3 ms·

I'm on NSO's side here. It's quite hypocritical of everyone involved to be against NSO but not gun makers. I don't even want to touch civilians abuse of guns, j

I'm on NSO's side here. It's quite hypocritical of everyone involved to be against NSO but not gun makers. I don't even want to touch civilians abuse of guns, just governments buying guns from weapons manufacturers and using them in properly sanctioned wars. People are acting like exploits are more dangerous than bullets or restricted like nuclear, biological and chemical weapons, they are not! The demand is there and the suppliers exist. without companies like NSO, the price of exploits goes up and it becomes more lucrative for malicious actors to sell them to even more nefarious actors. The exploit brokers become more anonymous. And when they sell to the really bad actors, it will require deanonymizing market places on Tor instead of having law suits like this. It is much better for everyone involved to tolerate companies like NSO and regulate them.

ktallett 1y ago
It isn't an either or scenario, NSO can be in the wrong and rightfully fined and weapons can also be sold by governments to the wrong parties. The latter should be regulated as well, not the former being let off as well. Demand shouldn't always equal supply.
dqv 1y ago
> It is much better for everyone involved to tolerate companies like NSO and regulate them. That's what this is. That's what a lawsuit is. This is them being regulated. They aren't being ordered to shut down, they're being ordered to pay damages.
- notepad0x90 1y ago
  no, there is no regulation or law for what they do. This is a civil suit between two companies, it is not a regulation. had they actually violated the law, it would have been a criminal prosecution. civil damages are not government regulation. if you can simply be anonymous, you won't even break the law as you sell to any party.
  - dqv 1y ago
    > no, there is no regulation or law for what they do Yes, there is: the CFAA. Corporations and the government have even weaponized criminal complaints against individuals under the law. > This is a civil suit between two companies, it is not a regulation The venue in which regulation is enforced does not change its status as a regulation. The distinction between criminal and civil is irrelevant here. (Notwithstanding the possibility of a corrupt judge) Meta would not have been able to continue their suit had there not been a regulation. > had they actually violated the law, it would have been a criminal prosecution No, had a prosecutor wanted to pursue an indictment, it would have been a criminal prosecution. A prosecutor's willingness to enforce a law and bring trial is at their discretion. In the same way that charges don't necessarily indicate criminality, a lack thereof doesn't necessarily indicate the absence of wrongdoing. > civil damages are not government regulation. Civil laws are regulation. The judge is the regulating authority who enforces the penalty for being out of compliance with those laws, which comes in the form of ordering money damages in this situation. > if you can simply be anonymous, you won't even break the law as you sell to any party Yes and maybe the fact that they're anonymous brings it it to the level of criminality in a prosecutor's eyes. That desire to conceal their identity could the turn preponderance of the evidence (civil) into beyond a reasonable doubt (criminal). Or it could always stay in the civil system. The criminal system is political just like anything else. See above.
    - notepad0x90 1y ago
      CFAA is criminal law with specific parameters. the accused must have attempted or conspired to attempt to bypass a restricted system. Demonstrating how to steal money from a bank vault for example is not a crime, neither is teaching others how to do so for a fee or providing them with tools that can aid them in that endeavor. Especially when the other party is a government, it is reasonable to assume they will operate within the bounds of their own law. Red teamers, pentesters, security researchers, security training providers couldn't exist if the CFAA prohibited this. It isn't like their customers come to them and ask "hey, we're gonna spy on a journalist, can we buy pegasus". At the very least, it needs to be established that it is reasonable to presume pegasus will be used to break a law, it could be used for lawful reasons (which exist) and I'm sure they'll make their clients sign waivers to protect themselves fro such presumption. Anonymity isn't a crime (at least not yet), and it alone cannot be used to presume criminal intent. It isn't a crime to offer services anonymously. Perhaps not paying your taxes (if income could be proven) is something they can go after (and fail). The civil system can be used, if it is the government that is the plaintiff. Random companies suing is not enforcement since companies act in their interest, not in the interest of public policy and regulation. Waiting for events that align with corporate interests is not regulation, it is coincidence.
sureglymop 1y ago
I think your last sentence is key. The NSO as far as I'm aware to targets people on an individual level. It's not hard to phish and hack a single individual as a large organization. It's just a matter of resources and slipping up eventually. With that being said, the exploits they find are interesting and I wish they would publish them in a white hat manner instead.

