> While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. This seems contradictory. If its not possible

> While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. This seems contradictory. If its not possible to have perfect security, how are you supposed to make your enemy's offensive tools useless? > It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. Yes, it is an extremely gray area that is tough to find an easy answer to. Whatever ideals you want to stick to, the fact is the other side more likely than not will not play by your ideal/"right" rules. It seems like China and Russia have no plans on slowing down pilfering intellectual property and causing chaos in the US. Is it really a good idea for the US to throw down all offensive cyber weapons for some ideal? That would only encourage China and Russia to act worse knowing that they don't have to worry about repercussions from their actions. > The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. In this case, the article was about google exposing a hacking operation of a government that was trying to prevent terrorism. If the terrorists are able to kill people due to this government operation being shutdown are you saying that it was better for google to have exposed it just because security flaws are bad and should be fixed? It isn't possible to know for sure which side is "right" in this situation. If the operation would have prevented deaths with no collateral deaths on the other side, how can anyone say that preventing some bits on computers being moved in unexpected ways is better than having people die? > Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. > It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Clean, well designed and secure systems are nice and all but I don't a large majority of non-tech workers will agree that this standard trumps every other consideration when it comes to a functioning society. It doesn't seem fair that some tech workers like clean design and they deserve to dictate what is right and wrong in society.