[owenmarshall]

Depends on how you want to slice that.

My laptop? My OpenBSD router? Very unlikely anyone has attacked it. I’ve had boring jobs and have boring interests.

Do I think the Russians, Iranians, or any major foreign adversary have a 0-day they could use against my systems if I suddenly got a top secret clearance and clocked in as more interesting? Absolutely.

[perl4ever]

I don't think this cliched "I'm not interesting" logic makes sense. At scale, a lot of "non-interesting" stuff becomes interesting. Or a way to find a needle in a haystack. Why wait until it's urgent to focus on a particular person? We all are aware that the US intelligence services operate this way, right? I can't think of a reason why others wouldn't.

[owenmarshall]

The discussion above focuses on targeted operations by state intelligence. The CIA/FBI wouldn’t run around using 0-days on everyone’s box because the risk of discovery would be too high.

I do, however, agree with you in part: I’m sure that I have a lengthy profile built from passive monitoring. Heck, I’ve googled “tor project” so I know I’m in a database.

https://daserste.ndr.de/panorama/aktuell/NSA-targets-the-pri...

[perl4ever]

[I deleted everything I wrote]

Everything is about relationships. It makes no sense to "target" someone for being suspicious up front, because when they know they are interested in you, what they want to find out is who you interact with and how. So ideally, they (any data analyst) want everybody in their database. Then they do queries when they are looking for something.

And looking at what has been public, in the news, it seems like it isn't that unusual to break into and scarf up someone else's database in its entirety, without any fancy "0-day" exploits. Case in point, the US Office of Personnel Management had everything compromised, basically all the information the US government possessed about everyone with a security clearance. Probably it will never be publicized how many spies were lost, let alone other damage.