10 ms·

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pre

Wow, so much discussion of Apple and their software, and so little of NSO group and why they're even a thing. I just want to add this: these people operate pretty much in the open. They're not ashamed of it either, or else they wouldn't put it on their CV: https://www.linkedin.com/company/nso-group/people/ https://www.linkedin.com/company/nso-group/people/ That right there tells me that we as "the tech community" are way too okay with this sort of application of the tech. The tech we're all so convinced will "make the world a better place." /s

heywhatupboys 3y ago
people will put experience on their resume building literal bombs etc. why would this be any different, it is really a non-issue in comparison
illumin8 3y ago
I don't see why companies that facilitate criminal acts are not swiftly brought to legal justice. We should not be tolerating companies like NSO group in any sense. If the Israeli government wants to look the other way, we should designate NSO group a terrorist organization and start sanctioning any country that won't bring them to justice. If Snowden and Assange can be extradited to the US and tried for crimes, executives of NSO group absolutely should as well. Lock 'em up!
Obscurity4340 3y ago
The NSO is less of an issue to me than the fact they are finding exploits Apple isn't (assuming Apple truly isn't aware of these and/or building them in on request) and that Apple has more than enough to budget for. To me, the NSO (as evil as they are) is like a regulator who cuts through a company's "self-regulation" claims and proves that the company they are regulating is either intentionally making their own platform insecure or is at best, negligent to mitigating and being proactive in addressing obvious issues. Apple could pay all these people and companies way more than they could ever hope to earn on the free world market to simply fuck off. They are notoriously stingy with bug bounties and constantly disillusion those who are helping to ostensibly make their platforms more secure. I view NSO in a similar light to Correllium, whom Apple has tried to shutdown (unsuccessfully). Its like trying to blame a whistleblower rather than prosecuting the misconduct that comes to light. The energy and blame is misplaced and this lawsuit only distracts from the fact that iMessage is basically the skeleton key to access anything and everything on a modern iPhone, after all this time.
tempera 3y ago
Security holes will be hunted down and exploited in whatever is popular. That is a law of nature and no amount of shaming will change it.
resolutebat 3y ago
Oh, but you see, NSO targets only "terrorists and criminals", so if you're a law-abiding citizen with nothing to hide, there's nothing to be concerned about. Right? It's not like there's any regimes out there where, say, casual investigative journalism or opposition politics would ever land you with criminal or terrorist charges, no sirree.
- sz4kerto 3y ago
  In Hungary, for example, which is an EU country and democracy (i.e. there are elections), investigative journalists have been targeted with Pegasus by the government.
  - ErneX 3y ago
    Our Prime Minister (Spain) was a target and they supposedly extracted gigabytes from his phone. It was another country, we still don’t know which one it was but some think it was Morocco.
  - baq 3y ago
    In Poland, opposition party election campaign leaders were invigilated by Pegasus.
  - megous 3y ago
    Elections != democaracy. In Russia, there are also elections. So are they in Syria, and so on.
    - moonchrome 3y ago
      Sounds like you don't like the outcome and dismiss the possibility that it's the result of the system. From what I understand Orban has a decent approval rating in his country. For Putin it's hard to say since Russia is so foreign and separated, just like China - the only source of info is random crap by your preferred biased media source. But for Hungary - I've been there multiple times in the last few years, know a few people, and I have no trouble believing he won democratic elections.
H8crilA 3y ago
Much of this stuff is classified as a weapon, and thus really sold by the Israeli government, not by the company. It's no different from a MANPADS that sometimes is used to destroy a Ka-52 over Ukraine, and sometimes is used to shoot down a civilian airliner - that is to say it's directed by the foreign policy (and foreign policy errors) of the manufacturing country. There's no reason to expect the world to disarm any time soon, so the best approach is to be aware and democratically influence policy, rooting out bad ideas and bad actors. Israel is constantly trying to woo Saudi Arabia so that they can be allies during a potential war with Iran. Israel will definitely sacrifice some human rights activists just for the ability to cross the Saudi airspace. But it has not been going well for Israel lately.
- throwaway290 3y ago
  AFAIK Israeli government audits NSO and stuff, but they are separate... And Intellexa (authors of Predator I think?) doesn't even get audited because it's "not israeli" on paper
  - H8crilA 3y ago
    The important part is export control - i.e. deciding who can buy the stuff: https://en.wikipedia.org/wiki/NSO_Group https://en.wikipedia.org/wiki/NSO_Group
    - throwaway290 3y ago
      If they are dumb and get caught during audit for selling to Sudan or something then sure, Israeli government will probably tell them they're bad. (And what, shut them down? Lol.)
  - rany_ 3y ago
    It's more like they leverage it for diplomacy. The auditing means nothing really, it's being given to authoritarian government like Saudi Arabia as long as they are OK with Israel existing. The bar to get access to NSO tools is too low...
