14 ms·

Regarding the headline, it is absurdly unrealistic to expect that any consumer-grade software can defend itself from state-funded hackers. Not even the entirety

Regarding the headline, it is absurdly unrealistic to expect that any consumer-grade software can defend itself from state-funded hackers. Not even the entirety American intelligence apparatus can defend itself against state hackers. Why would we expect lowly iOS (or any other consumer software) to do better? If you have reason to believe you're targeted by state-backed intelligence agencies, you really oughta be working under the assumption that they can see everything you're doing.

fortran77 5y ago
But this isn’t state funded. It’s a relatively small private company.
wmf 5y ago
"Consumer-grade" iOS probably has a larger R&D budget than all mil-spec competitors combined. iOS also has a larger attack surface but it's not obvious to me that it's a lost cause.
- spicybright 5y ago
  It doesn't mean they spend all that budget on hardening against attacks. The vast majority is for user experience, flashy+useful end user features, etc.
  - dmitriid 5y ago
    And actual military grade security would stand in the way of so much of that. Consumer products are in a he unenviable position of trying to combine things that don't combine well.
    - joe_the_user 5y ago
      If being hacked makes someone feel bad, consumer products are in an unenviable position. If making money makes some feel good, consumer product are in an enviable position.
  - olliej 5y ago
    There are only a finite number of engineering hours available. Employing more engineers doesn’t work. Rewriting the stack in a safe language would take years (25+ years of code to rewrite). Saying the vast majority is on ux+flash, is the super common mistake: you don’t see any of the work that is not in the UI portion of an app, that doesn’t mean that’s not getting huge amounts of work.
  - gruez 5y ago
    To make it even worse, the "flashy+useful end user features" are the very thing that make the OS hard to secure. Nearly all of iMessage exploits stem from parts related to non-text handling. FORCEDENTRY was caused by code related to image handling, for instance. I'm sure if you're willing to cut the scope of the messaging app to only text, it'd be impossible to hack.
    - codeflo 5y ago
      You’d probably have to limit it to ASCII text, and even then use fixed-width fonts just to be sure — at least one iOS vulnerability was related to word-wrapping of Zalgo-style Unicode in lock screen notifications.
      - Ntrails 5y ago
        And practically nobody would buy that product, secure or not
        emn13 5y ago
        Yeah, nobody would use a text only communication platform.;-)
        Ntrails 5y ago
        There is a reason smart phones won. That discord trumps irc and xmpp. I am not sure how secure a Nokia 3210 really is, but I could phone and text with it even today I expect. The users are rare, and that is not accidentap
        emn13 5y ago
        Sure, it's just a particularly amusing case to make on a text-only platform like hacker news.
  - geenew 5y ago
    That is what we pay them for, to a material degree. iOS wins in a lot of use-cases because it's perceived as the platform that better protects privacy. For me, it's fine if they lose some battles, but they should budget to win the war.
phh 5y ago
I fully agree there. In addition to software expectations, state-backed intelligence doesn't require any software (or hardware) security flaw to surveil you. If you're are a target of interest to them, there isn't much you can do. As you say, only thing you can do in such case, is to do everything assuming you're being spied upon.
- chubot 5y ago
  As James Mickens says, there are only two threat models: 1. Mossad 2. Not Mossad https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://news.ycombinator.com/item?id=27915173 https://news.ycombinator.com/item?id=27915173 :)
  - 0xCMP 5y ago
    I've read and sent that PDF so many times. A fun snippet that jumped out at me this time: > With public key cryptography, there’s a horrible, fundamental challenge of finding somebody, anybody, to establish and maintain the infrastructure. For example, you could enlist a well-known technology company to do it, but this would offend the refined aesthetics of the vaguely Marxist but comfortably bourgeoisie hacker community who wants everything to be decentralized and who non-ironically believes that Tor is used for things besides drug deals and kidnapping plots.
  - deleted 5y ago
    [deleted]
  - jjav 5y ago
    That is most often relevant, but here not quite. Apple has way more budget than Mossad.
    - inglor 5y ago
      Lucky for the Mossad they are not building a competitor to the iPhone/iMac/MacBookPro/iPad etc... They don't have to compete with apple they just have to find an interesting mistake in their code. On phones with tens of years of legacy firmware/modem/protocol code that's very hard to reliably stop. (NSO is not Mossad and Mossad doesn't use NSO afaik)
fortran77 5y ago
But it's not "state funded". NSO is a private company owned by Novelpina Capital, LLC.
