4 ms·

Bullshit. There's a limited pool of talent that can generate something like this. If you make is sufficently toxic and/or difficult to work for a company that

Bullshit. There's a limited pool of talent that can generate something like this. If you make is sufficently toxic and/or difficult to work for a company that involved with flagrantly violating human rights (like NSO), you'll substantially starve them of talent. Worst case, you'll significantly reduce the quality of their exploits. Best case, it'll be effectively unavailable.

badrabbit 7y ago
Ok but where will that talent go? Countries will just get someone else to start a firm and support it. It's an arms race and you're blaming defense contractors for supplying arms! The people with power to be hostile to exploit devs who sell their talent to the highest bidder are the same people who are bidding for that talent. So long as NSO group and others dont harm the interests of countries protecting them they will always be in demand. If even the entire west punished developing exploits for money a high crime, at best you give business to chinese,russian and indian companies. At worse, western devs move to other coubtries or simply sell exploits illegally without getting caught...to non-western entities. The only way to beat this sort of a problem is to compete with demand. But that means competing against resources of nation states. Perhaps international treaties to control this arms race would help? And yes, I know at best there are only a few hundred people with enough talent, but I bet you there are even less nuclear bomb scientists and you know how that supply/demand is turning out...
- fake-name 7y ago
  > Ok but where will that talent go? Presumably to another company where they live, or are comfortable relocating to. You seem to continuously be assuming a perfect market, that doesn't exist. I agree that just blocking this sort of thing from countries that actually care about human rights won't solve the issue, but stopping a lot of it is still valuable. Additionally, I don't know if this sort of thing could exist in some of the countries you name. For China, at least, it sure seems like if you're good enough at this sort of thing, you get strongarmed into their existing military infrastructure used for spying on everyone else. I can only assume Russia is similar. I don't think either of those countries have free enough markets that a NSO-like company could exist. India, I don't know enough to comment. > At worse, western devs move to other coubtries or simply sell exploits illegally without getting caught...to non-western entities. Do people just up and move to other countries at the drop of the hat? That requirement alone is going to substantially reduce the number of people doing this sort of work. Again, the goal isn't to completely prevent exploit sales (which I agree is basically impossible), but to reduce the harm. Stomping out these companies (or having MUCH more aggressive oversight) won't substantially impact the hosting state's economy, and it will substantially reduce the available products on the market. I can't see a argument against that.
  - badrabbit 7y ago
    Here is where out views diverge: you think reducing volume of supply is important, I think controlling supply is important. You think reducing volume means what little supply is available will be used against high value targets only. In reality, the smaller supply will focus more on high value exploits which will still be leveraged at the same scale. Even if that was not true, you still have no control over exploit sales and use. Allowing places like NSO and Zerodium to thrive with some control and restrictions is the best outcome. But really, do we even have law makers that understand any of this or perhaps the NSA/CIA can control them. Normal security companies have intel community ties,I think that can be acheived here as well.

badrabbit 7y ago

Ok but where will that talent go? Countries will just get someone else to start a firm and support it. It's an arms race and you're blaming defense contractors for supplying arms! The people with power to be hostile to exploit devs who sell their talent to the highest bidder are the same people who are bidding for that talent. So long as NSO group and others dont harm the interests of countries protecting them they will always be in demand. If even the entire west punished developing exploits for money a high crime, at best you give business to chinese,russian and indian companies. At worse, western devs move to other coubtries or simply sell exploits illegally without getting caught...to non-western entities. The only way to beat this sort of a problem is to compete with demand. But that means competing against resources of nation states. Perhaps international treaties to control this arms race would help? And yes, I know at best there are only a few hundred people with enough talent, but I bet you there are even less nuclear bomb scientists and you know how that supply/demand is turning out...

fake-name 7y ago
> Ok but where will that talent go? Presumably to another company where they live, or are comfortable relocating to. You seem to continuously be assuming a perfect market, that doesn't exist. I agree that just blocking this sort of thing from countries that actually care about human rights won't solve the issue, but stopping a lot of it is still valuable. Additionally, I don't know if this sort of thing could exist in some of the countries you name. For China, at least, it sure seems like if you're good enough at this sort of thing, you get strongarmed into their existing military infrastructure used for spying on everyone else. I can only assume Russia is similar. I don't think either of those countries have free enough markets that a NSO-like company could exist. India, I don't know enough to comment. > At worse, western devs move to other coubtries or simply sell exploits illegally without getting caught...to non-western entities. Do people just up and move to other countries at the drop of the hat? That requirement alone is going to substantially reduce the number of people doing this sort of work. Again, the goal isn't to completely prevent exploit sales (which I agree is basically impossible), but to reduce the harm. Stomping out these companies (or having MUCH more aggressive oversight) won't substantially impact the hosting state's economy, and it will substantially reduce the available products on the market. I can't see a argument against that.
- badrabbit 7y ago
  Here is where out views diverge: you think reducing volume of supply is important, I think controlling supply is important. You think reducing volume means what little supply is available will be used against high value targets only. In reality, the smaller supply will focus more on high value exploits which will still be leveraged at the same scale. Even if that was not true, you still have no control over exploit sales and use. Allowing places like NSO and Zerodium to thrive with some control and restrictions is the best outcome. But really, do we even have law makers that understand any of this or perhaps the NSA/CIA can control them. Normal security companies have intel community ties,I think that can be acheived here as well.