quonn 3y ago
— The tech we're all so convinced will "make the world a better place." — That was true 15 years ago … I don‘t hear this often anymore.
- hospitalJail 3y ago
  The cost of living is absurdly low. I do believe tech made it possible. The only concern I have is greed from landlords and medical practitioners. The cost of resources has plummeted, the cost of scarce things (land and medical licenses) continue to go up. (Although limited medical licensees is a US corruption thing, its not inherent)
- klabb3 3y ago
  It sad true that tech would make the world a better place (in some ways). But not because of the infinite goodness and wisdom of the first movers, who happened to entrench themselves at the right moment in time. The same is true today. Eg LLMs have huge potential. What worries me are the sociopaths who draw the same conclusion.
  - deleted 3y ago
    [deleted]
caisah 3y ago
There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spyware-scandal-exposing-pegasus/ https://www.pbs.org/wgbh/frontline/documentary/global-spywar.... It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.
- allie1 3y ago
  To sell the software, they need approval from Israel’s govt, as the software is treated as a weapon
  - dkindler 3y ago
    The US gov't almost certainly has a say as well.
    - withinboredom 3y ago
      The US has their own version, called the NSA. Available to hire via really simple framing. Guaranteed whomever is caught will be in prison for years just to get a trial to prove they're innocent.
      - bink 3y ago
        The US has private firms buying, developing, and selling malware as well. NSO group is just a little more open and shameless about it.
- goodluckchuck 3y ago
  The ties to government are a red herring. Hacking into people’s private phones and computer systems is generally immoral and illegal. It generally continues to be immoral and illegal when governments do it. Except it also becomes more outrageous, because governments are supposed to protect us from this sort of thing.
dr_kiszonka 3y ago
FWIW, some tech does make the world a better place. It is just that a lot of this tech does not pay enough to put it on our radars.
localplume 3y ago
[dead]
Sephr 3y ago
Selling malware/software weapons to US entities is generally legal for other US entities*, with the main caveat that if it ends up ITAR regulated then you can only sell it to the US government and other ITAR-cleared suppliers unless it's open source (in which case you'd be selling the platform). NSO Group is bad because they have been caught selling to oppressive regimes and allegedly actively supported (and potentially continue to support) the deployment of their software for oppressive regimes to harm innocent civilians. They should be (and iirc are) sanctioned for their bad behaviors, bad intentions, and mishandling of their responsibilities. * There are plenty of caveats (e.g. the seller & buyer need to have good intentions and only plan to use the malware in accordance with the law). I am not a lawyer and this is not legal advice.
neilv 3y ago
In the current environment of Internet-powered inane mob behavior, we should try to avoid pointing the mob at individuals.
- dspearson 3y ago
  Nobody is forcing anyone to work for these scumbags. It is a choice.
- sneak 3y ago
  I disagree entirely. I regularly name specific people from "git blame" in bug reports calling out unethical behavior. Just because you got a paycheck for it doesn't suddenly make the behavior ethical.
aihkas 3y ago
[flagged]
- jker 3y ago
  Take it down a notch, please.
smfugit 3y ago
No big political leaders out of the tech world yet. So "the tech community" doesnt have anyone to rally around. And this more a political prob than a technical problem.
jwr 3y ago
> That right there tells me that we as "the tech community" are way too okay with this sort of application of the tech. The tech we're all so convinced will "make the world a better place." This calls for a larger discussion of individual choices of every one of us. It would not be an easy discussion, because things are far from simple, and yet every one of us should actively think, instead of falling into the whataboutism trap and doing nothing. For example, there are probably thousands of tech people in Russia right now either breaking into Ukrainian systems or writing software for missiles, drones, targeting systems, etc. These systems do not write themselves. Each of those people should ask themselves if this is really what they should be doing. I am certainly asking myself if I want to ever work with people who were complicit in these crimes (and how will I know?). I know some people who pledged to never work on any military systems. I was close to that point of view, until Russia started dropping bombs on my Ukrainian friends. Now I don't see it quite in the same light anymore. Similarly, the NSO group is not an amorphous entity, PEOPLE work there and write these exploits. In each case, it is a conscious decision. My point is that we can't abstract tech from moral choices. There is always right and wrong, there is always the right thing to do. It might not be universally applicable, and there will always be endless discussions on HN ("but what about..."), but each of us can and should think about how our work is applied.
- tryauuum 3y ago
  Yep it's hard It's easy for me to say "I won't work on military stuff" but then again I'm single and have no kids I don't know if I would have courage to stop working in Russian military IT tech if I were a sole provider for a family of three.
rakkhi 3y ago