- PradeetPatel 5y ago
  It has been established that there is a clear link between NSO and the Israeli government.
  - fortran77 5y ago
    https://en.wikipedia.org/wiki/Weasel_word https://en.wikipedia.org/wiki/Weasel_word
  - SigmundA 5y ago
    I believe Apples quarterly revenues are similar to Israel's yearly government expenditures.
- drzaiusapelord 5y ago
  Not technically but an Israeli cybersecurity company like this isn't exactly two guys in garabge bootstrappy capitalist success story you're making it out to be. It most likely is filled with spooks, has deep connections with the Israeli intelligence services, and is full of ex-military. In authoritarian or semi-authoritarian regimes spinning off hacking to a private company pays dividends, because they get blacklisted, as a private company, which doesn't greatly affect diplomatic norms. Also it allows Israel to sell exploits to regimes that might be hard to via government agencies. Afterall, it was "private" business that sold them, not the government, wink wink. A bit like so many "private" cybergangs in Russia have impunity to attack the USA/EU and sell and deploy ransomware there because, again, its "not the government, its criminals" but in reality they're defacto arms of the governments there or at least have strong ties to the government, pay them protection money, and often get marching orders from them.
  - samatman 5y ago
    > is full of ex-military To be fair, this is just as true of an Israeli car repair shop or shawarma joint...
lr4444lr 5y ago
Though their bread and butter us government contracts, NSO is a private venture backed firm.
tyrfing 5y ago
Apple makes more in profit per year than the US IC budget. Their annual revenue is slightly lower than the entire GDP of Israel, where NSO is based. It is far less unrealistic than you think.
- olliej 5y ago
  Core difference though is one side has to find a few bugs, the other side has to make zero mistakes.
  - tyrfing 5y ago
    That is mostly true, but I hate to see the narrative that it's insecure due to lack of resources. It's easy to miss the ridiculous scale of these big tech companies.
    - olliej 5y ago
      The problem is not money, there is only so much any one engineer can do, and there are only so many engineers you can have working on anything. No one can "solve" security simply by buying more engineers, what is needed is time.
      - lern_too_spel 5y ago
        NSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabilities.
        saagarjha 5y ago
        But can Apple outspend all NSOs? Including the various government-backed entities?
        olliej 5y ago
        The problem is time rather than money - there are a finite number of engineering hours in a year, the only way to increase that is to add more engineers, but adding more engineers very rapidly starts costing time rather than helping.
pyuser583 5y ago
Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. No other tech has that level of control. Think of the controversy surrounding the Intel ME and other “secondary processors”. Not an issue with the IPhone (from Apples perspective). When Google decided they wanted to control all the computing on their servers, from bare metal up, they ran into the ME. Apple is the only key civilian entity with that level of control.
- coldtea 5y ago
  >Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. That's not really relevant. The American intelligence apparatus controls their entire stack too, ordering and autiting custom versions of professors and such.
- drzaiusapelord 5y ago
  Apple cant do this on its servers either, considering it has no server product. Google has this stack control in Android, Google Home, Chromebook, etc trivially if it chooses, if it doesn't have that already. Microsoft can do this on its Cortana smart speakers and Surface Pro X running their (Qualcomms) ARM cpu. Also I imagine bulk buyers can get Intel ME disabled if they don't want it on their server. AMD PSP can be disabled in the BIOS I believe. Comparing a phone to a server doesn't make too much sense. A phone is a consumer product like Android or Home and a server is a business product. Apple runs its cloud on Intel or AMD like everyone else.
  - mike_d 5y ago
    > Apple cant do this on its servers either, considering it has no server product Wat? https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/macos/server/ https://www.apple.com/macos/server/
    - deleted 5y ago
      [deleted]
jrochkind1 5y ago
Don't forgot how recently this wasn't obvious to hardly anyone though. Probably only 10 years ago, I knew a lot of people who thought careful and conscientious use of encryption and security features could protect sensitive info from governments. That's not a very long time ago. It's taken a while to sink in -- and to the full extent of it being more and more widely known. That nearly any government can probably trivially get access to anything, using commodity off-the-shelf surveillance software. (Postscript: Edward Snowden is a hero).
albertopv 5y ago
