lazy_gator

I agree that it is not a true backdoor, but I am simply pointing out that the goal is accomplished by hoarding 0-days or creating an actual backdoor.

The 0-day you were not reporting gave you escalated access to iOS devices. If Apple had given you a backdoor, you would have had the exact same access to the device.

Not saying its the same thing, which is why I used "de facto". The government just wants the access. Regardless the hole is intentional or unintentional, if a hole exists, then overall security is weakened

We can debate the meaning of words, but the goal of a backdoor from the perspective of the government is to gain access to a system. The effect of a backdoor is accomplished through a literal backdoor or a figurative backdoor by hoarding exploits, which both are a detriment of security.

By de facto, I was implying that they both accomplish the same things with almost the same list of pros and cons.

A unreported zero day is a de facto backdoor. The chain you mentioned has similar flaws as the current strategy. Step 3 would be incredibly difficult. It would be similar to detecting a virus signature, which are easily circumvented. The second party can use trivial techniques to change the signature in a way that makes it incredibly difficult to detect.

Many 0-days are built of of multiple bugs. A triple letter may use bug #1 and bug #2 to get a result, but another party will use bug #1 and bug #3 to get a similar result. Back to square one with corporate/government/personal equipment getting hacked reducing overall security.

I am actually in a similar boat. I have done a lot of java work, and was active on the security side of things in my previous role. I mostly worked on compliance, but I did some pen testing.

I can see compliance not being friendly to remote where pen testing would be a lot more friendly.

I know security is a big field, but I would love to hear any insight that you have on it.

Yes, that book completely changed my world view. I still think about it consistently almost 6 years later. He took a very empirical approach to a problem that is often discussed using less than thorough methods.

This is really cool. I saw that jjs was bundled with java 8, and saw this possibility.

I wonder if it is compatible with node js frameworks like express. I think that node has a lot of native code to implement various functions, so it would probably require a lot of work.