Well it's like complaining about the sun or wearing sun screen. Bad guys will always be there. Bears pandas eagles... We wear sun screen and maybe get pissed if the sun screen company is not doing a good job. But go ahead yell at the sun. Those dam UV rays!!!
- comboy 3y ago
  I generally agree but it's nuanced. Think about your physical home security. Just like bad guys are always gonna be there, so will the bugs.
rmbyrro 3y ago
It gives me the impression that you find "the tech community" to be a cohesive collective that has the organization to switch gears in a given direction. I wonder why you expect it to be like that. In reality, "the tech community" is extremely diverse and not cohesive at all. For one example, a large proportion of developers are barely making enough money to pay their most basic bills. They don't have enough mental space to even know what NSO is...
- jdright 3y ago
  That is the problem, we are not cohesive enough in shaming these people. They are criminals, and criminals don't post openly on linkedin proud of their work.
- skissane 3y ago
  > In reality, "the tech community" is extremely diverse and not cohesive at all. I really dislike this phrasing "the X community" which seems to be so popular nowadays. Lumping together many millions of people worldwide who have a single thing in common–how did people end up using the word "community" to describe that?
  - beebeepka 3y ago
    Every time I see "the intelligence community" I just know I am reading propaganda
- fortran77 3y ago
  I’m in the Tech Community. I’m fine with the NSO group. (Which, btw, is owned by U.K. Novalpina Capital, and managed by a firm out of Luxembourg. But for some reason you all here aren’t obsessed with those countries.)
- black_puppydog 3y ago
  That right there is why I used the scare quotes. :)
dcormier 3y ago
Darknet Diaries had an episode about them a while back. It’s a good listen (as that podcast always is). https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
- oo0shiny 3y ago
  I just got finished listening to the most recent episode of Darknet Diaries this morning on the way into the office! It was about similar companies to the NSO group: https://darknetdiaries.com/episode/137/ https://darknetdiaries.com/episode/137/
  - PawgerZ 3y ago
    I listened to the first half this morning. Was thinking about going back and watching the NSO group episode he mentioned again. Then I get to work, and the first thing I see is this link.
yyyk 3y ago
Actual headline: mentions NSO group and nothing about Apple. Top comment (+50 comments): Why do we talk about Apple so much and so little about NSO group. The absurdly pro-Apple PR on HN is tough to bear. I have to say it's so overt it made me more hostile to Apple (NSO is obviously a worthy topic, but we do discuss it).
- deleted 3y ago
  [deleted]
- yyyk 3y ago
  (responding to a deleted comment) Plenty of these comments are about NSO. And that's fine! But trying to catch every blackhat won't solve our security problems. Ultimately, the only solution to these security holes is more secure software, and the only way to get that is to pressure Apple to invest more resources. The main question should be how come 'secure' Apple software keeps having 0-click exploits. Pressuring Microsoft led them to adopt a much more secure culture compared to previously. Apple shouldn't be exempt from the same pressure.
- black_puppydog 3y ago
  To be fair, when I made my post I had to go through 3 pages of threads to verify there was indeed, at that moment, very little discussion about NSO, and mostly discussion about remedies and how bad apple is handling imessage. But I'm glad that enough other people seem to care. :)
raxxorraxor 3y ago
This is a problem of legislation. It would be trivially easy to stop this behavior, but governments in the western sphere tend to like surveillance as well.
DSingularity 3y ago
I dont think its the "tech community" being okay with this application of the tech as much as it is fear of standing up to Israelis in any way. Imagine you own a infosec company and an applicant with excellent skills applies. You look at the CV in detail before the interview and you see that they proudly declare their NSO background. Tell me what will you do? Cancel the interview? How comfortable would you be to deny the applicant a job for that reason alone? I would wager the majority would consciously hire them out of fear of blowback and most of the remainder would unconsciously suppress their opinions on the NSO.
- black_puppydog 3y ago
  Nah. Joining NSO or such displays a moral "flexibility" and/or a lack of judgement that pretty much precludes the individual from taking on significant responsibility. Imagine having a business handling privacy relevant data and when someone asks about your stance on data security you have to admit you hired people who are okay with keeping the whole planet insecure for their own benefit. I know, I know, in my more cynical moments I see it your way as well. But that doesn't make it right.
cookiengineer 3y ago
The NSO group is the easiest to spot. The other parties involved in their operations are not so easily traced, such as Team Jorge, AIMS, Legion, Xaknet etc. For once, I am not okay with what they are doing, and I've started to fight them actively. You're welcome to join.
asveikau 3y ago
If NSO did not exist the vulnerabilities they discover would still be there. So I guess the complaint should not be that they exist, so much as their motivations and applications being questionable. It's an argument for something similarly funded to exist, but with an aim to responsibly report the bugs and get them fixed.
broupannoiffuto 3y ago
The 0-day market does not only exist for iOS. There are many perfectly "official" companies in the west advertising and selling those.