Apple has tons of money, a crazy amount of money, they have a net income of dozens of billions every quarter. They have more money than most state funded agencies. They just don't want to.
- nicce 5y ago
  > They just don't want to. Do you even know what you are asking? You are asking perfect code and hardware, no single mistake on any line of the process. Taking account on every possible scenario and sidescenario you can’t or can think about.
- jagger27 5y ago
  I strongly suspect you would not be able to find a single Apple employee who says they "don't want to" protect iPhones from NSO malware.
- poisonborz 5y ago
  A lot of commenters point to the heaps of money. But what do you buy with it? How do you build it up at this scale? Security isn't a metric you can reliably work by like clicks, op/s and sales. And beyond a very narrow frame it won't help their case of being a producer of consumer products, rather it makes very difficult to work with state actors.
  - blip54321 5y ago
    Raising bug bounties by an order of magnitude goes a long ways. Apple's program is pretty good relative to industry norms, but all of the programs are well below black/gray market prices for exploits, and most are below costs to find, document, and submit an exploit. Google pays less than a month's salary for their most serious Chrome exploits, for example: https://bughunters.google.com/about/rules/5745167867576320 https://bughunters.google.com/about/rules/5745167867576320 I think all this is good until an adversary decides to brick every iDevice, Android, Windows, MacOS, and Linux machine in the US. And by "brick", I mean overwrite firmwares, disable fans, and run at maximum load.
deleted 5y ago
[deleted]
phendrenad2 5y ago
That sounds narrow and simplistic to me. Apple is just consumer-grade hardware? How many politicians and CEOs of key American businesses use iPhones? Probably all of them. Is there some secret iPhone model for Donald Trump, hand-patched and reflow soldered by the NSA to remove any NSO vulnerabilities? Does the American government not know about NSO? Are they powerless to stop key American businesses from being hacked by a foreign state? I'm sure there's a lot more to the story that we'll only find out about with a well-placed FOIA in the year 2070 or so.
atemerev 5y ago
It should be possible to protect oneself. It is extremely difficult only because there are basically only two options if you want to have a smartphone: either iOS or Android. The immense power of nation-state adversaries is focused on just two targets. And there are are no commercial off-the-shelf security solutions that can “protect” you. You have to do your own security. This is why Snowden had to painstakingly teach the journalists on how to use GPG to receive his cache. No other way would be trustful enough.
biztos 5y ago
> defend itself from state-funded hackers Doesn't it matter which state? Sure, for US, Russia, China this is probably just true without nuance. For someplace like Israel (small but highly motivated and strong in both espionage and tech) apparently also true. But should I not expect a FAANG-level company to defend itself from state-sponsored hacking if the state is Uzbekistan or Cambodia? And if every state can get access to top-tier hacking by having an alliance with $MAJOR_PLAYER, why should we expect that doesn't extend to non-state actors? At which point, are we just giving up on security? I think Apple absolutely can defend itself against state-funded hackers. Whether they choose to do so is a question of priorities I guess.
- fortran77 5y ago
  NSO is not Israel. They are a small private company, based in Israel, owned by a UK private equity group. This isn’t a ‘state sponsored’ anything.
  - biztos 5y ago
    I agree, in the same way that Raytheon is "not America," but my interpretation of the parent comment was that the cosy relationship with the government made it effectively the same thing from the point of view of companies defending themselves. Whether or not that's actually the case is an interesting discussion.
- j16sdiz 5y ago
  I am not so sure... State can use selective enforcement of different regulations to strongarm companies doing crazy stuffs..
  - biztos 5y ago
    Granted, a state actor can (depending how important the state is to your business) compel you to not counter their attacks. But that isn’t really a question of technology, and the parent comment was, I think, suggesting it’s an unrealistic expectation on the tech level for companies to beat back state actors.
the_gipsy 5y ago
> it is absurdly unrealistic to expect that any consumer-grade software can defend itself from state-funded hackers Apple put it in their TV ads, you know.
datavirtue 5y ago
The defense is to not implement slapdash feature that careen into a memory ditch. I will repeat, Leaving out functionality that you have not secured is the defense. Calling software "consumer grade" and not expecting it to be secure is uninformed hand waving.
2OEH8eoCRo0 5y ago
Name some non consumer grade software that's up to the task? I think you're making excuses. Apple, owning the entire stack, has the least excuse of anyone. Given their market share they also have a lot of responsibility to be better.

