4 ms·

Thought experiment: Apple could hire nine NSO equivalent teams to do what NSO does. Then fix the bugs they find. This is not a guarantee there are no bugs, but

Thought experiment: Apple could hire nine NSO equivalent teams to do what NSO does. Then fix the bugs they find. This is not a guarantee there are no bugs, but if finding them is crucial to fixing them, NSO is now 1/10 likely to be the team that finds them and 10 times less likely to maintain unique access to the secret. Scale numbers to make better financial sense. Now, one would think there are already more non-NSO security researchers than NSO have, who earn money from bounties and report issues to Apple. Yet NSO has a business model. How?

olliej 5y ago
You're assuming apple doesn't already have that. What we see in the news, etc is an example of survivor bias: you don't see the bugs that apple finds in anything they haven't released.
- judge2020 5y ago
  For reference, Apple has four red team positions currently open[0], and I imagine these are rolling openings (ie. recreated every 6 months or so for listing refinement). 0: https://jobs.apple.com/en-us/search?search=%22red%20team%22&sort=relevance&location=united-states-USA https://jobs.apple.com/en-us/search?search=%22red%20team%22&...
fortran77 5y ago
> Yet NSO has a business model. How? Because Apple's security is actually pretty bad, making their job easy.
throwaway_4ever 5y ago
> Apple could hire nine NSO equivalent teams to do what NSO does. No they can’t. If Apple could, they would deploy their war chest billions to do so. People often make the mistake of thinking some objective is money-constrained, and a place like Microsoft could’ve just thrown the most money at mobile in 2008 to be the best mobile OS. The Israeli’s in these national security level positions work like their life depends on it because they literally believe it does. Good luck replicating that with a gazillion teams of cushy big tech Silicon Valley positions.
olliej 5y ago
Another thing I realized, but after I could edit my comment :D NSO makes money reselling the same set of productized exploits. Their business model depends on no one else (apple or other researchers) finding it. Selling an exploit gets you a single payday, selling a service lets them both charge market rate for exploits, but keep doing so. Honestly I wouldn't be surprised if they had a monthly subscription fee.
poisonborz 5y ago
It isn't just about NSO-level entities. Their products have an almost full reach over the human population. Every security researcher and most of the good engineers are looking at them or their customers as target, in some way. The're always outnumbered. Money and headcount gets you only so far. Global reach = global attack surface with global adversaries, and not only within the industry.
zx85wes 5y ago
They don't care about these hacks unless they hit their bottom line.

olliej 5y ago

You're assuming apple doesn't already have that. What we see in the news, etc is an example of survivor bias: you don't see the bugs that apple finds in anything they haven't released.

judge2020 5y ago
For reference, Apple has four red team positions currently open[0], and I imagine these are rolling openings (ie. recreated every 6 months or so for listing refinement). 0: https://jobs.apple.com/en-us/search?search=%22red%20team%22&sort=relevance&location=united-states-USA https://jobs.apple.com/en-us/search?search=%22red%20team%22&...

fortran77 5y ago

> Yet NSO has a business model. How? Because Apple's security is actually pretty bad, making their job easy.

throwaway_4ever 5y ago

> Apple could hire nine NSO equivalent teams to do what NSO does. No they can’t. If Apple could, they would deploy their war chest billions to do so. People often make the mistake of thinking some objective is money-constrained, and a place like Microsoft could’ve just thrown the most money at mobile in 2008 to be the best mobile OS. The Israeli’s in these national security level positions work like their life depends on it because they literally believe it does. Good luck replicating that with a gazillion teams of cushy big tech Silicon Valley positions.

olliej 5y ago

Another thing I realized, but after I could edit my comment :D NSO makes money reselling the same set of productized exploits. Their business model depends on no one else (apple or other researchers) finding it. Selling an exploit gets you a single payday, selling a service lets them both charge market rate for exploits, but keep doing so. Honestly I wouldn't be surprised if they had a monthly subscription fee.

poisonborz 5y ago

It isn't just about NSO-level entities. Their products have an almost full reach over the human population. Every security researcher and most of the good engineers are looking at them or their customers as target, in some way. The're always outnumbered. Money and headcount gets you only so far. Global reach = global attack surface with global adversaries, and not only within the industry.

zx85wes 5y ago

They don't care about these hacks unless they hit their bottom line.