Hacker News new | past | comments | ask | show | jobs | submit | udev4096's comments login

I personally, and hope that's true for a lot of people, owe pretty much everything we have accomplished to a lot of open source projects. It's just crazy, I am extremely grateful and try to donate every now and then

I wonder how they find extremely talented exploit developers. The exploits they produce probably takes years to develop at minimum

Short and sweet: Unit 8200.

Unit 8200 is Israel's elite military intelligence cyber unit - think NSA but with mandatory military service. Israelis serve in their late teens/early twenties, the most tech-savvy and promising recruits land in Unit 8200 where they develop world-class offensive cyber capabilities on the state's dime.

When they finish their service, they take those skills directly to companies like NSO, Candiru and Paragon. It's not a secret - these companies are often funded, and actively recruit Unit 8200 alumni. The talent isn't necessarily found, it's manufactured by the state and then handed off to the private sector.

That's why Israeli spyware is so effective. Arguably, it's not commercial R&D - it's military grade capabilities with a profit motive and little, if any, ethics oversight.


Probably mostly the same way everybody finds extremely talented exploit developers? By bidding for them? Why do people think exploit developers are a strategic resource like rare earth metals? They're probably uniformly distributed across the world --- including in developing countries.

Just about every single Israeli citizen is required to complete mandatory military service. In effect this means that both the local baker and the stay-at-home programmer have likely worked for the IDF in some capacity.

> Graphite allows the operator to covertly access applications, including encrypted messengers like Signal and WhatsApp

That's pretty obvious. Signal doesn't protect you against full device compromise. Any app can trivially extract your signal conversations


> Any app can trivially extract your signal conversations

There is a security model baked in to the mobile OS that usually does not allow that.


Yes, and it can be subverted when the mobile OS is compromised.

That doesn't lead to

> Any app can trivially extract your signal conversations


In that case, can Signal users take advantage of this to export their own messages?

Yes but one would have to exploit a similar vulnerability as was exploited in this story. Apple would patch it as soon as it became popular because it could be used for an attack like this one.

I don't think that's obvious for non-techies

I would love to see how they target GrapheneOS. iPhone is easy to break, GrapheneOS is not

Use a goddamn VPN or Tor if you don't like being profiled. We live in the era of mass surveillance. It is obvious that everyone is being profiled all the time. It's a meta-data aggregating player, how the fuck do you think that works?

Linux desktop has terrible security model. Unless they intend to spend significant amount of time hardening the base distro, which also comes with it's own caveats. Windows, for all it's problems, is still a better choice for an enterprise environment

The companies falling to malware and extortion/ransomware would seem to indicate otherwise

What? That is really stupid way to think you're better off using Linux Desktop. Plenty of modern malware versions target pretty much every OS, from windows to mac

I disagree

Your opinion has nothing to do with it. Research shows it's true

Man, amazing what all "research" can do these days

LibreOffice is terrible. I cannot believe how anyone can do anything with it. I cannot stand Word but it's just impossible to find a true replacement for it. OnlyOffice should get more recognition. It is the closest you can get for Word replacement

> I cannot stand Word but it's just impossible to find a true replacement for it.

As someone who's never used Word: what do you use Word for that it's hard to find a replacement?

(For me, the "light" things I want to note down and version, I use one of the lightweight markup languages. The "heavy" things, I either use TeX or something to convert my lightweight markup into a pdf or whatever people want. What am I missing?)


>what do you use Word for that it's hard to find a replacement?

Opening files created by other organizations and expecting them to load correctly and accurately, and then editing them and expecting them to load correctly and accurately when I send them back.


How is it terrible? I keep hearing people say this, but I've never actually experienced any shortcomings personally. Granted, I don't really use word processors much. But when I did, I never had any.

Fit and finish aren't there, and have barely improved. It just looks bad. And it starts slowly (but so does Microsoft Office). Having to decide which fork to use is a problem.

Otherwise, I haven't had major issues. Sometime it doesn't work well with complex excel sheets, or complex word docs; create doc in X, edit in Y, view in X is likely to be disappointing if formatting is critical, but I've seen people use a publish to PDF, edit by change requests flow for that instead.

Other than multiplayer support, it's still much nicer than Google Docs, which can look better but likes to get into weird partially loaded states or runs simple spreadsheet tasks very slowly due to mandatory interaction with a server.


