8 ms·
Microsoft and Google join Facebook’s legal battle against NSO
- bkmrkr 6y agoWhy the implicit antisemitism and need to list Israel in the name. I find it interesting that we never list other country origins when discussing their issues
- KyleJ61782 6y agoEspecially since it's not listed in the title after clicking the link.
- WanderPanda 6y agoIf I remember correctly in the case of Crypto AG, Switzerland was regularly mentioned in the title
- Chris2048 6y agoWhy does listing Israel in the name mean antisemitism? The company claimed "sovereign immunity", you don't think country of origin is important?
- helge9210 6y agoPutting "Jewish hacking company" in the title would be antisemitic, critisizing Israel is not.
- richrichardsson 6y agoExactly. Although it's a bit odd they added "Israeli". Israel != Judaism, yet the common automatic cry of "antisemitism" when criticising Israel is problematic.
- aparsons 6y agoWhy mention the Russian hackers? Aren’t they just hackers?
- giancarlostoro 6y agoOr so says their VPN trail that ends there for obvious reasons.
- kowlo 6y agoWhy the implicit antisemitism and need to list Israel in the name. I find it interesting that we never list other country origins when discussing their issues "Post-truth"? Did you look for any evidence of this supposed pattern? - Chinese military personnel charged for hacking into Equifax https://news.ycombinator.com/item?id=22289826 https://news.ycombinator.com/item?id=22289826 - Russian opposition leader Navalny dupes spy into revealing how he was poisoned. https://news.ycombinator.com/item?id=25495480 https://news.ycombinator.com/item?id=25495480 - Gitlab Blocked Iranians’ Access https://news.ycombinator.com/item?id=24886102 https://news.ycombinator.com/item?id=24886102 - The YouTube ban is un-American, wrong, and will backfire https://news.ycombinator.com/item?id=25391202 https://news.ycombinator.com/item?id=25391202 - Many Japanese children refuse to go to school https://news.ycombinator.com/item?id=21860951 https://news.ycombinator.com/item?id=21860951
- GordonS 6y agoPlease don't do that, there is enough real antisemitism without trying to create more out of nothing. The company is based in Israel - that is a fact, and would be pointed out regardless of the country.
- porpoise 6y ago> I find it interesting that we never list other country origins when discussing their issues I don't remember ever reading a headline, clicking into it, and discovering that it's about something happening in China. The country origin is almost always advertised right in the headline itself. In fact, since I'm not a fan of most China coverage in mainstream media, the above fact allows me to filter much of it out simply by CSS (using uBlock's implementation of the :has-text selector), with no need for JS (via userscripts).
- _jal 6y agoHilarious that they think being an arms dealer should afford them 'sovereign immunity'. I'd like to think the world would be a better place without them. But this is like the MPAA response to Unauthorized Looking - shutting down Napster just made it harder to observe, and this will just push the weapons dealers further underground.
- beerandt 6y ago>just push the weapons dealers further underground. Or will encourage nation-states to actually provide them with sovereign immunity, or some official equivalent protection. A state having these companies operate within their jurisdiction, and under their influence, is likely viewed as preferable to pushing them underground, or to another country
- sam_goody 6y agoWhat are they trying to gain? Now, at least, FB/Google/etc can also purchase the hacking tools, and try to defeat them. If NSO is shut down, their employees will likely be scooped up by any number of underworld markets - the payloads will become larger, more audacious, and better hidden. Obviously, the big corps know that. My guess is they are more interested in increasing their cover (what could we have done), than they are in security.
- bhouston 6y agoIt is whack-a-mole, but you just keep doing it. Similar to what happens when the big guys go after the spammers. Anytime they become organized and identifiable, you take them out. I heard once of a strategy called "mowing the grass", you want to keep your opponents unsophisticated and always regrouping.
- sam_goody 6y agoPublic companies like NSO that are on the books can be taken down. They also limit to whom they sell. And sometimes can help to limit the damage (eg, I suspect Iran cannot use NSO tools to attack the Mossad). But if their employees are hired by companies that are hacking for profit or "national security", there is no one to "take down". Or even keep your eye on. And if they are hired by companies that sell this software in markets that are impossible to regulate (such as is done with hacked credit cards et al, from Russia, N. Korea, and elsewhere), then their hacks will be made available in such a manner that you perhaps could eventually take down some of them (if you spend dozens of years and gobs of money and arm-twisting), but by then the damage will be 100-fold, since there are no limits to whom it is sold. And even then, you can never know what else you missed.
- adriancr 6y agoIf companies such as these do not exist or are killed then the employees you mention will have a hard existing. Sure there are self taught people but a lot learn on the job. If companies are killed off then investments will be harder to come by and the tech to do the hacks will be harder to get to. Those employees if they decide to collaborate with Iran/NK/Russia vs the US will find US can easily arrest them once they set foot anywhere in the western world.
- piokoch 6y agoSounds like MS, Google and FB has just confirmed that they store in their database information allowing "surveil" on people. Good we have that stated clearly. Big Guys, solution is simple: just delete or anonymize those data, so it is not possible to surveil people, you will not have to fight legal battles and NSO will not try to break into your database. In addition you will avoid temptation to surveil people by yourself! And you will not need to hand over these data to parties that are able to force you do this. Be that Chinese government or FBI or some other 3 letter agency.
