big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less.
"jesus christ. the damage our own government has done to [Iraq, Syria, Libya, North Korea, Vietnam, Serbia, Afghanistan...] is just insane. if i was a [citizen of these countries] I would be so pissed."
At least, the shareholder has his life and his property (sans the missed opportunity due to "the damage our own government has done to microsoft").
"We are fighting the evils of terrorism" / "It's their fault for releasing software full of these holes" / "It's the target's fault for installing this OS" pretty easy to rationalize this stuff.
And I think you are implicitly asking them to think "one day this will leak and will damage the reputation of a major US company" and they probably are not allowed to think that way it's more down the line "we'll just keep it hidden and nobody will ever find out, we are the best at this and not like those other agencies whose stuff has been leaked"
The CIA's job is to spy on people. Planting bugs is part of their job. If they didn't plant bugs in computer systems too, what are they being paid for?
I mean, you can argue that their entire charter should be rearranged or abolished, but it's hard to blame them when "sneaking into places they're not wanted and exfiltrating data" is kind of their entire reason for existing.
(the drone program is a whole other kettle of fish)
It's meant for post-compromise use. You need admin rights before you can use it.
I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends.
> big companies go along with this behavior and collude with the government
Isn't that called mercantilism?
> big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less.
It hasn't affected their bottom line yet.
It is concerning how intertwined large corporations are with government.
> It hasn't affected their bottom line yet.
it's unknowable what the bottom line or stock price would be with different circumstances, but there is no question that security disclosures like this are a downward pressure on it.
who knows; maybe they did get an even bigger lift from the collusion.
the only way it will change is if consumers start pricing in this kind of behavior (paying less for compromised products).
it's too bad that's such an unlikely goal.
I actually blame both, but it's not like MS is an innocent victim here -- there's a lot more they could have done on security, and didn't because it was expensive. If that choice being exploited costs them money, how is that anything but an effect of their own choices?
I'm not sure Microsoft has been making the bad "security is expensive" decisions since XP sp2. Note also that they've been ahead of the curve on security since Vista, which was much maligned (partially) as a result. Nowadays both macOS and windows effectively have UAC, but Vista took the heat for it. Same thing with blocking unknown software; Windows took the heat, but just you try to run non-Apple-signed packages on OS x.
It's also trivial to escalate from a regular user to NT AUTHORITY\SYSTEM (which is a higher privilege than Administrator!). There's so many privilege escalation vulnerabilities in Windows it's hard to keep track of them all! A big reason for that is that Microsoft considers privilege escalation vulnerabilities, "medium risk".
Well, yes, this is technically true. But it's technically true because there's an infinite amount of work you can do on security. Microsoft could have hired every person on the planet who's good at verifiable systems, or could be trained to be good at it, and rewritten the entirety of Windows as provably correct code (a la seL4), taking many years and lots of money. Microsoft could have hired every cryptographer or everyone who could be good at cryptography and developed digital signature algorithms that are far better than the current state of the art. (Remember that it's been proven that the US government, or someone with aligned political goals and roughly equivalent capabilities, used a previously-unknown attack on MD5 to spoof a Windows Update certificate to Iranian nuclear reactors, and it's not like newer hashes are impossible to collide, just harder.) No matter how much time and effort you spend on security, there's always more you can spend.
The engineering decision in security is how to spend enough money to outpace your attackers, but also successfully ship a product.
If your own government is becoming one of the attackers and therefore increasing the cost it takes to stay ahead of your best attacker, to the point where shipping a product becomes unprofitable, that's not a sign that you should have been there anyway, that's a sign that your government should get out of the business of being an attacker.
EDIT: Apple, Google, etc as well.
I'm not sure what the CIA/NSA would gain by explaining their tactics, I don't understand why they would ever do that. IMO it is a non-sequitor to my comment.