Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple sues NSO Group to curb the abuse of state-sponsored spyware

apple.com

Post reply on HN
Print view View original

61–70 of 477 posts

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#61

Post by kelnos »

rasengan wrote: post #28

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

The problem is that this approach requires that Apple expend enough resources for their security to be perfect all the time. Outfits like NSO Group need only be lucky once (well, with some consistency, as Apple finds and fixes the vulnerabilities they use).

It's a cat-and-mouse game where Apple has a distinct disadvantage, one that's likely impossible to fully overcome.

They certainly should (continue to) spend a bunch of money to make their OS and hardware as secure as possible. But at a point returns start to diminish, and perfection just isn't an attainable goal.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#62

Post by jp57 »

kingcharles wrote: post #52
strict9 wrote: post #7

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: > The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those a…

I was the victim of a state-sponsored attack. I took it to court. I tried to subpoena the contents of the government agents' iPhones but Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. The lawyer specifically told me all he does is go around the country and lie to judges to get them to cancel subpoenas. We introduced the T+C…

> Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence.

If a lawyer makes an argument in court about the law governing a case (as opposed to the facts of the case), and the judge accepts the argument, and the judge's decision survives all its appeals, then the lawyer's argument is, by definition, true.

EDIT: I'm objecting here to the characterization of the lawyers' arguments as "lying". The judge's "power" to suboena digital evidence sounds like a question of interpretation of the law. Many (all?) US court cases have at least one question of law in which the parties make opposing arguments. One party prevails, the other does not, or maybe one party prevails on some points and the other prevails on other points. But however those questions are ultimately decided, that's the law, as it pertains to that case. In that context, it seems very strange to characterize either party as "lying" in such arguments.

If, on the other hand, "the judge's power to subpoena digital evidence" really means Apple's technical ability to produce such evidence, then I would agree that those are facts about which some statements could be considered truthful or not.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#63

Post by kelnos »

rStar wrote: post #50
josh2600 wrote: post #41

Earlier quoted context omitted.

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). Let’s, just for a second, propose that apple went full M…

> I’m sorry but there’s no world where Apple can make perfect security i think everyone knows that perfect security is not possible, the operative word being ‘perfect’. i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today, which would still be miles and miles away from ‘perfect’, vulnerable to nation state actors e…

> i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today

That's a pretty tall order, and would likely result in a device that is much more expensive and has a user experience that users would not like. Assuming "orders of magnitude better" is even possible, of which I am skeptical.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#64

Post by fsflover »

kingcharles wrote: post #52
strict9 wrote: post #7

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: > The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those a…

I was the victim of a state-sponsored attack. I took it to court. I tried to subpoena the contents of the government agents' iPhones but Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. The lawyer specifically told me all he does is go around the country and lie to judges to get them to cancel subpoenas. We introduced the T+C…

Perhaps you may want to ask https://eff.org for help.

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#65

Post by haswell »

rStar wrote: post #58
tpush wrote: post #54

Earlier quoted context omitted.

Conspiratorial nonsense.

unless you understand how tech, business, governments and security services work, then not so much

That's a pretty massive thing to imply without any followup. As someone who understands how tech, business, governments and security services work, care to enlighten the rest of us?

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#66

Post by nickff »

technobabbler wrote: post #48
badRNG wrote: post #38

Earlier quoted context omitted.

One could interpret this as the software is "sponsored" by the governments that finance their operations and purchase their products. This would be countries like Saudi Arabia, Mexico, Germany, and Kazakhstan, not necessarily Israel. Though the fact the US has sanctioned an Israeli business does seem to have potential implications on Israeli policy. [1] [1] https://www.reuters.com/technology/us-blacklists-four-compan…

Beyond merely selling their products to Israel, the NSO Group itself is an Israeli firm, founded by ex-Israeli intelligence, and whose products are subject to Israeli national export controls. https://en.wikipedia.org/wiki/NSO_Group That's a level of sponsorship way beyond simply being a customer... that's state espionage served with a side of profit. It's evil when the USA does it, it's evil when the Russians do it,…

None of this seems like 'sponsorship' to me, it seems more like 'restriction' or 'regulation'. 'Sponsorship' implies that someone is providing a level of funding beyond just being a paying customer. Is there any evidence that the government of Israel (or any of the other governments you mention) are actually providing loans or share capital to NSO Group?

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#67

Post by leecb »

fragmede wrote: post #60
strict9 wrote: post #7

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: > The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those a…

Is it great? The lawsuit is Apple trying to enforce the iCloud EULA to stop reverse engineering. While NSO Group created hacking tools, and then did some questionable things with them, do we really want those inane licenses no one reads, and everyone scrolls down to hit [agree]; do we really want them to legally binding? Put another way, if it was someone HN liked , would we still say this is actually good? Because c…

> those inane licenses no one reads, do we really want them to legally binding?

What all would be possible if software EULAs weren't legally binding?

One thing that EULAs typically do is reduce liability for the company producing the software. Imagine if Google/Apple were liable for damages from all the miscommunications caused by autocorrect?

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#68

Post by fsflover »

josh2600 wrote: post #41
rasengan wrote: post #28

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). Let’s, just for a second, propose that apple went full M…

> The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!).

https://qubes-os.org

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#69

Post by speeder »

kelnos wrote: post #61
rasengan wrote: post #28

Legal methods are a crutch at best. Apple would be wise to put forth the same budget into their security team's research and development and properly address these weaknesses.

The problem is that this approach requires that Apple expend enough resources for their security to be perfect all the time. Outfits like NSO Group need only be lucky once (well, with some consistency, as Apple finds and fixes the vulnerabilities they use). It's a cat-and-mouse game where Apple has a distinct disadvantage, one that's likely impossible to fully overcome. They certainly should (continue to) spend a bun…

Some people even can conclude from this that being evil is better idea.

A fictional example: there is a character in Wheel of Time, that realized that for the good guys to win, they must win every time the bad guy attempts something, but the bad guy must win only once (since his goal is destruction of the universe), thus this character concludes that being evil is a better goal, since you can keep trying until you succeed, he imagines eventually he WILL succeed, as a matter of "when", not of "if".

Re: Apple sues NSO Group to curb the abuse of state-sponsored spyware

#70

Post by kevinh »

rStar wrote: post #31
lehi wrote: post #15

Only curbing "abuse" implies that "normal use" of state-sponsored spyware remains kosher.

apple builds their own hardware and software. security, or lack thereof, is clearly apples choice. apple blaming nso here is pure public relations and optics, nee propaganda, which many on this board drink like the koolaid it is. it’s confirmation bias.

Ah, yes, Apple just neglected to flip the security switch on.
Post reply on HN