[SahAssar]

Come on, you said:

> Any government can get RCE on any OS with the change in their couch

If you were extremely hyperbolic for effect that's fine, that's why I asked if you actually believed that, but what you are saying now is not at all arguing the same point.

[indolering]

I was not being hyperbolic: a couple million dollars is very cheap for virtually any military. Both exploit broker bounties and corporate bug bounties are in that range.

What is your objection?

[DANmode]

“Extremely hyperbolic”,

or relative?

$50k-$150k+ is a low-to-medium cost case to carry out for US law enforcement. or military.

Much like the $3 in change you could dig out of your couch or car to get a small drink or sandwich.

[SahAssar]

Nobody in this thread has provided anything that would lead me to believe that any government can easily buy RCE on any OS. Read the quote again:

> Any government can get RCE on any OS with the change in their couch

[Veserv]

That is inanely pedantic. The municipal government of Monowi, Nebraska probably can not buy a RCE in any OS as they only govern a single person. That is also utterly meaningless to argue as it bears no effect on the core thrust of the argument that COTS operating systems in use by military and critical infrastructure are easily and cheaply hackable by potential adversaries. They are demonstrably grossly inadequate for purpose.

[SahAssar]

All my questions where with the assumption of a country-level government. I asked why, if this is so cheap, common and easy we do not see it used more.

Even if we said that we restrict it to for example the G20 I still don't think they can easily and cheaply "RCE any OS".

[indolering]

We do see it! Do you not remember the Snowden leaks?

Shit hasn't changed much. We still have monolithic kernels written in portable assembly. Linus still doesn't tag bug fixes with potential security impacts as such because he is more worried about unpatched consumer garbage (which compromise all low end phones). When your mitigation for such problems is to not make it obvious, then your OS is not safe enough in safety critical settings (which includes consumer devices).

Process isolation would downgrade the vast majority of critical Linux CVEs to availability bugs (crash a server but not compromise it).

Just because governments don't need to reach for RCE everytime doesn't mean that it is safe. Th fact that such bugs are so cheap is an indication that your safety margin is too thin.

[DANmode]

“I don’t get told, it isn’t happening/possible.”

Hopefully this helps as succinctly as possible. Genuinely.