heywhatupboys 3y ago

people will put experience on their resume building literal bombs etc. why would this be any different, it is really a non-issue in comparison

illumin8 3y ago

I don't see why companies that facilitate criminal acts are not swiftly brought to legal justice. We should not be tolerating companies like NSO group in any sense. If the Israeli government wants to look the other way, we should designate NSO group a terrorist organization and start sanctioning any country that won't bring them to justice. If Snowden and Assange can be extradited to the US and tried for crimes, executives of NSO group absolutely should as well. Lock 'em up!

Obscurity4340 3y ago

The NSO is less of an issue to me than the fact they are finding exploits Apple isn't (assuming Apple truly isn't aware of these and/or building them in on request) and that Apple has more than enough to budget for. To me, the NSO (as evil as they are) is like a regulator who cuts through a company's "self-regulation" claims and proves that the company they are regulating is either intentionally making their own platform insecure or is at best, negligent to mitigating and being proactive in addressing obvious issues. Apple could pay all these people and companies way more than they could ever hope to earn on the free world market to simply fuck off. They are notoriously stingy with bug bounties and constantly disillusion those who are helping to ostensibly make their platforms more secure. I view NSO in a similar light to Correllium, whom Apple has tried to shutdown (unsuccessfully). Its like trying to blame a whistleblower rather than prosecuting the misconduct that comes to light. The energy and blame is misplaced and this lawsuit only distracts from the fact that iMessage is basically the skeleton key to access anything and everything on a modern iPhone, after all this time.

tempera 3y ago

Security holes will be hunted down and exploited in whatever is popular. That is a law of nature and no amount of shaming will change it.

resolutebat 3y ago

Oh, but you see, NSO targets only "terrorists and criminals", so if you're a law-abiding citizen with nothing to hide, there's nothing to be concerned about. Right? It's not like there's any regimes out there where, say, casual investigative journalism or opposition politics would ever land you with criminal or terrorist charges, no sirree.

