The same that it works in any other industry. By hiring those with proven track records, the best of the best. The goal is obviously not to hire 100% of the potential 0-day hunters, but by launching a concentrated poaching effort, to make a sufficient dent.
> What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability.
This is such a crucial point. Forced to read between the lines of the blog post (because the above information is missing), it sounds like there are currently unpatched issues in Android revolving around this?
If the number of skilled 0-day hunters who will work for a paycheck is > 0, then yours is a moot point, since a poaching program would still make an impact even if there are some people who work for spyware companies who would not work for FAANG.
I think you will also find that morals for many people are inversely proportional to the offered salary. An 0-day developer being compensated $130k may well abandon their particular morals if offered a $240k salary instead.
Project Zero is amazing, but they 1) seem like a very small team, and 2) their mandate is far too broad (essentially to search for 0-days in anything, versus a specific system). What I am talking about is more like Apple having a dedicated team of 10 vulnerability researchers all looking into iOS 0-days fulltime.
> But while they could try and poach them today, tomorrow there will be a whole load of new people working for those companies, and it'll just be a never-ending cycle.
The number of people who successfully find 0-click 0-days for iOS/Android is very small. It's not a vastly replenishable resource.
Spyware firms and 0-day vendors both have staff dedicating to finding 0-days. Why do Google and Apple not simply poach these staff?
I am sure Google and Apple can offer very competitive salaries, so why do they not do so? Is it because the cost of basically poaching all of the skilled 0-day hunters is deemed to be greater than the cost of just issuing patches?
This reminds me of when Signal messenger locked users out of their chats until they set a device PIN several years(?) ago. The fact that people may have been in the middle of important conversations was apparently not a concern.
'Privacy' is in the title of the article, not 'privacy policies'. Reducing 'privacy' to just privacy policies is overly reductive, let alone speculative that that's what the author did. Regardless, assuming it is privacy policies, what about their privacy policies, specifically? What does Chrome's policy state that's so egregious that Safari's doesn't?
The problem with generic advice like this is that it is invariably opinionated and unexplained.
For example, what makes Firefox, Safari, and Brave ethical browsers but Edge and Chrome not?
Firefox development has undergone plenty of unethical decisions, and I'm not sure what even a distant justification for Safari being 'ethical' would be.
> I‘m only buying quality stuff and stick to it as long a possible. Most of my cloth are years old.
> I’m buying a new iPhone if the one i have doesn’t get any updates anymore
There have been many cases of Apple deploying planned obsolescence - intentionally crippling devices to get people to buy new models. So I wouldn't call Apple products that 'quality stuff'.
I base decisions on quality products based on how good they function, how long they last, and how easy and straightforward they are to repair yourself. Apple checks absolutely none of those boxes.