4 ms·

> It will be interesting to see where this goes. If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the co

> It will be interesting to see where this goes. If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry, forcing them to rely more on hacking humans rather than hacking mobile OSes. It will likely cause some interesting tensions with government as well. eg. Apple's official stance per their 2016 customer letter is no backdoors: https://www.apple.com/customer-letter/ https://www.apple.com/customer-letter/ Will they be allowed to maintain that stance in a world where all the non-intentional backdoors are closed? The reason the FBI backed off in 2016 is because they realized they didn't need Apple's help: https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute#FBI_withdrawal_of_request https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... What happens when that is no longer true, especially in today's political climate?

fsflover 6mo ago
> If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry If Apple and Google actually cared about security of their users, they would remove a ton of obvious malware from their app stores. Instead, they tighten their walled garden pretending that it's for your security.
- fsflover 6mo ago
  Some links for the downvoters: https://news.ycombinator.com/item?id=46911901 https://news.ycombinator.com/item?id=46911901 https://news.ycombinator.com/item?id=47457963 https://news.ycombinator.com/item?id=47457963
  - Analemma_ 6mo ago
    You're being downvoted because you posted a non sequitur, not because people don't believe you. Vulnerabilities in the OS are not the same thing as apps using the provided APIs, even if they are predatory apps which suck.
    - deleted 6mo ago
      [deleted]
tptacek 6mo ago
Big open question what this will do to CNE vendors, who tend to recruit from the most talented vuln/exploit developer cohort. There's lots of interesting dynamics here; for instance, a lot of people's intuitions about how these groups operate (ie, that the USG "stockpiles" zero-days from them) weren't ever real. But maybe they become real now that maintenance prices will plummet. Who knows?
qingcharles 6mo ago
I assume that right now some of the biggest spenders on tokens at Anthropic are state intelligence communities who are burning up GPU cycles on Android, Chromium, WebKit code bases etc trying to find exploits.
- saagarjha 6mo ago
  In theory Anthropic does not permit this use.
spr-alex 6mo ago
Adding to your comment a similar letter was published as recently as September 2025 https://support.apple.com/en-us/122234 https://support.apple.com/en-us/122234 "we have never built a backdoor or master key to any of our products or services and we never will."

fsflover 6mo ago

> If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry If Apple and Google actually cared about security of their users, they would remove a ton of obvious malware from their app stores. Instead, they tighten their walled garden pretending that it's for your security.

fsflover 6mo ago
Some links for the downvoters: https://news.ycombinator.com/item?id=46911901 https://news.ycombinator.com/item?id=46911901 https://news.ycombinator.com/item?id=47457963 https://news.ycombinator.com/item?id=47457963
- Analemma_ 6mo ago
  You're being downvoted because you posted a non sequitur, not because people don't believe you. Vulnerabilities in the OS are not the same thing as apps using the provided APIs, even if they are predatory apps which suck.
  - deleted 6mo ago
    [deleted]

tptacek 6mo ago

Big open question what this will do to CNE vendors, who tend to recruit from the most talented vuln/exploit developer cohort. There's lots of interesting dynamics here; for instance, a lot of people's intuitions about how these groups operate (ie, that the USG "stockpiles" zero-days from them) weren't ever real. But maybe they become real now that maintenance prices will plummet. Who knows?

qingcharles 6mo ago

I assume that right now some of the biggest spenders on tokens at Anthropic are state intelligence communities who are burning up GPU cycles on Android, Chromium, WebKit code bases etc trying to find exploits.

saagarjha 6mo ago
In theory Anthropic does not permit this use.

spr-alex 6mo ago

Adding to your comment a similar letter was published as recently as September 2025 https://support.apple.com/en-us/122234 https://support.apple.com/en-us/122234 "we have never built a backdoor or master key to any of our products or services and we never will."