sz4kerto 3y ago
In Hungary, for example, which is an EU country and democracy (i.e. there are elections), investigative journalists have been targeted with Pegasus by the government.
- ErneX 3y ago
  Our Prime Minister (Spain) was a target and they supposedly extracted gigabytes from his phone. It was another country, we still don’t know which one it was but some think it was Morocco.
- baq 3y ago
  In Poland, opposition party election campaign leaders were invigilated by Pegasus.
- megous 3y ago
  Elections != democaracy. In Russia, there are also elections. So are they in Syria, and so on.
  - moonchrome 3y ago
    Sounds like you don't like the outcome and dismiss the possibility that it's the result of the system. From what I understand Orban has a decent approval rating in his country. For Putin it's hard to say since Russia is so foreign and separated, just like China - the only source of info is random crap by your preferred biased media source. But for Hungary - I've been there multiple times in the last few years, know a few people, and I have no trouble believing he won democratic elections.

H8crilA 3y ago

Much of this stuff is classified as a weapon, and thus really sold by the Israeli government, not by the company. It's no different from a MANPADS that sometimes is used to destroy a Ka-52 over Ukraine, and sometimes is used to shoot down a civilian airliner - that is to say it's directed by the foreign policy (and foreign policy errors) of the manufacturing country. There's no reason to expect the world to disarm any time soon, so the best approach is to be aware and democratically influence policy, rooting out bad ideas and bad actors. Israel is constantly trying to woo Saudi Arabia so that they can be allies during a potential war with Iran. Israel will definitely sacrifice some human rights activists just for the ability to cross the Saudi airspace. But it has not been going well for Israel lately.

throwaway290 3y ago
AFAIK Israeli government audits NSO and stuff, but they are separate... And Intellexa (authors of Predator I think?) doesn't even get audited because it's "not israeli" on paper
- H8crilA 3y ago
  The important part is export control - i.e. deciding who can buy the stuff: https://en.wikipedia.org/wiki/NSO_Group https://en.wikipedia.org/wiki/NSO_Group
  - throwaway290 3y ago
    If they are dumb and get caught during audit for selling to Sudan or something then sure, Israeli government will probably tell them they're bad. (And what, shut them down? Lol.)
- rany_ 3y ago
  It's more like they leverage it for diplomacy. The auditing means nothing really, it's being given to authoritarian government like Saudi Arabia as long as they are OK with Israel existing. The bar to get access to NSO tools is too low...

quonn 3y ago

— The tech we're all so convinced will "make the world a better place." — That was true 15 years ago … I don‘t hear this often anymore.

hospitalJail 3y ago
The cost of living is absurdly low. I do believe tech made it possible. The only concern I have is greed from landlords and medical practitioners. The cost of resources has plummeted, the cost of scarce things (land and medical licenses) continue to go up. (Although limited medical licensees is a US corruption thing, its not inherent)
klabb3 3y ago
It sad true that tech would make the world a better place (in some ways). But not because of the infinite goodness and wisdom of the first movers, who happened to entrench themselves at the right moment in time. The same is true today. Eg LLMs have huge potential. What worries me are the sociopaths who draw the same conclusion.
- deleted 3y ago
  [deleted]

caisah 3y ago

There is a nice PBS documentary about Pegasus's NSO https://www.pbs.org/wgbh/frontline/documentary/global-spyware-scandal-exposing-pegasus/ https://www.pbs.org/wgbh/frontline/documentary/global-spywar.... It looks like NSO is backed up by the Israeli government. They say their software is only sold to governments which were previously vetted, but the reality is that most of the time they sell to authoritarian states which monitor and persecute people opposing the regime.

allie1 3y ago
To sell the software, they need approval from Israel’s govt, as the software is treated as a weapon
- dkindler 3y ago
  The US gov't almost certainly has a say as well.
  - withinboredom 3y ago
    The US has their own version, called the NSA. Available to hire via really simple framing. Guaranteed whomever is caught will be in prison for years just to get a trial to prove they're innocent.
    - bink 3y ago
      The US has private firms buying, developing, and selling malware as well. NSO group is just a little more open and shameless about it.
goodluckchuck 3y ago
The ties to government are a red herring. Hacking into people’s private phones and computer systems is generally immoral and illegal. It generally continues to be immoral and illegal when governments do it. Except it also becomes more outrageous, because governments are supposed to protect us from this sort of thing.

