5 ms·
That is mostly true, but I hate to see the narrative that it's insecure due to lack of resources. It's easy to miss the ridiculous scale of these big tech compa
by tyrfing 5y ago
That is mostly true, but I hate to see the narrative that it's insecure due to lack of resources. It's easy to miss the ridiculous scale of these big tech companies.
- olliej 5y agoThe problem is not money, there is only so much any one engineer can do, and there are only so many engineers you can have working on anything. No one can "solve" security simply by buying more engineers, what is needed is time.
- lern_too_spel 5y agoNSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabilities.
- saagarjha 5y agoBut can Apple outspend all NSOs? Including the various government-backed entities?
- olliej 5y agoThe problem is time rather than money - there are a finite number of engineering hours in a year, the only way to increase that is to add more engineers, but adding more engineers very rapidly starts costing time rather than helping.
- saagarjha 5y agoI think the strategy suggested here was “why doesn’t Apple just buy all of NSO’s exploits”, to which I responded that doing this for all threat actors is infeasible. I think you’re talking about actually solving the security issues, which is blocked by things that aren’t just money, I agree.
- jagger27 5y agoGovernment-backed entities can also make promises that Apple's money can't buy. Who knows what kind of back room deals are made that involve citizenship, safe passage, dropped criminal charges, etc.
- saagarjha 5y agoIndeed.
- lern_too_spel 5y agoBig governments aren't selling their espionage services, so they're arguably less important to handle. Moreover, there is likely duplication in exploits between these groups such that buying private sector exploits and patching them will likely take a few government exploits out with them.
- saagarjha 5y agoI wouldn’t argue that. Plus, note that there are many NSOs, and stamping them all out gets harder as you shut more of them down because prices go up.
- lern_too_spel 5y agoThe prices go up for the NSOs as well. At the point the price exceeds their clients' willingness to pay, the prices stop going up.
- nicce 5y agoResources get surprisingly low if you share them for every possible attack interface. (If you even know them all) On Apple’s scale, there are quite many. Attackers need to find only one buggy interface.