US judge finds NSO Group liable for hacking journalists via WhatsApp

One of the specific things I’d also like to emphasize, being in this industry, is that people often misjudge how to make their software secure. Yes, it involves caring and some level of quality of course, but you can write a perfect, well-designed, award winning app that people love with all the care that goes into that. That won’t stop NSO Group from completely and utterly hacking it. So to some extent yes it is a problem of not caring enough about your software but I want to make it clear that it’s not something your average developer can fix if they just tried harder. You need someone who is an expert in this stuff involved. This is different from UI design in that you can kind of work through it yourself with the appropriate amount of effort. In security, if you don’t actually know what you’re doing, you will do it wrong regardless of how hard you try. Even the people who know what they’re doing make plenty of mistakes. There is some basic tribal knowledge that I’m sure you’re familiar with (“parse, don’t validate”, “principle of lowest privilege”, “type systems and memory safety prevent bugs”) but you can’t really peer pressure someone into making secure software if they’re past the point of not being completely incompetent.

> the social and political implications of these kinds of attacks

> Hacker News in general is not a great place to talk about a country’s policy on offensive cyberattacks

That's not what I was referring to. By "the social and political issues in tech", I meant the general issues involved in building software, the internal and external cultures of the software developers.

> But being able to iterate and release software faster can sometimes have a positive impact on quality. Compare the quality of our favorite vendor’s browser to, say, Google’s: I think it is quite reasonable to say that the software quality of the latter is actually far higher, and bugs get fixed faster, specifically because of their release cadence.

You might have cause and effect reversed here. You suggest that the results are due to the engineering practices of the companies, whereas I would suggest that the engineering practices of the companies are a result of the values of the companies. It does appear to me that Google inherently cares more about security than Apple, and as far as I can tell, Google has more of an engineering-led culture than Apple.

Having said that, I don't think this is as simple as you say it is. ;-) For example, Google Chrome has a user-hostile silent forced updates system, which is what allows them to ship constant updates, whereas Apple Safari has a more user-friendly system where there's visibility and choice: you can see the pending updates in System Settings and choose when or even whether to install them. The latter type of update system is much less conducive to constant, frequent updates, because that would annoy users.

I don't understand why Apple has chosen to tie Safari updates to OS updates, on iOS and on the latest macOS, especially since the same Safari updates are not tied to OS updates on macOS N-1 and N-2. I mean, I understand why the major OS updates in the fall bring major Safari updates, but I don't understand why the subsequent minor Safari updates couldn't come separately, which will give Apple more flexibility to patch security vulnerabilities and other bugs in Safari.

Back to Chrome, I'm not sure I agree that its release cadence is good. First, Chrome has a public release schedule, and schedules are the death of software quality. Fixing bugs as soon as you can is fine, but forcing yourself to release things at certain fixed dates, simply for the purpose of releasing something, is not fine. The calendar is governing the release, not the readiness of the software. Moreover, Google Chrome is constantly, constantly, constantly introducing new features and other changes that have nothing to do with fixing bugs, which means that Google Chrome is constantly, constantly, constantly introducing new bugs, including new security vulnerabilities.

Apple also has a schedule: major new OS updates go out every September, no matter what. And this practice, the forced schedule, creates major quality issues. Ready or not, the updates must ship. Apple has more flexibility between Septembers, but unfortunately, contemporary Apple has also adopted the practice of using "minor" updates to constantly, constantly, constantly introduce new features and other changes that have nothing to do with fixing bugs. Part of the reason behind this is that Apple's forced yearly schedule doesn't give the company the time to finish things they've been working on and even promised at WWDC (another forced yearly schedule with self-imposed big announcements).

All of this is in stark contrast to "the good old days" when major Mac OS X updates had no fixed schedule. Of course the 10.N updates were still buggy, as major software updates always are, inevitably and predictably, but the major updates were infrequent, and they weren't forced on users. To the contrary, you had to go to a retail store and pay $129 for the privilege of receiving the discs to install a Mac OS X 10.N.0 version. The early adopters were self-selecting. And the minor 10.N.M updates were almost exclusively bug fixes without new features, so you had increasing quality over time, up and until the next major update.

> I think (vaguely, don’t hold me to this) that societally we do too little to punish this and that uncut corners should be valued more highly.

Perhaps, but I consider reward and punishment to fall under the same rubric as "incentives". And "getting tough on crime" rarely if ever works, for various well-known reasons. For example, wrongdoers don't believe they'll get caught, until they do get caught, making the punishment largely irrelevant to preventing the actions. And powerful people are very good at escaping the worst punishments even when they do get caught, as the powerful people tend to control the system of rewards and punishments.

IMO the only effective way to encourage good behavior and discourage bad behavior is to teach and foster personal ethics. The "incentives" have to be internal to one's own mind rather than external to one's body. Ethics make you do the right thing even when nobody is watching, even if you never get rewarded or punished. No system, no matter how "perfectly designed" can turn a bunch of bad people into a good, well-functioning society. The quality of the society depends essentially on the personal qualities of its members.

Yes I am boycotting Israel (and Zionism), for genocide, apartheid, human rights violations, interfering with my own government. They've been breaking international law since the Balfour Declaration.

You can boycott things for whatever political reasons you want, but boycotting something for political reasons is very different than boycotting to improve your own security. My impression is that it is the latter the original post was suggesting, and its the latter that doesn't make sense to me, as a practical matter.

I didn't know this about Snyk. Taking them out of my tools and unregistering myself immediately. Thanks!