dr_kiszonka 3y ago

FWIW, some tech does make the world a better place. It is just that a lot of this tech does not pay enough to put it on our radars.

localplume 3y ago

[dead]

Sephr 3y ago

Selling malware/software weapons to US entities is generally legal for other US entities*, with the main caveat that if it ends up ITAR regulated then you can only sell it to the US government and other ITAR-cleared suppliers unless it's open source (in which case you'd be selling the platform). NSO Group is bad because they have been caught selling to oppressive regimes and allegedly actively supported (and potentially continue to support) the deployment of their software for oppressive regimes to harm innocent civilians. They should be (and iirc are) sanctioned for their bad behaviors, bad intentions, and mishandling of their responsibilities. * There are plenty of caveats (e.g. the seller & buyer need to have good intentions and only plan to use the malware in accordance with the law). I am not a lawyer and this is not legal advice.

neilv 3y ago

In the current environment of Internet-powered inane mob behavior, we should try to avoid pointing the mob at individuals.

dspearson 3y ago
Nobody is forcing anyone to work for these scumbags. It is a choice.
sneak 3y ago
I disagree entirely. I regularly name specific people from "git blame" in bug reports calling out unethical behavior. Just because you got a paycheck for it doesn't suddenly make the behavior ethical.

aihkas 3y ago

[flagged]

jker 3y ago
Take it down a notch, please.

smfugit 3y ago

No big political leaders out of the tech world yet. So "the tech community" doesnt have anyone to rally around. And this more a political prob than a technical problem.

jwr 3y ago

> That right there tells me that we as "the tech community" are way too okay with this sort of application of the tech. The tech we're all so convinced will "make the world a better place." This calls for a larger discussion of individual choices of every one of us. It would not be an easy discussion, because things are far from simple, and yet every one of us should actively think, instead of falling into the whataboutism trap and doing nothing. For example, there are probably thousands of tech people in Russia right now either breaking into Ukrainian systems or writing software for missiles, drones, targeting systems, etc. These systems do not write themselves. Each of those people should ask themselves if this is really what they should be doing. I am certainly asking myself if I want to ever work with people who were complicit in these crimes (and how will I know?). I know some people who pledged to never work on any military systems. I was close to that point of view, until Russia started dropping bombs on my Ukrainian friends. Now I don't see it quite in the same light anymore. Similarly, the NSO group is not an amorphous entity, PEOPLE work there and write these exploits. In each case, it is a conscious decision. My point is that we can't abstract tech from moral choices. There is always right and wrong, there is always the right thing to do. It might not be universally applicable, and there will always be endless discussions on HN ("but what about..."), but each of us can and should think about how our work is applied.

tryauuum 3y ago
Yep it's hard It's easy for me to say "I won't work on military stuff" but then again I'm single and have no kids I don't know if I would have courage to stop working in Russian military IT tech if I were a sole provider for a family of three.

rakkhi 3y ago

Well it's like complaining about the sun or wearing sun screen. Bad guys will always be there. Bears pandas eagles... We wear sun screen and maybe get pissed if the sun screen company is not doing a good job. But go ahead yell at the sun. Those dam UV rays!!!

comboy 3y ago
I generally agree but it's nuanced. Think about your physical home security. Just like bad guys are always gonna be there, so will the bugs.

rmbyrro 3y ago

It gives me the impression that you find "the tech community" to be a cohesive collective that has the organization to switch gears in a given direction. I wonder why you expect it to be like that. In reality, "the tech community" is extremely diverse and not cohesive at all. For one example, a large proportion of developers are barely making enough money to pay their most basic bills. They don't have enough mental space to even know what NSO is...

