Comment by brutal_chaos_ | Hacker News Reader

Comment by brutal_chaos_ | Hacker News Reader

Parent Full thread

Nit (maybe moot):

> 4) Apple incurred damages […] from expenses related to mitigating the hacking of their users.

This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. Put another way, that also sounds like the corporate open source push, "We love open source because we don't have to support it, the community will!"

"4)" says the community will pay for/support security, just wait for the hack and make 'em clean it up. Mitigation costs shouldn't be a recoverable damage, they should be doubled and paid out to the victims...maybe that'll incentivise better security over dollar dollar bills y'all.

This all maybe moot because this was a B2B action and I'm thinking from a non-monied, single user/security researcher perspective. What if the company was a non-profit security research group? Perhaps this is what the 90day grace periods are for when dealing with responsible disclosure?

Anyhow, my ignorance must be showing at this point.

From Facts(C),

"60. Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades.

61. These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial."

Hopefully the judgement is able to split the hairs between reputational and development harm to a company for security vulnerabilities, and harm to users for organized exploitation of those vulnerabilities.

The former feels like it should be free speech -- statement of facts related to the company's product(s). The latter is an obvious wrong.

Is it C that imposes huge costs here? Do they have a list what CVEs have what cost?

I don't know of any legitimate security research group that hacks user accounts they don't own.

NSO hacked devices they didn't own and infected them with spyware. Apple had to pay to repair / replace those devices.

I don't see how this sets any sort of precedent with security researchers are liable for the costs of fixing vulnerabilities that they uncover.

> I don't know of any legitimate security research group that hacks user accounts they don't own.

nit: "user accounts to which they're not authorized"

I work with friends' accounts all the time provided they authorized me to do so and provided I'm permitted to do so as part of the vuln disclosure program terms and rules of engagement, though I usually split the bounty with them in a meaningful way to make it worth their while.

I know of several cases of reverse engineering of a bunch of hardware where the hardware is only available to a very limited subset of professionals. To gain access you either need to join that class and break the terms under which the devices are provided, get someone else to break the terms they agreed to or to steal a device (which for obvious reasons is at a somewhat different level than breach of terms and conditions). It is pretty clear that these restrictions exist to avoid reverse engineering of a - trivial - protection that makes making compatible products impossible, and which in turn protects a non-trivial revenue stream.

Apple is not really all that different. If they believe that suing to prevent reverse engineering is going to stop the bad guys they are delusional, I suspect that they are fully aware of this and are engaging in a very expensive bit of theater here: the NSO Group is not going to be overly impressed by this, whether they win or lose the case. If they lose they will be open to a damage claim, which in turn will have to be enforced through a court in a different country, if they win Apple will lose far more than just this case, they will lose the battle against everybody that wishes to engage in reverse engineering.

Another thing I suspect is that Apple is either very much concerned about the image/reputation damage, their supposedly highly secure platform/environment appears to be less secure than Apple wanted you to believe and a click-through EULA is not going to impress a law breaking entity, they probably should have anticipated that. And Apple may believe that other law breaking entities are going to stop doing their thing if they win this lawsuit, I'm a bit more pessimistic about that. Legal action is not a good way to recover from a technical failure, Apple needs to update their threat model and act accordingly.

>This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway.

No, read again, this only refers to damages from unlawful activity. "White hat hackers" need not fear.

Assuming they're lawyers who know every law and don't get skewered by something like DMCA 1201.

I wouldn't be so sure about that. The difference between white hat and black hat is usually only determined once the destination of the results of the activity is known. Plenty of bug bounty programs appear to be one element in the marketplace for valuing an exploit. If the bounty isn't high enough your 'white hat' may well change the color of their hat.

So... People who aren't criminals... Might become criminals... After committing a crime... I guess?

Reply on news.ycombinator.com