NSA finding exploits is good. NSA keeping those exploits secret, for use as tools, is probably good; NSA disclosing those exploits to vendors and getting them fixed may or may not be better. NSA convincing vendors to insert bugs (or features) that can be exploited is bad. I don't know a whole lot about how much they do each of these.
I agree, but try to keep the terminology clear. The things you're saying are bad aren't "exploits"; they're "implants". There are modes of implanting code that I think are clearly bad, but even more modes where I think "well, that's SIGINT for you."
Sure, I'll readily accept a preference for the term "implants". I just wanted to state things (what I hope was) clearly lest people talk past each other.
Comments
NSA finding exploits is good. NSA keeping those exploits secret, for use as tools, is probably good; NSA disclosing those exploits to vendors and getting them fixed may or may not be better. NSA convincing vendors to insert bugs (or features) that can be exploited is bad. I don't know a whole lot about how much they do each of these.
I agree, but try to keep the terminology clear. The things you're saying are bad aren't "exploits"; they're "implants". There are modes of implanting code that I think are clearly bad, but even more modes where I think "well, that's SIGINT for you."
Sure, I'll readily accept a preference for the term "implants". I just wanted to state things (what I hope was) clearly lest people talk past each other.