3 ms·

Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. But while they could try and poach them today, tomorrow t

by entuno 3y ago

Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. But while they could try and poach them today, tomorrow there will be a whole load of new people working for those companies, and it'll just be a never-ending cycle.

cco 3y ago
> Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. For moral reasons do you mean? I would be surprised to learn there are a lot of people that are open to selling 0 day exploits to "bad actors" (granted that this term is doing a lot of heavy lifting here), but wouldn't want to work for Google or Apple. > ...it'll just be a never-ending cycle I think the idea is you pay them so well that they can work for a handful of years and remove any cash incentive reason for them to continue selling 0 days to bad actors.
- eastbound 3y ago
  > “bad actors", but wouldn't want to work for Google or Apple - Everyone who doesn’t like US hegemony. Which happens about everywhere but US, in varied proportion, but even in Europe, and even worse in Middle-East, - Everyone who doesn’t like monopolies. Capitalism of competition (as opposed to state capitalism, when the state borrows a trillion per semester, ahem) requires that monopolies be broken down to avoid distortion of competition. Helping bad actors can be, under their viewpoint, less bad than the damage done to a billion consumers consumers at a time. Plus monopolies impose a monoculture of occidentalism, with certain values that a firm in Egypt might consider worse than sponsoring bad actors.
  - toasterblender 3y ago
    If the number of skilled 0-day hunters who will work for a paycheck is > 0, then yours is a moot point, since a poaching program would still make an impact even if there are some people who work for spyware companies who would not work for FAANG. I think you will also find that morals for many people are inversely proportional to the offered salary. An 0-day developer being compensated $130k may well abandon their particular morals if offered a $240k salary instead.
toasterblender 3y ago
> But while they could try and poach them today, tomorrow there will be a whole load of new people working for those companies, and it'll just be a never-ending cycle. The number of people who successfully find 0-click 0-days for iOS/Android is very small. It's not a vastly replenishable resource.
- hattmall 3y ago
  It's a small group but a wide pool. It's not like the same person finds 10 0days. And until they do find their one exploit most of them have pretty much no credentials at all. So how do you avoid hiring 10,000 up and comers that never actually come up?
  - toasterblender 3y ago
    The same that it works in any other industry. By hiring those with proven track records, the best of the best. The goal is obviously not to hire 100% of the potential 0-day hunters, but by launching a concentrated poaching effort, to make a sufficient dent.
    - throwaway38475 3y ago
      People have said Apple can buy companies like NSO for less than they probably spend on SEIMs in a year. But as soon as they do that there will be another startup doing the same thing. The company (GreyShift) that broke the secure enclave had ex-apple security engineers working for them.
    - entuno 3y ago
      They could certainly go out and try and hire some of the best iOS vuln researches. But if they hire the top 10 out there, then #11 gets a massive payrise to go and work for one of the spyware companies. And if Apple is paying huge amounts of money and getting into bidding wars with all the other companies out there for vuln researches, that'll attract a load more people to start hunting.
    - astrange 3y ago

by entuno 3y ago

cco 3y ago

> Some of them wouldn't want to work for Google and Apple in the first place, regardless of the salary. For moral reasons do you mean? I would be surprised to learn there are a lot of people that are open to selling 0 day exploits to "bad actors" (granted that this term is doing a lot of heavy lifting here), but wouldn't want to work for Google or Apple. > ...it'll just be a never-ending cycle I think the idea is you pay them so well that they can work for a handful of years and remove any cash incentive reason for them to continue selling 0 days to bad actors.

eastbound 3y ago
> “bad actors", but wouldn't want to work for Google or Apple - Everyone who doesn’t like US hegemony. Which happens about everywhere but US, in varied proportion, but even in Europe, and even worse in Middle-East, - Everyone who doesn’t like monopolies. Capitalism of competition (as opposed to state capitalism, when the state borrows a trillion per semester, ahem) requires that monopolies be broken down to avoid distortion of competition. Helping bad actors can be, under their viewpoint, less bad than the damage done to a billion consumers consumers at a time. Plus monopolies impose a monoculture of occidentalism, with certain values that a firm in Egypt might consider worse than sponsoring bad actors.
- toasterblender 3y ago
  If the number of skilled 0-day hunters who will work for a paycheck is > 0, then yours is a moot point, since a poaching program would still make an impact even if there are some people who work for spyware companies who would not work for FAANG. I think you will also find that morals for many people are inversely proportional to the offered salary. An 0-day developer being compensated $130k may well abandon their particular morals if offered a $240k salary instead.

toasterblender 3y ago

> But while they could try and poach them today, tomorrow there will be a whole load of new people working for those companies, and it'll just be a never-ending cycle. The number of people who successfully find 0-click 0-days for iOS/Android is very small. It's not a vastly replenishable resource.

hattmall 3y ago
It's a small group but a wide pool. It's not like the same person finds 10 0days. And until they do find their one exploit most of them have pretty much no credentials at all. So how do you avoid hiring 10,000 up and comers that never actually come up?
- toasterblender 3y ago
  The same that it works in any other industry. By hiring those with proven track records, the best of the best. The goal is obviously not to hire 100% of the potential 0-day hunters, but by launching a concentrated poaching effort, to make a sufficient dent.
  - throwaway38475 3y ago
    People have said Apple can buy companies like NSO for less than they probably spend on SEIMs in a year. But as soon as they do that there will be another startup doing the same thing. The company (GreyShift) that broke the secure enclave had ex-apple security engineers working for them.
  - entuno 3y ago
    They could certainly go out and try and hire some of the best iOS vuln researches. But if they hire the top 10 out there, then #11 gets a massive payrise to go and work for one of the spyware companies. And if Apple is paying huge amounts of money and getting into bidding wars with all the other companies out there for vuln researches, that'll attract a load more people to start hunting.
  - astrange 3y ago