US judge finds NSO Group liable for hacking journalists via WhatsApp

You keep conflating Hamas with Palestinians. It seems deliberate. I for one do not think they are the same thing, but if you do I'm not sure this conversation can go anywhere. I am also unsure why you think you should be able to speak to the motives of Hamas and Israel (and therefore assert the intent is genocide) while I cannot.

As a side note, you argue like you are on Reddit. It might be helpful to review the site guidelines[1] about discussion on Hacker News.

[1] https://news.ycombinator.com/newsguidelines.html

made me chuckle needed this :)

The supply chain violation was performed by a Hungarian shell company with no links to Israeli tech. Using it as an example of why you would avoid any Israel-based companies is a weird security strategy.

Come on, you know me better than that.

In this case, the comment fit the conversation. The original comment was a short, pithy, and rather sarcastic one that was, nonetheless, correct. They pointed out that we need to write higher-Quality software, in order to give folks like the NSO people fewer “hooks.” The NSO folks are smart, dedicated people, that, in other circumstances, we would admire for their creativity and intelligence. They often take advantage of mistakes (or deliberate decisions) made by folks that we may find less admirable.

I like this community and medium, and sincerely want to be a “good citizen.” The opportunity to interact with people like you, is a privilege that I respect and value. We may not always agree on everything, but I find many of your contributions to be inspiring, educational, and relevant, so I appreciate you. You have taught me lessons, and have changed my mind, and, I’m sure, will continue to do so. You have great insight, knowledge, and experience, which I value, and appreciate you sharing it (for example: https://saagarjha.com/blog/2023/12/22/swift-concurrency-wait...). People like you, are why I like this place. We have no social interaction, so I have no idea if we’d get along, IRL. I would like to think we would, but I’m often wrong, and not afraid to promptly admit it.

For myself, I try to participate by making very specific suggestions, and “keeping it focused on me.” I don’t attack others, even if I find what they say to be quite offensive (or if they attack me, which is fairly common). Most times, I don’t feel that my comments would improve things, even if I vehemently disagree with someone, so they are best left unsaid. I don’t participate in any other social media, and I’m retired, so I do spend a fair bit of time, here.

I spent most of my career at a corporation that was all about Quality, and I suppose it must have rubbed off on me. At that company, Quality was a religion, and they took it to the point of obsession. After leaving, I have tried to practice their mindset in my continuing work. I write software that can have a big impact on the lives of its users, so I take Quality seriously, in order to reduce things like attack surface. I feel as if the current tech community has a baseline ethos of “write code as badly as we can get away with,” and that ethos is rewarded. I don’t think that treatises on better unit testing will be of interest to folks with that mindset. I feel as if the mindset, itself, is the issue, and code dumps won’t make a difference.

I often reference stuff I’ve written, not because I want traffic (I could absolutely care less, whether or not folks read my stuff. I write for myself), but because I don’t want to litter the place with “wall of text” commentary (as you can see, I lean prolix). A quick link to an article that I wrote, going into great detail, is better than a massive comment that won’t have as much information.

For example: https://news.ycombinator.com/item?id=42478993

Are those articles specific enough?

I don’t think you’ll find anyone who would disagree with the premise that we should improve software quality. Yes, even the people who value iteration speed and shipping. All things being equal, better quality is always better, because of course it is.

The problem arises when all things are not equal, and something needs to give. Perfect quality is generally not attainable or even desirable, because it sacrifices things in other areas that we care about even more. Sometimes the value of something is high enough that we will pay the price for it failing in some cases. That’s just how we do a cost-benefit analysis. I say this even though I work in software security, where most of my job exists and is made difficult by “bad” quality, and a lot of my effort goes into figuring out how to improve that. Depending on the circumstances, I may advocate for the balance to be adjusted in favor of more security (at the expense of something else) and sometimes I may actually decide that this is counterproductive. That’s really my actual response to the comment.

However, as you probably noticed, I didn’t reply with that. I called it low-quality. In fact I think the whole discussion is low-quality, not because it is not a real point, but because it’s not interesting. I understand and appreciate that you have worked on software quality throughout your career. I want you to be proud of your efforts in this area. And it’s completely reasonable to point to that and go “this is what’s missing from our industry”. It’s not actually very novel or actionable. So, despite me not actually voting on the thread, I felt it was not valuable.

When I was in high school I happened to be pretty decent at physics. In fact I won some awards and was nationally ranked. This is kind of like your situation, except of course my skills were less general and also more ephemeral. But it’s as if I, given my arguably decent understanding of physics, went “the problem with climate change is that we’re using too much energy”. First of all, this doesn’t actually use any of those skills to proclaim. Even someone who failed high school could probably tell you that. But secondarily, and more importantly, I haven’t actually said anything useful. My knowledge of mechanics is great but solving climate change is a huge problem, both deeply technical but also social and political. It’s a lot harder than going “stop applying force over distance to things”. The same is true for preventing exploits: I’m sure you’re great at writing apps that have low defect rates, but when it comes to protecting against nation-state threats there’s a whole lot going on beyond “let’s not make any mistakes”. More relevant would be a discussion about, say, memory safety, or auditing, or whatever that is actually on-topic and actionable. What you’ve posted is something that is really just a “hear hear here’s an obvious problem let’s fix it” which invites nothing beyond people who will do nothing but agree with you, or somehow twist it into their pet peeve and rant against it. Neither is against the rules but I think it doesn’t make for insightful conversation, so I’m telling you about it now.