3 ms·
NSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabili
by lern_too_spel 5y ago
NSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabilities.
- saagarjha 5y agoBut can Apple outspend all NSOs? Including the various government-backed entities?
- olliej 5y agoThe problem is time rather than money - there are a finite number of engineering hours in a year, the only way to increase that is to add more engineers, but adding more engineers very rapidly starts costing time rather than helping.
- saagarjha 5y agoI think the strategy suggested here was “why doesn’t Apple just buy all of NSO’s exploits”, to which I responded that doing this for all threat actors is infeasible. I think you’re talking about actually solving the security issues, which is blocked by things that aren’t just money, I agree.
- jagger27 5y agoGovernment-backed entities can also make promises that Apple's money can't buy. Who knows what kind of back room deals are made that involve citizenship, safe passage, dropped criminal charges, etc.
- saagarjha 5y agoIndeed.
- lern_too_spel 5y agoBig governments aren't selling their espionage services, so they're arguably less important to handle. Moreover, there is likely duplication in exploits between these groups such that buying private sector exploits and patching them will likely take a few government exploits out with them.
- saagarjha 5y agoI wouldn’t argue that. Plus, note that there are many NSOs, and stamping them all out gets harder as you shut more of them down because prices go up.
- lern_too_spel 5y agoThe prices go up for the NSOs as well. At the point the price exceeds their clients' willingness to pay, the prices stop going up.