fortran77 5y ago

But this isn’t state funded. It’s a relatively small private company.

wmf 5y ago

"Consumer-grade" iOS probably has a larger R&D budget than all mil-spec competitors combined. iOS also has a larger attack surface but it's not obvious to me that it's a lost cause.

spicybright 5y ago
It doesn't mean they spend all that budget on hardening against attacks. The vast majority is for user experience, flashy+useful end user features, etc.
- dmitriid 5y ago
  And actual military grade security would stand in the way of so much of that. Consumer products are in a he unenviable position of trying to combine things that don't combine well.
  - joe_the_user 5y ago
    If being hacked makes someone feel bad, consumer products are in an unenviable position. If making money makes some feel good, consumer product are in an enviable position.
- olliej 5y ago
  There are only a finite number of engineering hours available. Employing more engineers doesn’t work. Rewriting the stack in a safe language would take years (25+ years of code to rewrite). Saying the vast majority is on ux+flash, is the super common mistake: you don’t see any of the work that is not in the UI portion of an app, that doesn’t mean that’s not getting huge amounts of work.
- gruez 5y ago
  To make it even worse, the "flashy+useful end user features" are the very thing that make the OS hard to secure. Nearly all of iMessage exploits stem from parts related to non-text handling. FORCEDENTRY was caused by code related to image handling, for instance. I'm sure if you're willing to cut the scope of the messaging app to only text, it'd be impossible to hack.
  - codeflo 5y ago
    You’d probably have to limit it to ASCII text, and even then use fixed-width fonts just to be sure — at least one iOS vulnerability was related to word-wrapping of Zalgo-style Unicode in lock screen notifications.
    - Ntrails 5y ago
      And practically nobody would buy that product, secure or not
      - emn13 5y ago
        Yeah, nobody would use a text only communication platform.;-)
        Ntrails 5y ago
        There is a reason smart phones won. That discord trumps irc and xmpp. I am not sure how secure a Nokia 3210 really is, but I could phone and text with it even today I expect. The users are rare, and that is not accidentap
        emn13 5y ago
        Sure, it's just a particularly amusing case to make on a text-only platform like hacker news.
- geenew 5y ago
  That is what we pay them for, to a material degree. iOS wins in a lot of use-cases because it's perceived as the platform that better protects privacy. For me, it's fine if they lose some battles, but they should budget to win the war.

phh 5y ago

I fully agree there. In addition to software expectations, state-backed intelligence doesn't require any software (or hardware) security flaw to surveil you. If you're are a target of interest to them, there isn't much you can do. As you say, only thing you can do in such case, is to do everything assuming you're being spied upon.

chubot 5y ago
As James Mickens says, there are only two threat models: 1. Mossad 2. Not Mossad https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://news.ycombinator.com/item?id=27915173 https://news.ycombinator.com/item?id=27915173 :)
- 0xCMP 5y ago
  I've read and sent that PDF so many times. A fun snippet that jumped out at me this time: > With public key cryptography, there’s a horrible, fundamental challenge of finding somebody, anybody, to establish and maintain the infrastructure. For example, you could enlist a well-known technology company to do it, but this would offend the refined aesthetics of the vaguely Marxist but comfortably bourgeoisie hacker community who wants everything to be decentralized and who non-ironically believes that Tor is used for things besides drug deals and kidnapping plots.
- deleted 5y ago
  [deleted]
- jjav 5y ago
  That is most often relevant, but here not quite. Apple has way more budget than Mossad.
  - inglor 5y ago
    Lucky for the Mossad they are not building a competitor to the iPhone/iMac/MacBookPro/iPad etc... They don't have to compete with apple they just have to find an interesting mistake in their code. On phones with tens of years of legacy firmware/modem/protocol code that's very hard to reliably stop. (NSO is not Mossad and Mossad doesn't use NSO afaik)

fortran77 5y ago

But it's not "state funded". NSO is a private company owned by Novelpina Capital, LLC.

