I wouldn't say so. The problem is the cyber warfare market created by nation states. If it wasn't for those large spenders, we wouldn't be where we are right now.

IMO nation states had a very negative influence on the internet, bringing secrecy, warfare, balkanized markets, mandatory identification and other closed concepts to a place that worked on open principles.

If states would invest more in security advancement and open research than in warfare, we might have been in a better position.

This is definitely part of the problem. But the fundamental flaw is the departure from simplicity.

The solution is to have a processor that is so simple that it cant do more then what you expect, and building the tools to make the unexpected stand out.

However, there is a bigger market for a processor with 3 extra layers of root access to ensure your boss can spy on you and Disney&Co really want this to be the norm.

It depends what you mean by "security first". If you're a person of interest and you're carrying around a personal spy with actual data on it and a hardware connected microphone, camera, GPS, sensors etc, which sends God knows what over the internet then yes, it's not going to go well for you.

But if you use devices with hardware kill switches and the most secure OS possible (storing nothing on device, perhaps it's a gateway to another security hardened machine).

Secure computing is possible, but it takes a lot of time, effort and dedication.

If you're just using off the shelf hardware and software you're going to have a bad time.

One thing that seems to link these Pegasus stories is that none of these targeted individuals are practising seemingly decent security ops, being hacked over WhatsApp or iMessage seems fairly trivial and hopefully now they would reconsider their threat model.

It's whwt that has really evolved into. We used to live in a much simpler (and secure in that manner) world where there were no smartphones, even GPRS didn't exist, all important communication were done on physical medium.

That became much more inconvenient as technology just progressed to a point where 99.9% of the society couldn't resist using the smartphone, rightly for many purposes, including many of us here too.

But as OSs (and even SoCs) became more complex as more features are added (well, I can't think of Apple or Samsung execs on stage saying "hey we didn't add any features this year" so it has to go this way naturally) flaws are inevitable.

By now every piece of software and hardware that is in use, every abstraction layer in that computing tower of bable has been thoroughly hacked. Anywhere from plaintext passwords on a server to insane exploits like Rowhammer, those security websites and podcasts have long weekly litanies of tragedy. Additionally there is all-knowing Google, chinese phones phoning home, undocumented functions in intel processors, ISPs sabotaging user encryption, small-time browser plugin writers that get offered high sums for their plugin to get a front row seat to users' browsers, programmers pulling who-knows-what from npm and are probably pwned by time they write 'hello world', phishing, billions of smart devices constantly listening and often filming and we probably only know 10% of what's going on until a Snowden 2.0 comes along.

Yes, all of it is 'fundamentally flawed', and it would take a herculean effort to start over with a clean slate, yes, to figuratively burn it all down and make simple provably correct and safe hardware and a small and minimal OS that has browsing and communications built in.

Anyone?

Yeah. Aren't there even known cases of journalists being tracked through hacks and killed? (Like https://www.cnn.com/2019/01/12/middleeast/khashoggi-phone-ma....) Flawed computer code ever putting people into dangerous situations and being involved with deaths should be considered like the Therac-25 incident: a case study and a call to action to change the industry so that regular practices that solve the issue are in effect everywhere.

...and yet they milk our very livelihood with their app stores