jdright 3y ago
That is the problem, we are not cohesive enough in shaming these people. They are criminals, and criminals don't post openly on linkedin proud of their work.
skissane 3y ago
> In reality, "the tech community" is extremely diverse and not cohesive at all. I really dislike this phrasing "the X community" which seems to be so popular nowadays. Lumping together many millions of people worldwide who have a single thing in common–how did people end up using the word "community" to describe that?
- beebeepka 3y ago
  Every time I see "the intelligence community" I just know I am reading propaganda
fortran77 3y ago
I’m in the Tech Community. I’m fine with the NSO group. (Which, btw, is owned by U.K. Novalpina Capital, and managed by a firm out of Luxembourg. But for some reason you all here aren’t obsessed with those countries.)
black_puppydog 3y ago
That right there is why I used the scare quotes. :)

dcormier 3y ago

Darknet Diaries had an episode about them a while back. It’s a good listen (as that podcast always is). https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/

oo0shiny 3y ago
I just got finished listening to the most recent episode of Darknet Diaries this morning on the way into the office! It was about similar companies to the NSO group: https://darknetdiaries.com/episode/137/ https://darknetdiaries.com/episode/137/
- PawgerZ 3y ago
  I listened to the first half this morning. Was thinking about going back and watching the NSO group episode he mentioned again. Then I get to work, and the first thing I see is this link.

yyyk 3y ago

Actual headline: mentions NSO group and nothing about Apple. Top comment (+50 comments): Why do we talk about Apple so much and so little about NSO group. The absurdly pro-Apple PR on HN is tough to bear. I have to say it's so overt it made me more hostile to Apple (NSO is obviously a worthy topic, but we do discuss it).

deleted 3y ago
[deleted]
yyyk 3y ago
(responding to a deleted comment) Plenty of these comments are about NSO. And that's fine! But trying to catch every blackhat won't solve our security problems. Ultimately, the only solution to these security holes is more secure software, and the only way to get that is to pressure Apple to invest more resources. The main question should be how come 'secure' Apple software keeps having 0-click exploits. Pressuring Microsoft led them to adopt a much more secure culture compared to previously. Apple shouldn't be exempt from the same pressure.
black_puppydog 3y ago
To be fair, when I made my post I had to go through 3 pages of threads to verify there was indeed, at that moment, very little discussion about NSO, and mostly discussion about remedies and how bad apple is handling imessage. But I'm glad that enough other people seem to care. :)

raxxorraxor 3y ago

This is a problem of legislation. It would be trivially easy to stop this behavior, but governments in the western sphere tend to like surveillance as well.

DSingularity 3y ago

I dont think its the "tech community" being okay with this application of the tech as much as it is fear of standing up to Israelis in any way. Imagine you own a infosec company and an applicant with excellent skills applies. You look at the CV in detail before the interview and you see that they proudly declare their NSO background. Tell me what will you do? Cancel the interview? How comfortable would you be to deny the applicant a job for that reason alone? I would wager the majority would consciously hire them out of fear of blowback and most of the remainder would unconsciously suppress their opinions on the NSO.

black_puppydog 3y ago
Nah. Joining NSO or such displays a moral "flexibility" and/or a lack of judgement that pretty much precludes the individual from taking on significant responsibility. Imagine having a business handling privacy relevant data and when someone asks about your stance on data security you have to admit you hired people who are okay with keeping the whole planet insecure for their own benefit. I know, I know, in my more cynical moments I see it your way as well. But that doesn't make it right.

cookiengineer 3y ago

The NSO group is the easiest to spot. The other parties involved in their operations are not so easily traced, such as Team Jorge, AIMS, Legion, Xaknet etc. For once, I am not okay with what they are doing, and I've started to fight them actively. You're welcome to join.

asveikau 3y ago

If NSO did not exist the vulnerabilities they discover would still be there. So I guess the complaint should not be that they exist, so much as their motivations and applications being questionable. It's an argument for something similarly funded to exist, but with an aim to responsibly report the bugs and get them fixed.

broupannoiffuto 3y ago

The 0-day market does not only exist for iOS. There are many perfectly "official" companies in the west advertising and selling those.