They can be close enough to 100% as you like. Even if that was true, it does not excuse the morons who built the stuff for easy spying instead of reasonable security.

> when physical access to the hardware is so easy (for nation states)

So where is our deep, persistent infiltration of China?

Unknown to the public. The NSA doesn't announce when it has pwned other countries (except sometimes much later) and China doesn't reveal intrusions the way US agencies and companies are required to.

A few years back the whole US humint network in the PRC was lost, agents killed, due to use of antiquated security tech.

Do you have links where I can read about that? Sounds interesting

>Computers can never be 100% secure.

This is ridiculous defeatism. You are going to need more 0's than exist in the global economy to crack many cryptosystems.

I don't need to crack crypto, I just need to find an admin that can be blackmailed.

Then design the system so that there is not a single source of administrative failure.

and also make sure to design a system without any bugs

You should look into cryptography. It actually is possible to design open systems provably without bugs or single sources of failure. It's possible to build mechanisms of plausible deniability that are largely immune to rubber-hose attacks.

It's also possible to design systems with an intermediate level of security. With your attitude, you might as well leave your house unlocked because any competent locksmith could break in.

I am aware of cryptography, but how does strong cryptography prevents these?

https://www.heartbleed.com

https://www.blackduck.com/blog/understanding-apple-goto-fail...

Side channels are prevented through security audits. There is not an infinite well of bugs in any codebase that will always be exploitable.

Once you patch the bugs, they are patched. You eventually reach a state where there is no more surface area for bugs.

I'm sorry, that's not aligned with reality. Possible states in a system grow exponentially with lines of codes added and no one can expect or prevent all the failure states leading to security issues

I feel like you've never worked at a company that has decades of tech debt and has more than just a handful of devs.

Lol, ok hotshot.

You only need to spend barely 7 zeros to defeat any organization in the world. About half of a single tank to defeat any commercial IT system no matter how much they spend on “security”.

Then let them spend it instead of giving your data away for free

That is what they did. Salt Typhoon is what they got. This will continue to happen until critical software systems are secure against state actors and requires tens to hundreds of billions of dollars to compromise instead of millions to tens of millions (in the hardest cases).

It's a lot cheaper to just kidnap and interrogate someone with the access you need.

And that's only if blackmail didn't work.

Okay then make them do that instead of giving your data away for free