Is it really so egregious? I'll let you be the judge!
1. http://www.c-span.org/video/?c4486712/sen-feinstein-accuses-cia-searching-co...
2. http://www.c-span.org/video/?c4486741/dianne-feinstein-cia-separation-powers 3. http://www.c-span.org/video/?318232-5/sen-feinstein-alleges-improper-cia-sea...
________________________________ От: Delton Barnes delton.barnes@mail.ru Кому: tor-relays@lists.torproject.org Отправлено: суббота, 12 апреля 2014 13:45 Тема: Re: [tor-relays] NSA knew about Heartbleed
Jesse Victors:
"The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said. The NSA said in response to a Bloomberg News article that it wasn?t aware of Heartbleed until the vulnerability was made public by a private security report. The agency?s reported decision to keep the bug secret in pursuit of national security interests threatens to renew the rancorous debate over the role of the government?s top computer experts."
I'm skeptical of this report. The Office of the Director of National Intelligence responded to the story by saying:
"Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before 2014 are wrong"
This is believable because if it were a lie, they would risk an outright contradiction from a leak or Snowden document, which would further damage their already terrible credibility and reputation.
"Two sources familiar with matter" could merely be two computer security experts who have an unsubstantiated opinion that the NSA was exploiting this beforehand. We have no idea how credible these sources are.
One thing I am sure of is this generated a lot of clicks for Bloomberg. NSA rumors involving hot technology topics seems like a good way to make money for a news website.
That said, if you carefully parse the statement from DNI, it seems to me to imply they were aware of the Heartbleed vulnerability in 2014. Why would they say "before 2014" instead of "before its disclosure Monday" or something? They may have known about it weeks or months in advance, and been exploiting it or patching their systems. But that is not as egregious as it would be to conceal this flaw for years.
Delton
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays