Hacker News new | ask | show | jobs
by seadan83 294 days ago
Gotta say, you sound hypercritical.

> "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)?

This is not a research paper where the guardian needs to go into those details. Those details are known based on previous incidents/issues and general knowledge.[1]

> Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this).

Guardian articles are pretty short. They're not going to quote someone when all they are trying to get is that these are risky tools that invite abuse. So they interviewed an expert who could give a quote to that effect. Why is that shovelled in? This is very much "WHY" someone should care. It's a core tenant of journalism, don't just present what - but also some analysis for what it means.

> Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming.

Yeah, are they going to link to 30 different articles and so forth? Here you go, a quick reference: [2]

> ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it.

Why does any of the quote sound cherry-picked? The context seems clear: other governments use this tool, if USG does too, then other governments know the capabilities. It's an intrinsic problem. Seems to be completely conveyed via the quotes, and that was presumably the reason to interview this additional person.

> The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen?

How this happens is WAY out of scope of the article. This is a general news article that is around 300 or so words. It's not a security bulletin or a tech focused article. Why do you expect these details? Can you give any other examples from say the LaTimes, BBC.co.uk, or any other similar news services?

> And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power.

This does seem implied. The quote "were designed for dictatorships, not democracies built on liberty and protection of individual rights" is really saying this, no? Like, it's saying exactly, this technology is a concern because it can be abused and is a tool for authoritarian countries and not democracies.

> The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.

I agree with your premise here. In this case, the article that the USG is adopting these tools should be well alarming to you.

[1] https://citizenlab.ca/2025/06/first-forensic-confirmation-of...

[2] https://www.federalregister.gov/documents/2023/03/30/2023-06...

2 comments

Well you're certainly correct, as a tech person i'm nonetheless always disapointed by mainstream media reporting on these things as the "how" and "what" bit is by far more interesting to me than anything in the article.

The actual article is pretty old news and uninteresting - yes US police have used spyware for "surveilence". This is not new by any means. Similarly a number of Israeli private companies have made a name for themselves selling spyware software on, lets say the grey market. This is well known by now.

The only interesting thing to know would be how this particular piece of software works.

Yeah I thought it was widely known that "deploy" could be as simple as sending a text message. The recipient did not even need to open in in the case of Pegasus.
So you're presuming that there is an exploit that allows a remote attacker to install "Graphite" via a text message? That is not stated here - or anywhere - as it was over and over again in the case of Pegasus (and similarly, the trumpets sounded when the patch was fixed a couple weeks later).

The reporting here is markedly more imprecise, and it's frustrating.