PradeetPatel 5y ago
It has been established that there is a clear link between NSO and the Israeli government.
- fortran77 5y ago
  https://en.wikipedia.org/wiki/Weasel_word https://en.wikipedia.org/wiki/Weasel_word
- SigmundA 5y ago
  I believe Apples quarterly revenues are similar to Israel's yearly government expenditures.
drzaiusapelord 5y ago
Not technically but an Israeli cybersecurity company like this isn't exactly two guys in garabge bootstrappy capitalist success story you're making it out to be. It most likely is filled with spooks, has deep connections with the Israeli intelligence services, and is full of ex-military. In authoritarian or semi-authoritarian regimes spinning off hacking to a private company pays dividends, because they get blacklisted, as a private company, which doesn't greatly affect diplomatic norms. Also it allows Israel to sell exploits to regimes that might be hard to via government agencies. Afterall, it was "private" business that sold them, not the government, wink wink. A bit like so many "private" cybergangs in Russia have impunity to attack the USA/EU and sell and deploy ransomware there because, again, its "not the government, its criminals" but in reality they're defacto arms of the governments there or at least have strong ties to the government, pay them protection money, and often get marching orders from them.
- samatman 5y ago
  > is full of ex-military To be fair, this is just as true of an Israeli car repair shop or shawarma joint...

lr4444lr 5y ago

Though their bread and butter us government contracts, NSO is a private venture backed firm.

tyrfing 5y ago

Apple makes more in profit per year than the US IC budget. Their annual revenue is slightly lower than the entire GDP of Israel, where NSO is based. It is far less unrealistic than you think.

olliej 5y ago
Core difference though is one side has to find a few bugs, the other side has to make zero mistakes.
- tyrfing 5y ago
  That is mostly true, but I hate to see the narrative that it's insecure due to lack of resources. It's easy to miss the ridiculous scale of these big tech companies.
  - olliej 5y ago
    The problem is not money, there is only so much any one engineer can do, and there are only so many engineers you can have working on anything. No one can "solve" security simply by buying more engineers, what is needed is time.
    - lern_too_spel 5y ago
      NSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabilities.
      - saagarjha 5y ago
        But can Apple outspend all NSOs? Including the various government-backed entities?
        olliej 5y ago
        The problem is time rather than money - there are a finite number of engineering hours in a year, the only way to increase that is to add more engineers, but adding more engineers very rapidly starts costing time rather than helping.

pyuser583 5y ago

Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. No other tech has that level of control. Think of the controversy surrounding the Intel ME and other “secondary processors”. Not an issue with the IPhone (from Apples perspective). When Google decided they wanted to control all the computing on their servers, from bare metal up, they ran into the ME. Apple is the only key civilian entity with that level of control.

coldtea 5y ago
>Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. That's not really relevant. The American intelligence apparatus controls their entire stack too, ordering and autiting custom versions of professors and such.
drzaiusapelord 5y ago
Apple cant do this on its servers either, considering it has no server product. Google has this stack control in Android, Google Home, Chromebook, etc trivially if it chooses, if it doesn't have that already. Microsoft can do this on its Cortana smart speakers and Surface Pro X running their (Qualcomms) ARM cpu. Also I imagine bulk buyers can get Intel ME disabled if they don't want it on their server. AMD PSP can be disabled in the BIOS I believe. Comparing a phone to a server doesn't make too much sense. A phone is a consumer product like Android or Home and a server is a business product. Apple runs its cloud on Intel or AMD like everyone else.
- mike_d 5y ago
  > Apple cant do this on its servers either, considering it has no server product Wat? https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/macos/server/ https://www.apple.com/macos/server/
  - deleted 5y ago
    [deleted]

jrochkind1 5y ago

Don't forgot how recently this wasn't obvious to hardly anyone though. Probably only 10 years ago, I knew a lot of people who thought careful and conscientious use of encryption and security features could protect sensitive info from governments. That's not a very long time ago. It's taken a while to sink in -- and to the full extent of it being more and more widely known. That nearly any government can probably trivially get access to anything, using commodity off-the-shelf surveillance software. (Postscript: Edward Snowden is a hero).

albertopv 5y ago

Apple has tons of money, a crazy amount of money, they have a net income of dozens of billions every quarter. They have more money than most state funded agencies. They just don't want to.