LibreOffice does everything I need it to...

Most people only use a small percentage of functionality in any app.


Individually, sure. But in an organization, the larger it is, the more probability that all of the features are being used approaches 1. Then you don't have a software issue anymore, you have a business workflow, retraining, or retooling issue.

Most admin staff don't do anything complex aside from writing letters. They don't create complex docs with table of contents and images and so on.

I have worked for companies prior who gave basic online office 365 to 99% of staff and then more expensive subscriptions on a as needed basis.


Using multiple tiers of the same application is a good strategy.

And using partial MS Office and partial LibreOffice is also certainly an option, but whether it will be successful depends on an organization's workflow, because that introduces an additional interoperability risk which isn't an issue if everyone uses the same tool.


Yeah I tried so hard to use LibreOffice. OnlyOffice is great

GrapheneOS is in dire need of an OEM partner access which can provide them with the latest source which Google has put behind a paywall. Otherwise, GrapheneOS will not be able to continue the development and eventually shut down

It sounds like early access will speed things up for them/their users. I read nothing in the thread about a general inability to continue nor the danger of having to shut it down?

I very much applaud the goal of trying to be up to date within a few days of new releases and I hope they find both good devs and gain access. I can also see how that may impact morale in the longer term if they don’t.


The rumor is that Android will be going almost completely closed source. If that happens, there'll be no new releases.

Yeah, they haven't posted about shutting down on twitter. It was posted in the matrix room:

> We previously let the community know we need Android partner access in order to port to Android 16 early and for other reasons. We have not received Android partner access. Now that Android 16 has been released, it has become clear that we are going to need it more than before going forward. At the moment, it's clear that GrapheneOS development will be unable to continue in the way it was going before. This the last call for people to share partner access with us if you want to see GrapheneOS continue. Otherwise, be prepared for the final release of GrapheneOS to be today. It's up to the people who have this access to decide if they want the project to go on after today. In order to continue without this, we would need to do substantially more work that we have not had to do previously.


EDIT: More context from the GrapheneOS team on their public Twitter communications

>In the past, the main issue with AOSP was them forking AOSP apps into Google apps and then sometimes abandoning the AOSP apps. This increased over time, leaving behind a bunch of legacy apps we need to replace. There have been similar issues to this, but all things we can handle.

>They've added more and more functionality to Google Play which ends up being considered required, but they haven't ever gone out of the way to gut parts of AOSP. Android 16 has changed this. They ripped out all of the device repositories, despite promising to do the opposite.

More contextual information potentially coming from a community member (not GrapheneOS) on their forum:

>Google apparently hasn't released the kernel code and Pixel device specific code yet, and GrapheneOS team seem to be panicking over that latter part right now, as Google seemingly have removed that code from the AOSP tree entirely, possibly permanently. The next few days will be exciting.


This is one of the reason you need to segregate your whole LAN. At the bare minimum, use VLANs to knock off these ruthless scanners. And obviously, this wouldn't be possible if you used a strong adblock list on whatever DNS you're running. They cannot touch the people who take proper measures. I also do not believe people who use Facebook really care about privacy. I am well aware of how mean this sounds but they fully deserve to be tracked

> they fully deserve to be tracked

Absolutely not. The law is still the law. The fact that Meta is able to break the law via technical means doesn’t mean victims deserve to be victimized.

Just because someone is able to pick your lock at night doesn’t mean you deserve to be burglarized.


Get a better lock. If you don't care enough to not get lock picked, whose fault is it? The bar to avoid this form of tracking is not high at all. It's trivial for anyone who is willing to put some serious efforts in defending their privacy

"trivial ... serious efforts"

which is it? you contradict yourself in a single sentence.


Absolutely no lock will prevent a sufficiently motivated thief.

And the bar is high for the average person, who isn't much tech savvy at all.


You live in a tech bubble if you think it's trivial when most people don't even know what localhost is.

This is why lawmakers don't take the opinion of "experts" like you.

People: "Oh there is a poisonous substance in the water. Many people harmed" Your answer: "Yeah, why don't you have a degree in water safety, in the first place plebs? I take samples every week."

GDPR doesn't work like your imaginary all-expert world. Facebook should and hopefully be fined to nonexistence.


I am definitely not surprised. It's quite normal, as I stated. What I was trying to say was they are abusing the private frontends to get around legal restrictions of aggressively scraping the web

Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: