume my computer already has about six dozen NSA rootkits in it already, so what's a couple more? :)

Yeah - once you've admitted your adversary is the NSA, you've already lost. Cosplaying secret agents with state level support is not going to end well.

"Threat: The Mossad doing Mossad things with your email account. Solution: Magical amulets? Fake your own death, move into a submarine? YOU’RE STILL GONNA BE MOSSAD’ED UPON"

-- https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Thank you for this article and the joy it has brought me!

The realistic threat model for a common person is an agency that doesn't have resources to target them personally but is happy to steal their private data if they can cheaply do it on a mass scale.

Just tell me why should the NSA expose itself with their own software..especially software that targets not only programmers but highly specialized software analysts? Your Plastic Router and your half-secured OS is a much better target...and your ISP (because metadata is the most important thing to start and justify a targeted attack).

Open source, so no, we're not.

Sometimes the best place to hide something is in plain sight :)

Of all the things on the NSA priority list, it seems like trying to inject malicious software into the wild via random reverse engineers computers seems like the best use of their time.

open source means you can review the code. pretty sure, since this comes from them, is intensely scrutinized. So again, not worried.

Super secret spy agencies are much less competent than you'd be led to believe. I'd be more afraid of Google and Facebook.

I would not say that they are not competent, but you are absolutely right about Google/Facebook/Amazon, the big difference is, the NSA/CIA have to justify their actions...Google/Facebook not so much.

Very naive. The CIA is per definition a lying, criminal, state-protected enterprise, which is accountable to no one. Not to the oversight committee and for sure not the president. They just keep lying, doing their own secret wars, media interference and election busting. Being fascist should also be concerning to some. There are tons of books on that. The only oversight was the Church commission, once. They collect and fabricate so much dirt on everyone that oversight is impossible.

The NSA being accountable is also news to me. They routinely violate their own constitution, and many other laws. They also cooperate with said criminals, and similar criminal enterprises worldwide.

SELinux is from NSA, so they're already in your kernel.

Apparently most don't have an issue with LinuxSE either.

Reply on news.ycombinator.com