nicce 5y ago
> They just don't want to. Do you even know what you are asking? You are asking perfect code and hardware, no single mistake on any line of the process. Taking account on every possible scenario and sidescenario you can’t or can think about.
jagger27 5y ago
I strongly suspect you would not be able to find a single Apple employee who says they "don't want to" protect iPhones from NSO malware.
poisonborz 5y ago
A lot of commenters point to the heaps of money. But what do you buy with it? How do you build it up at this scale? Security isn't a metric you can reliably work by like clicks, op/s and sales. And beyond a very narrow frame it won't help their case of being a producer of consumer products, rather it makes very difficult to work with state actors.
- blip54321 5y ago
  Raising bug bounties by an order of magnitude goes a long ways. Apple's program is pretty good relative to industry norms, but all of the programs are well below black/gray market prices for exploits, and most are below costs to find, document, and submit an exploit. Google pays less than a month's salary for their most serious Chrome exploits, for example: https://bughunters.google.com/about/rules/5745167867576320 https://bughunters.google.com/about/rules/5745167867576320 I think all this is good until an adversary decides to brick every iDevice, Android, Windows, MacOS, and Linux machine in the US. And by "brick", I mean overwrite firmwares, disable fans, and run at maximum load.

deleted 5y ago

[deleted]

phendrenad2 5y ago

That sounds narrow and simplistic to me. Apple is just consumer-grade hardware? How many politicians and CEOs of key American businesses use iPhones? Probably all of them. Is there some secret iPhone model for Donald Trump, hand-patched and reflow soldered by the NSA to remove any NSO vulnerabilities? Does the American government not know about NSO? Are they powerless to stop key American businesses from being hacked by a foreign state? I'm sure there's a lot more to the story that we'll only find out about with a well-placed FOIA in the year 2070 or so.

atemerev 5y ago

It should be possible to protect oneself. It is extremely difficult only because there are basically only two options if you want to have a smartphone: either iOS or Android. The immense power of nation-state adversaries is focused on just two targets. And there are are no commercial off-the-shelf security solutions that can “protect” you. You have to do your own security. This is why Snowden had to painstakingly teach the journalists on how to use GPG to receive his cache. No other way would be trustful enough.

biztos 5y ago

> defend itself from state-funded hackers Doesn't it matter which state? Sure, for US, Russia, China this is probably just true without nuance. For someplace like Israel (small but highly motivated and strong in both espionage and tech) apparently also true. But should I not expect a FAANG-level company to defend itself from state-sponsored hacking if the state is Uzbekistan or Cambodia? And if every state can get access to top-tier hacking by having an alliance with $MAJOR_PLAYER, why should we expect that doesn't extend to non-state actors? At which point, are we just giving up on security? I think Apple absolutely can defend itself against state-funded hackers. Whether they choose to do so is a question of priorities I guess.

fortran77 5y ago
NSO is not Israel. They are a small private company, based in Israel, owned by a UK private equity group. This isn’t a ‘state sponsored’ anything.
- biztos 5y ago
  I agree, in the same way that Raytheon is "not America," but my interpretation of the parent comment was that the cosy relationship with the government made it effectively the same thing from the point of view of companies defending themselves. Whether or not that's actually the case is an interesting discussion.
j16sdiz 5y ago
I am not so sure... State can use selective enforcement of different regulations to strongarm companies doing crazy stuffs..
- biztos 5y ago
  Granted, a state actor can (depending how important the state is to your business) compel you to not counter their attacks. But that isn’t really a question of technology, and the parent comment was, I think, suggesting it’s an unrealistic expectation on the tech level for companies to beat back state actors.

the_gipsy 5y ago

> it is absurdly unrealistic to expect that any consumer-grade software can defend itself from state-funded hackers Apple put it in their TV ads, you know.

datavirtue 5y ago

The defense is to not implement slapdash feature that careen into a memory ditch. I will repeat, Leaving out functionality that you have not secured is the defense. Calling software "consumer grade" and not expecting it to be secure is uninformed hand waving.

2OEH8eoCRo0 5y ago

Name some non consumer grade software that's up to the task? I think you're making excuses. Apple, owning the entire stack, has the least excuse of anyone. Given their market share they also have a lot of responsibility to be better.