Hacker News Reader

Comment by dmix | Hacker News Reader

> Following Microsoft’s original disclosure in early March 2021, the United States Government also identified other vulnerabilities in the Exchange Server software.

> Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector.

Finally they seem to be starting to take the defence of citizens and private industry seriously - in a far more public forum. Instead of just hearing the odd story of this happening through back channels.

From the linked press release:

https://www.whitehouse.gov/briefing-room/statements-releases...

View on HN

The challenge the NSA has is it possesses 2 separate missions that are often in direct conflict: secure the communications of the United States, and to collect, eavesdrop, and compromise the communications of other countries.

The United States Atomic Energy Commission of the 1950s and 60s had the same problem. Their mission was to both regulate nuclear power as well as research and promote the widespread adoption of nuclear power. Making things safe and keeping them safe while also making things easy and cheap are often in conflict. Ultimately it was split into two different agencies: One tasked with regulation and one Tasked with research and promotion.

I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities.

Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then works to patch them, promotes bug bounties, develops secure coding standards, audits open source projects, etc. Imagine something like The National Endowment for the Arts (NEA) that instead funds critical pieces of software like openSSL, etc.

Is that necessarily the best form? Probably not but it’s way better than what we have now: every time the NSA suggests changes to “make something more secure “ there is a looming specter that they are lying and are actually trying to compromise things.

> Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then works to patch them, promotes bug bounties, develops secure coding standards, audits open source projects, etc. Imagine something like The National Endowment for the Arts (NEA) that instead funds critical pieces of software like openSSL, etc.

I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'?

Or they should stop stealing tax payers money and dissolve these agencies. The one thing they are good at is digging deeper and deeper the debt account, for virtually no benefit, and surely nuisance and worries.

Are you saying that the market, such as it is, is doing a good enough job of managing software vulnerabilities and their consequent breaches?

No. I'M by no means saying nor implying that. I'm saying tax should not be taken away from people to fund agencies. Businesses are free to do a good or bad job at managing their security posture. And if it is a bad job they are very likely to pay the consequences. The market is fine regulating itself in the long term. Agencies and regulation rather create obstacles and biases.

> I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'?

I like it too, but I also think it would be needed to be backed by some kind of regulatory agency that could issue the cybersecurity equivalent of an "Airworthiness Directive". Otherwise we'd be in a similar situation we have know: lots of information about vulnerabilities that are often not acted upon.

> The challenge the NSA has is it possesses 2 separate missions that are often in direct conflict: secure the communications of the United States, and to collect, eavesdrop, and compromise the communications of other countries.

I don't know... isn't that like saying a military general has 2 conflicting missions: offense and defense? We trust military leaders with both duties, even though they could theoretically sacrifice everything to achieve victory.

> I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities.

If you split the NSA in two, wouldn't you just have two agencies working against each other? And it would essentially give the offensive agency full permission to hoard security flaws to the detriment of the nation it serves.

I think a better solution is to clearly establish the relative priorities of each mission. IMO, the NSA should always prioritize the security of the USA's (and it's allies') technological infrastructure over attacking its enemies'.

Genuinely curious about the downvotes on this. I know political stances often trump generally reasoned arguments on HN -- is it that this thread isn't _outright_ anti NSA?

Probably. I know people in my circles who believe without caveats or qualifications that the NSA is evil, that we just shouldn't have spy agencies at all, and wouldn't entertain any sort of abstract discussion of how the work should be organized.

> I believe both missions of the NSA are important. However I believe it should be split into two agencies each Enthusiastically pursuing a single mission to the best of their abilities.

At least with cryptography, I'm not sure how practical that is. I'm not cryptographer, but my impression is that offense and defense both deeply inform each other in that space.

For what it's worth, I think this is the NCSC in the UK.

In the UK we have the GCHQ and NCSC, which are in a sense what you're getting at.

I concur, One who is responsible for punching holes shouldn't be the one to patch it.

Right now adversaries are just playing treasure hunt because of this.

>> Rather than withholding them, the United States Government recognized that these vulnerabilities could pose systemic risk and the National Security Agency notified Microsoft to ensure patches were developed and released to the private sector.

It is amazing that NSA had to notify Microsoft. You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies.

Digital security will never be trust unless these things are addressed in an open transparent way.

> You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies.

Are you under the impression that MS doesn't spend millions on security? They're currently spending roughly $1b/year. This isn't going to be fixed by "a few pen test"

If they are spending a billion, these flaws show that obviously isn't enough.

How do you know they're not doing exactly that? For every 1 vulnerability that gets disclosed, we have no clue how many potential vulnerabilities were caught by security testing or practices. The entire nature of security is that it's impossible to have literally 0 vulnerabilities.

It's not possible to find all the bugs and they only get noticed when they fail to find one. No one recognizes all the bugs that they continually find and fix.

I don't understand why HN has such a flippant attitude towards cybersecurity. You would think a forum full of developers would understand the complexity of software.

But the "just hire a pentester and you'll never have any bugs" and "just follow some (ill-defined) 'best practices' and you'll never be hacked" attitudes are so prevalent.

If you are not outsourcing security, then you are not taking it seriously. It is the one thing where you need to give the job to the best person.

But, we’re more likely to outsource the one thing you don’t need to outsource, like app developers.

> I don't understand why HN has such a flippant attitude towards cybersecurity. You would think a forum full of developers would understand the complexity of software.

HN is also full of contrarians and people who like to feel superior than everyone else (and often express that through flippant dismissals).

You are hugely overestimating the level of security of software like this. There's a constant stream of vulnerability discoveries, disclosures and fixes. Those vulnerabilities don't pop into existence the week someone publicly discloses them and informs the vendor, they've been waiting there for anyone to find them for years.

If MS wanted to replace a product like this with one that has a low probability of containing any remotely exploitable vulnerabilities, they'd have to go back to the drawing board, do a full rewrite witha completely different sw development process, take a lot of time or make some major functionality compromises (or probably both).

Reply on news.ycombinator.com