Hacker News Reader

Comment by whimsicalism | Hacker News Reader

There's a difference between underground criminal gangs discovering exploits and selling them on black markets and being able to raise capital, have legal protection, etc. while you hire experienced developers to find exploits that you sell to despotic regimes like Saudi Arabia.

I suspect that distinction is what you are missing.

View on HN

Exactly, it wouldn't necessarily change the demand, but would hopefully reduce the supply (by raising costs). Being a legal entity has much lower cost of funding and much lower cost of operations than being an illegal entity. Otherwise most entities/corporations would not bother to be legal, which is clearly not the case.

Look how magnificently such a strategy worked for drugs.

Illegal recreational drugs are usually used by the buyer in a way that will only affect themselves. So they can't complain to the police if things go bad and they certainly won't if things go good. Enforcement is a huge problem.

NSO style products are used by one entity against another entity. As a result enforcement is a fundamentally different sort of problem. There is a complainant.

And there’s still a market for hitmen too.

This is such a shallow comparison, which seems to come up with every discussion around criminalization. Law enforcement isn’t 100% effective but that doesn’t mean every criminalized activity should be legal.

It works for nuclear weapons.

That's only because they're weapons of mass destruction. Nuclear capacity is essentially a step function - you either have it or you don't. Those who have it get to push around those who don't. There are some very strong incentives for the haves to prevent the list of nuclear powers from growing.

Also, unlike software vulnerabilities, nuclear weapons don't have a half-life counted in weeks.

It's a crude comparison, but software is a lot more like drugs than it is like nuclear weapons.

Is it? The fundamental reason the war on drugs failed is that drugs have relatively inelastic demand. Someone addicted to meth will find a way to get meth if it costs $10 or $500. Software exploits aren't like that at all. They are a tool used by gangs and governments that are only useful if they cost less than they're worth.

Software takes no less than a crappy laptop and a brain to create.

The Manhattan project consumed 10% of the total US energy output in the mid 1940s. And obviously uranium is hard to come across.

More notable is the fact that (like software transactions) drug transactions happen in private between consenting parties. The war on non-addictive drugs (say, psychedelics) failed too.

Nuclear weapons don’t grow on trees. Bug grow by a side effect of programming.

Reply on news.ycombinator.com