NSA director finally greets Defcon hackers

For those of us who have already forgotten or have never known the reason for its necessity, could you explain why? Internationally and historically, similar levels of state communications monitoring are correlated with the need for self-preservation by authoritarian regimes. There are also many modern day states which do not possess an agency directly analogous to the NSA.

I think it is a legitimate question how much of an offensive information warfare standing capability a country needs when not at war, and what level of dirty tricks intelligence agencies should pull in peacetime to monitor adversaries. Particularly due to the non financial costs of this monitoring -- losing our moral standing as a free and fair country, incidentally monitoring citizens or those present in the USA, in violation of the constitution (especially due to the tortured "five eyes" sharing agreements, which, if they weren't governments, would be viewed as a conspiracy and some kind of constructive crime), etc. I judge all of this stuff by "does it make us safer", and at some point, it clearly goes the other way. I think that point is several hundred billion dollars a year less spending than what we have now (well in excess of a trillion). Maybe 50-75% less spending.

From the Hacker News Guidelines: "On-Topic: Anything that good hackers would find interesting."

The folks at DEF CON are some of the best hackers out there. Have you seen any of the presentations?

So, "keep your friends close, and your enemies closer?" :-)

Anyway, you make a good point, and there are good reasons to let the NSA guy have his say. But when you look at the abuses perpetrated by the US government over the years, it's hard to feel good about hanging around and listening to more propaganda from their representatives. And chucking tomatoes at him would send a strong message "don't assume that we are on the same side, or that we are going to support your agenda" or whatever.

The most interesting question was about whether the NSA would prefer a perfectly secure internet or a usefully insecure one (roughly paraphrased).

That's not far from what I wanted to ask: given the offensive value of 0-day exploits (as seen with Stuxnet, regardless of who actually did it), can agencies in "Cyber Command" really be trusted to give theirs up via responsible disclosure?

Stuxnet was written at the NSA, the other worms were almost certainly were partially written there. The MD5 signature collision attack was almost certainly developed there. You could imagine that they now have dozens, if not hundreds of developers working on finding 0day and integrating new exploits into their attack arsenal of worms.

I suddenly have a handful of friends form the old underground who went from working openly in the security industry on papers, audits etc. to no longer talking about who they work for.

I can only put two and two together and conclude that the NSA has been on a hiring binge the past few years and are hiring all the best security guys (exploit developers, more specifically).

That said, don't be dishonest. The media should not be calling someone who discovered they could make time-based events in games happen by changing the time a "hacking prodigy"[1], and the website of a hacking con, whose others should know better, should not be saying it "allow[s] for exploit code to run on servers"[2]. It devalues the real thing :)

[1] http://www.darkreading.com/blog/231300589/tween-hacker-s-tim... [2] http://www.defconkids.org/?page_id=505