>Firstly, thats not an argument, its a tautology. No, it's a correction. You suggested that "we made the attack surface vast". The point is that you're wrong.

>Firstly, thats not an argument, its a tautology. No, it's a correction. You suggested that "we made the attack surface vast". The point is that you're wrong. It's vast due to actual complexity and interconnectedness. It's vast by definition. >Secondly Attack surface is vast because we have shipped several billion locked down phones... This again illustrates that you don't understand what the attack surface is, thus you believe fallacies such as "we made it vast". It's not a phone or single entry point. It's every bit of software that a system touches or is comprised of, including custom, commercial, and OSS. It's firmware and hardware and networks and configs. It's social. And, to some extent, it's those same vulnerabilities in systems that connect to a system. Again, it's vast by necessity b/c our modern world depends on software, technology and interconnectedness. >Mate, they are criminals, they are culpable by definition, its in the Oxford dictionary. They have always existed and always will. So, this is your grand rationale for focusing all ire on the targeted companies vs the actual criminals? Your overall position then is that we should have no deterrent (why have laws at all?) and just lock our doors/secure our systems. If the inevitable criminals get you, then it's your fault. >Whats the point of banging on about [criminals]? Pretty obvious: to acknowledge they exist, are the actual cause of the problem, and need to be deterred/punished as part of any comprehensive solution. >Even if Russia and China magically dissapear tomorrow, the problem will remain: Actually, the problem would be substantially reduced to relatively nil. Just removing Russia alone would have a massive impact. And, the solution-set becomes vastly different when fighting domestic criminals vs deterring state-sanctioned attacks from foreign adversaries. But, here you are working hard to absolve the U.S.'s foreign adversaries again, "mate". Very curious. >Ita like if someone is always stealing stuff from your house, and I tell you maybe you should try locking the door. Another straw man. I've acknowledged repeatedly that we should lock the door. That discussion is over. What we're discussing is your position that we should not attempt to deter criminals (especially if they are foreign). Instead, they should be able to try breaking your locks with impunity and, if they succeed, then it's your fault.