Hacker News Reader

"our opinion of this stuff doesn't matter."

It very much does matter. If more people refuse to do this type of work, it eventually won't be done to the required standard. People would cut family ties and this would stop fast.

That's an incredibly blinkered view of the ecosystem that assumes that the only talent capable of delivering this work is people you talk to or share cultural ties with. There are ultra-skilled people in developing countries who could not give less of a fuck about how uncomfortable this stuff makes people in the west.

There are tons of people in the West who have no qualms about doing this for pure crime purposes; many of them are the ones who espouse most ardently that doing this work for the government is immoral.

> many of them are the ones who espouse most ardently that doing this work for the government is immoral

How do you know this?

An opinion, based on meeting people like https://www.nbcnews.com/news/us-news/capital-one-hacking-sus...

so what? As GP suggests, they are not nessisary for the development of exploits.

>If more people refuse to do this type of work

This is kind of like saying "if people wouldn't murder other people then..."

"Bad" kind of work always finds bodies to fill it's spots. Boycotts of a particular business might work, but a type of work won't, especially when there is decent money on the table. And then when you start adding in people that had previous run ins with law enforcement and find it hard to get a "legit" job and get a decent offer from a place like this, they'll have no problem taking it.

It would stop in your country but not globally. That means your country loses all expertise and will be much worse off to defend itself.

Case in point: In 2007 Germany passed a "hacking law" (§202c). On its face, it was supposed to prevent black hat work. Except it very predictably also did enormous damage to security research.

> At current market rates every country in the world can afford CNE technology

Slippery slopes don't justify anything. You might not care enough to make a difference, but many people do and your justification rings hollow to everyone that's potentially a victim. You wouldn't say this about nuclear proliferation, so why make a carveout for digital mercenary work? Because it's "harmless"?

I don't know what your goal is with this statement but it certainly doesn't make me feel any better. If you're this emotionally invested in the topic, it might be best for your own optics to not chime in.

I'm not justifying anything. I'm saying a very large number of people don't share the premise in the parent comment. It's one thing to disagree with a practice; it's another thing to suggest that disagreement with it is universal. It is not.

The difference is that it's completely plausible to protect against a cyberattack, but completely implausible to protect against a nuclear attack.

The onus is on Apple and their userbase to protect their own computers, not the rest of society to patrol and regulate unstoppable "information crime" against them

I think I agree with what I think you're trying to say.

However I don't agree with the repercussions of this, which are the same ones that make all reasonable people, security experts included, oppose EU's ChatControl or the UK's backdoor requests: There is no way to ensure and protect the people that need protection, as there is no way to ensure that only "the good guys" have it.

We tend to bullshit ourselves into believing that because spyware software like Predator are weapons, meaning that only countries would be allowed to buy them and use them (same way that Jeff Bezos cannot buy and use an F-35 for example). We see though, that certain individuals _can_ get their hands on these things and use them however they want.

For example, 3 years ago someone adjacent to the greek government bought and used Predator against MEPs, journalists, army generals, mafia bosses, MPs of opposing parties and even MPs of their own, ruling, party. The greek government of course denied that they did it, and they said that this individual did not act under the instructions of the government (though they then changed the law to prevent anyone for learning details about it, but that's a different story).

So, apart from adopting the same approach as with ChatControl and encryption backdoors, i.e. banning them, I don't know how we could protect ourselves against them.

I'm an American and am glad of my personal belief that the American system would not allow something like ChatControl by state mandate. I also wouldn't participate in commercial exploit development (even if I was capable of doing so competitively). But I don't think the two things are at all comparable.

ChatControl has almost happened here in the USA multiple times, and they will try again.

If you say so. Either way: not comparable to CNE operations.

> You don't know how any of these could be developed in good conscience?

The OP did say "...for resale in good conscience."

I personally read that as the commercial companies that allows anyone to buy the product off the shelf for the right price -- including governments, but also rogue elements. Bad actors, groups, or even people engaged in abusive domestic practices (customers without the time, experience, or resources to do it in-house). Not the people who work directly under government agencies developing these things for State level intelligence/ops

humans create myths which shape their world.

you, sadly, internalized a state humanity adopted after wwii, were the anti red propaganda told everyone that of you could illegally burn a forest down to then buy a Ferrari, it was the best course of action because if you didn't do it, someone would.

thankfully people like you are being ostracized, albeit too slow, and pointed out as what you really are: agentless weak oportunists.