- stingraycharles 6y ago> Big Guys, solution is simple: just delete or anonymize those data, so it is not possible to surveil people, you will not have to fight legal battles and NSO will not try to break into your database. Playing the devil’s advocate: isn’t it mandated for them to actually track people, in case some 3-letter government agency wants access?
- bbarnett 6y agoTracking is different than historical data, for tracking can be a live, forwarded feed. And even with that, you'd need a court order to force compulsion. Historical data, if it doesn't exist, cannot be revealed. And so far, there is no legislation forcing web activity to be stored for, well, months and years, like some of these jokers do.
- Frost1x 6y agoI doubt the sort of tracking government agencies push or request from them is nearly as detailed as what they're currently collecting for advertising. It's not that such agencies that spy on their own citizens don't want such information, its likely that they don't know just what derived information products are available to even make the requests. Technology is making anonymity nearly impossible in all facets of life and I don't think that's healthy for human development. Sometimes you need to assume an identity know one else knows so you can try things, fail, and develop socially as a person without fear of harming your identity. People need to be able to experiment and fail without fear of repercussion (obviously within legal bounds of what they're doing). I need to be able to walk in a bar, get drunk, and "sing" karaoke embarrassingly poorly and not have everyone at work the next day ostracize that behavior and have video evidence of it (just an example). Anonymity often grants failure and adventure without criticism and the direction we're headed is going to stiffle people's ability to explore themselves and life.
- DSingularity 6y agoGreat but I hope they are prepared to show some backbone should the lawsuit fail.
- ProAm 6y agoDon't both these companies allow the US government unfettered access to this data? Pot meet kettle, kettle meet pot.
- lawnchair_larry 6y agoNo, they don’t in fact.
- sn_master 6y agoSource? I find claims like this, and the one on Wikipedia that AirForce One does not have missiles amusing. Its not like they'll tell us even if they do.
- lawnchair_larry 6y agoI think you asked the wrong person for a source. I know it’s untrue, and I would expect that it would be necessary for evidence to accompany such a claim.
- ProAm 6y agoI Think Room 641a put what you say clearly into question, [p]. THe government has hooks into Skype when MS bought them and it went from P2P to P2S2P. I firmly believe the government has direct access to MS, FB, Google, etc.... Either permissively or on their own volition. [p] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- lawnchair_larry 6y agoIt wouldn’t, because it has nothing to do with the companies that were brought up. The skype thing is an old and very silly conspiracy theory. They didn’t rearchitect an entire product as a favor to the US government.
- 6y ago
- DontGiveTwoFlux 6y agoStamping out the above board market for hacks, is not a perfect solution. But limiting the free flow of these hacks from private companies to law enforcement and governments will decrease their availability and abuse. The expertise to build these hacks is high, and so is the potential for abuse. If government needs to build it in house instead of calling up a vendor like NSO and forking over a few, we can expect a better outcome.
- flowerlad 6y agoAlong with a legal battle I hope these companies are engaging in a technical battle as well. Because suppressing NSO using legal means will not make the vulnerabilities go away -- it will still be there, waiting to be exploited by someone else. Microsoft for example has 30+ year old C/C++ code in Office applications that customers install on their machines. This is an attack vector. Adobe Acrobat is another well known attack vector. These products should be rewritten in a safer language, like Rust. Roughly 70% of the security issues seen by Microsoft are memory safety issues. This means that if that software had been written in Rust, 70% of these security issues would most likely have been eliminated. See: https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming/ https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe... These companies should be held accountable for not investing in securing their code, instead of brushing them under the carpet and pretending that breaches are simply law-and-order issues, or that we need more laws to solve the problem.
- adamc 6y agoRewriting in Rust, however, would likely introduce many new bugs, as most rewrites do. The economics of it would be terrible.
- flowerlad 6y agoYes, fixing security bugs may introduce functionality bugs. But that's not a reason to not fix security bugs. Yes, the economics of it would not be great, which is why these companies are not already doing it. But someone else is paying the price, when information systems are compromised and data is stolen. We have to exact a heavy penalty on tech companies each time that happens, until the penalties change the economics.
- Rexxar 6y agoFixing security bugs by changing everything may also introduce new security bugs.
- 6y ago
- flowerlad 6y agoRelated: Saudi Arabia uses NSO tools against journalists: https://www.theguardian.com/media/2020/dec/20/citizen-lab-nso-dozens-of-aljazeera-journalists-allegedly-hacked-using-israeli-firm-spyware https://www.theguardian.com/media/2020/dec/20/citizen-lab-ns...
- Trisell 6y ago“Microsoft, Alphabet-owned Google, Cisco, Dell Technologies-owned VMWare, and the Washington-based Internet Association joined forces with Facebook to argue against that, saying that awarding sovereign immunity to NSO would lead to a proliferation of hacking technology and “more foreign governments with powerful and dangerous cyber surveillance tools.” So I’m to believe nation states having these tools is bad. But Facebook just at handing over data on dissidents to repressive governments is okay?
- Daho0n 6y ago> But Facebook just at handing over data on dissidents to repressive governments is okay? What are they supposed to do? Move out of the US?
- jiriro 6y agoIs there any info about which operating systems have the NSO tools targeted?