ktallett 1y ago

It isn't an either or scenario, NSO can be in the wrong and rightfully fined and weapons can also be sold by governments to the wrong parties. The latter should be regulated as well, not the former being let off as well. Demand shouldn't always equal supply.

dqv 1y ago

> It is much better for everyone involved to tolerate companies like NSO and regulate them. That's what this is. That's what a lawsuit is. This is them being regulated. They aren't being ordered to shut down, they're being ordered to pay damages.

notepad0x90 1y ago
no, there is no regulation or law for what they do. This is a civil suit between two companies, it is not a regulation. had they actually violated the law, it would have been a criminal prosecution. civil damages are not government regulation. if you can simply be anonymous, you won't even break the law as you sell to any party.
- dqv 1y ago
  > no, there is no regulation or law for what they do Yes, there is: the CFAA. Corporations and the government have even weaponized criminal complaints against individuals under the law. > This is a civil suit between two companies, it is not a regulation The venue in which regulation is enforced does not change its status as a regulation. The distinction between criminal and civil is irrelevant here. (Notwithstanding the possibility of a corrupt judge) Meta would not have been able to continue their suit had there not been a regulation. > had they actually violated the law, it would have been a criminal prosecution No, had a prosecutor wanted to pursue an indictment, it would have been a criminal prosecution. A prosecutor's willingness to enforce a law and bring trial is at their discretion. In the same way that charges don't necessarily indicate criminality, a lack thereof doesn't necessarily indicate the absence of wrongdoing. > civil damages are not government regulation. Civil laws are regulation. The judge is the regulating authority who enforces the penalty for being out of compliance with those laws, which comes in the form of ordering money damages in this situation. > if you can simply be anonymous, you won't even break the law as you sell to any party Yes and maybe the fact that they're anonymous brings it it to the level of criminality in a prosecutor's eyes. That desire to conceal their identity could the turn preponderance of the evidence (civil) into beyond a reasonable doubt (criminal). Or it could always stay in the civil system. The criminal system is political just like anything else. See above.
  - notepad0x90 1y ago
    CFAA is criminal law with specific parameters. the accused must have attempted or conspired to attempt to bypass a restricted system. Demonstrating how to steal money from a bank vault for example is not a crime, neither is teaching others how to do so for a fee or providing them with tools that can aid them in that endeavor. Especially when the other party is a government, it is reasonable to assume they will operate within the bounds of their own law. Red teamers, pentesters, security researchers, security training providers couldn't exist if the CFAA prohibited this. It isn't like their customers come to them and ask "hey, we're gonna spy on a journalist, can we buy pegasus". At the very least, it needs to be established that it is reasonable to presume pegasus will be used to break a law, it could be used for lawful reasons (which exist) and I'm sure they'll make their clients sign waivers to protect themselves fro such presumption. Anonymity isn't a crime (at least not yet), and it alone cannot be used to presume criminal intent. It isn't a crime to offer services anonymously. Perhaps not paying your taxes (if income could be proven) is something they can go after (and fail). The civil system can be used, if it is the government that is the plaintiff. Random companies suing is not enforcement since companies act in their interest, not in the interest of public policy and regulation. Waiting for events that align with corporate interests is not regulation, it is coincidence.

sureglymop 1y ago

I think your last sentence is key. The NSO as far as I'm aware to targets people on an individual level. It's not hard to phish and hack a single individual as a large organization. It's just a matter of resources and slipping up eventually. With that being said, the exploits they find are interesting and I wish they would publish them in a white hat manner instead.