3 ms·

> Ok but where will that talent go? Presumably to another company where they live, or are comfortable relocating to. You seem to continuously be assuming a pe

> Ok but where will that talent go? Presumably to another company where they live, or are comfortable relocating to. You seem to continuously be assuming a perfect market, that doesn't exist. I agree that just blocking this sort of thing from countries that actually care about human rights won't solve the issue, but stopping a lot of it is still valuable. Additionally, I don't know if this sort of thing could exist in some of the countries you name. For China, at least, it sure seems like if you're good enough at this sort of thing, you get strongarmed into their existing military infrastructure used for spying on everyone else. I can only assume Russia is similar. I don't think either of those countries have free enough markets that a NSO-like company could exist. India, I don't know enough to comment. > At worse, western devs move to other coubtries or simply sell exploits illegally without getting caught...to non-western entities. Do people just up and move to other countries at the drop of the hat? That requirement alone is going to substantially reduce the number of people doing this sort of work. Again, the goal isn't to completely prevent exploit sales (which I agree is basically impossible), but to reduce the harm. Stomping out these companies (or having MUCH more aggressive oversight) won't substantially impact the hosting state's economy, and it will substantially reduce the available products on the market. I can't see a argument against that.

badrabbit 7y ago
Here is where out views diverge: you think reducing volume of supply is important, I think controlling supply is important. You think reducing volume means what little supply is available will be used against high value targets only. In reality, the smaller supply will focus more on high value exploits which will still be leveraged at the same scale. Even if that was not true, you still have no control over exploit sales and use. Allowing places like NSO and Zerodium to thrive with some control and restrictions is the best outcome. But really, do we even have law makers that understand any of this or perhaps the NSA/CIA can control them. Normal security companies have intel community ties,I think that can be acheived here as well.

badrabbit 7y ago

Here is where out views diverge: you think reducing volume of supply is important, I think controlling supply is important. You think reducing volume means what little supply is available will be used against high value targets only. In reality, the smaller supply will focus more on high value exploits which will still be leveraged at the same scale. Even if that was not true, you still have no control over exploit sales and use. Allowing places like NSO and Zerodium to thrive with some control and restrictions is the best outcome. But really, do we even have law makers that understand any of this or perhaps the NSA/CIA can control them. Normal security companies have intel community ties,I think that can be acheived here as well.