Hacker News Reader

Comment by tptacek | Hacker News Reader

Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures.

NSA does not need Microsoft's help to break into computers.

View on HN

It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.

Which specific statement did I make that you disagree with? I'm happy to go into more depth.

Do you know more than I do about Microsoft's disclosures to the US Government (effectively nothing) or is it an educated guess that what they receive is comparable with MAPP?

Did I say something above that you disagree with?

MAPP customers do get proof-of-concept code to trigger the vulnerability, sometimes months in advance. That is a huge head start towards a functional exploit, and has been converted to a fully functional remote code-exec exploit prior to disclosure in at least one case that was fairly public.

Though I do not think this story has anything to do with MAPP.

Depending on the vulnerability, a crash POC might be a day's work away from an exploit, or it might be months of work.

MAPP or no MAPP, Microsoft does not have the technical capability to produce reliable exploits for all of the vulnerabilities it's made aware of.

Also, we both know NSA has a (less-well-known) charter for coordinating vulnerability response and computer security across the agencies; NSA has a public huge defensive interest in this stuff as well.

NSA doesn't need Microsoft to enable it to break into arbitrary Windows machines. But it might need their help to keep up with every attack vector on Microsoft code, which is what you need to do if you're doing defensive work.

Seems like microsoft have that expertises:

http://www.techdirt.com/articles/20130614/02110223467/micros...

This is going to sound dickish, but technically it's "the NSA," not just "NSA".

"National Security Administration doesn't need Microsoft to break into computers." vs "The National Security Administration doesn't need Microsoft to break into computers."

Too much of a tangent, perhaps?

Doesn't sound dickish. You're probably right. Force of habit.

National Security Agency, not Administration ;)

Tangent or not I'm interested. I think its less settled than you think. In fact I was always on the opposite team; its "NSA/DoD/DoE did x" just like it is "IBM did x" and not "the IBM did x."

I did enough research to conclude that it was not a settled issue. Its clear that if the initials were lower case and referred to a generic agency that deals with national security it would be "the national security agency" similar to the "the fishing tackle section of a sporting goods store." On the other hand a gander at DoD's style guide[1] makes it clear that they do not like the "the."

I'd love to see why you think its opposite. That's not dickish, that's a desire to answer a question that's been nagging me for a long time.

[1] http://www.dtic.mil/whs/directives/corres/writing/Writing_St...

From the english.SX:

"Is it proper to use “the” before the name of a government organization?" http://english.stackexchange.com/questions/76976/is-it-prope...

"Using the definite article with acronyms and initialisms" http://english.stackexchange.com/questions/30596/using-the-d...

"Definite article with proper nouns, titles followed by a common noun" http://english.stackexchange.com/questions/2327/definite-art...

"The definite article usage with objects that have names" http://english.stackexchange.com/questions/16988/the-definit...

"Capitalising the definite article in names" http://english.stackexchange.com/questions/84288/capitalisin...

Maybe it is clearer if we note this as proper usage: "the IBM corporation."

Similarly, "the Department of Defense", "the National Security Agency".

Frankly that does not make it any clearer to me. Which could be because I am bad at the nitty gritty of english syntax. But most importantly, with all due respect you are not Strunk and White. I am looking to a clear definitive reference and in the future I cant say "I know it is written this way because hga said so."

Well, you can start here for a well referenced treatment of these nouns: http://en.wikipedia.org/wiki/Proper_noun

The reason your comment did little to clear things up is because it relied on spelling the agencies/organizations names out. It is clear that the rules change for acronyms and abbreviations.

DoD vs. DOD is a big enough debate :)

I believe NSA refers to themselves without the article when the organization's name is abbreviated.

Not true. It's a proper noun, like "McDonald's". It just happens to also sound like a descriptive phrase. You'll find that, inside the agency, it is just "NSA" and not "the NSA". This is true for most "three letter agencies".

Don't believe it? See what the agency calls itself on its website: http://www.nsa.gov/

Reply on news.ycombinator.com