News for hackers. Stuff that matters.
Re:NYT journalist hacked with Pegasus after reporting on pre... by smoldesu on Sunday October 24, 2021 @04:48PM (#28981755)
You can't. It's all marketing fluff at this point, because significant enough state actors will see the ~$10,000,000 R&D cost for a few iOS/Android zero-days as a drop in the bucket. We live in a post-security world, where it's economically feasible to develop malware at a pace that outruns Blue Teams. We live in a post-privacy world because Apple and Google happily pass your data back to world governments in the name of stopping terrorism, or whatever the social cause du-jour is.

There's no escape really, your only option is to embrace the paranoia and learn to love the cat-and-mouse game, or (what most people choose) give up. Remember, this is the future you voted for when you signed up for Google Drive and bought your iPhone. This is the future you willingly supported with each ad that YouTube showed you on movie night, and the one you opted-into when you noticed you were low on popcorn and got 2-day delivery on kernels from Amazon.

Re:NYT journalist hacked with Pegasus after reporting on pre... by heavyset_go on Sunday October 24, 2021 @05:17PM (#28982018)
> We live in a post-privacy world because Apple and Google happily pass your data back to world governments in the name of stopping terrorism, or whatever the social cause du-jour is.

To illustrate this point, Apple gives up users' data for about 150,000 users/accounts in the US[1] a year in response to government data requests.

[1] https://www.apple.com/legal/transparency/us.html

Re:NYT journalist hacked with Pegasus after reporting on pre... by girvo on Sunday October 24, 2021 @05:53PM (#28982281)
What can a company do when presented with a legal, legitimate warrant? We talk like Apple in this example has a choice to say “no”: they don’t, though.
Re:NYT journalist hacked with Pegasus after reporting on pre... by heavyset_go on Sunday October 24, 2021 @05:58PM (#28982316)
Apple gives up customers' data when presented with simple data requests. Not all of the data they gave up was in response to subpeonas or warrants. Most tech companies have portals for law enforcement to simply ask, without a warrant, for users' data, and the companies often voluntarily share the requested data without any coercion from courts.

Yes, Apple is no different than any other tech company in that regard. The difference is that Apple's PR tells you otherwise. The whole San Bernardino shooting case had many people on HN saying that it meant that Apple would refuse to work with law enforcement when law enforcement would ask for users' data, even to the point of challenging subpeonas and warrants in court. That is clearly not the case.

Re:NYT journalist hacked with Pegasus after reporting on pre... by leppr on Sunday October 24, 2021 @06:14PM (#28982424)
The company shouldn't have your plaintext data in the first place.
Re:NYT journalist hacked with Pegasus after reporting on pre... by girvo on Sunday October 24, 2021 @07:26PM (#28982881)
No company should, but we don't live in that world (for a number of reasons), and if they do then they must follow instructions given by the government via warrants.

One of the issues I have is that those warrants are rubber-stamped out. We should change how the judiciary approaches that, raise the bar law enforcement has to meet to be able to request that data, while also encouraging the use of encryption at every level.

Until we make those changes (which I'm of the opinion the wider society does not have an appetite for the legal and usability trade-offs that come with the even if I personally do), I guess I'm confused by what we're demanding when we point out that a company based in the US cooperates with valid legal requests from the US government.

Re:NYT journalist hacked with Pegasus after reporting on pre... by smoldesu on Sunday October 24, 2021 @08:17PM (#28983224)
We're already in a zero-sum game, society won't 'like' any of the things that come next. What goes up must come down, and I get the feeling that we grossly underestimate how much data is in the hands of third-parties, private holdings and sovereign governments with their own interests. That dam will burst, it's just easier to tell the audience that the Internet is a Titanic: too big to fail, right?

The sentiment towards Apple is just disappointment today. Their 'ecosystem' approach has had detrimental effects on the consumer electronics market, and has given them a frightening amount of power over the flow of information. Apple's treatment has been generally irresponsible, though: they do nothing to assuage the general public of what's running in their OSes, rather choosing to occasionally throw out unverifiable whitepapers of how these systems might work, but we've got no way to verify that. For a company that claims 'privacy is a human right', I was really hoping to dig into something more profound.

The biggest issue is that we're taking Apple at face-value. They're documented liars, and their insistence on being right contrasts with their tacit rejection of transparency. They operate without accountability, and the only people keeping them in check have a mutual interest in creating a monopoly. Their factories are staffed by political prisoners, and they're the only FAANG company who's comfortable operating in China's homeland. It's crazy how people forget this with nothing more than a little marketing and some diversity in their iPhone commercial.

I expect better from a company with more money in the world than anyone else. But maybe this is yet another reminder that shareholders don't care about your security, privacy or peace-of-mind.