8 ms·

IBM Gives the Chinese Government Access to Software Code

59 points by pavornyoh 11y ago

haosdent 11y ago
I believe nobody could understand those stale and tricky code.
douche 11y ago
Would have maybe been somewhat informative if the article had said what products IBM was giving source code for.
- blumkvist 11y ago
  I opened the link just to read that...
AdmiralAsshat 11y ago
Beijing won’t receive client data or “back doors” into the technology, International Business Machines Corp. said Friday in a statement. I assume this means that IBM won't specially code backdoors into the software for the Chinese government to use, but I initially read that sentence to mean that there are backdoors in the software, but IBM won't show them to China. Which kinda defeats the purpose of letting them see the source code.
- pjc50 11y ago
  It increases the effort required; if you can make the binary line up with 99% of the source code, the remaining 1% is where the back door is. It's unlikely to have entirely reproducible builds, but simply making the callgraphs line up will give you a lot of information.
tacotuesday 11y ago
It seems the Chinese policy is very smart by demanding inspection of software before it goes into deployment/production. It's common sense really. We should demand as much in the US. Too bad we have laws and agencies that demand the exact opposite: https://www.fsf.org/blogs/licensing/epa-opposed-dmca-exemptions-that-could-have-revealed-volkswagen-fraud https://www.fsf.org/blogs/licensing/epa-opposed-dmca-exempti... I wonder who in our government thinks deploying code without review or testing is a good idea? Does anyone know where one might find a full list of these people/agencies?
- noarchy 11y ago
  It is one thing to have the government get access to software, and quite another to have truly open source software. Does the entire Chinese population have access to the source? I seriously doubt it.
dogma1138 11y ago
Microsoft and many other companies share code with governments and not just the US. https://en.wikipedia.org/wiki/Shared_source#Microsoft_Government_Security_Program https://en.wikipedia.org/wiki/Shared_source#Microsoft_Govern... This isn't that uncommon, and originally this wasn't even necessarily done form a security POV, office source code was shared so governments could build extensions on it for their own internal use before addon's were introduced or when addon functionality wasn't sufficient. Windows source code including kernel source code was often shared to pass various inspections, and in many cases to integrate proprietary tech such as hardware encryption into the system.
- tacotuesday 11y ago
  Indeed. This is, presumably, how the NSA managed to backdoor all major hard drive manufacturers' firmware. http://www.dailykos.com/story/2015/02/17/1364910/-Breaking-Kaspersky-Exposes-NSA-s-Worldwide-Backdoor-Hacking-of-Virtually-All-Hard-Drive-Firmware http://www.dailykos.com/story/2015/02/17/1364910/-Breaking-K... The NSA buys lots of storage, so it's only natural they would demand and have access to poorly tested/reviewed code hiding behind closed sources.
- pohungc 11y ago
  How would you even reliably audit something as big and complex as the Windows source code?
  - dogma1138 11y ago
    I'm not sure how many of them actually audited it and how many of them had to get access to the source code to tick a box. Government contracts for software often include having the rights for the source code in case the vendor goes out of business. In other cases they might want to audit only certain parts of the OS, or just to integrate their own code at a level that out of the box Windows interoperability doesn't support. If you say have a hardware encryption & security module which connects directly to the hard hard drive and includes a smart card reader for access you will probably need the ability to run custom code in the BIOS, boot loader and OS levels. Then again if you have the resources of a US, major European power, Russian or Chinese state agency you might have the ability to also audit the full source code.
fredkbloggs 11y ago
'“Strict procedures are in place within these technology demonstration centers to ensure that no software source code is released, copied or altered in any way,”' So... if I were an IBM shareholder (I'm not), I'd certainly hope that this means the code has been provided as a series of highly-compressed JPEGs of the code in a non-OCRable font (i.e., with randomness injected). Otherwise you can go ahead and set your forecasts for IBM's software sales in China to 0 for 2019 or so and beyond.
- Pyxl101 11y ago
  See my other comment in this thread for details about how these audits are usually done.
  - fredkbloggs 11y ago
    Thanks. Hopefully that's what's happening here. The article wasn't clear at all as to whether what's happening is what you describe or simply China getting copies of the source (in some form). What a difference it makes!
- brianwawok 11y ago
  Pretty sure they could just hire 20k people to type in the OCR proof code.. i.e. the turk solution.
  - fredkbloggs 11y ago
    Still best to make it as expensive as possible.
- douche 11y ago
  Given the current trends that I've been seeing, I think you could probably pencil in $0 for IBM software sales in 2019 anyway. IBM doesn't seem to be very interested in selling software.
- MichaelGG 11y ago
  Do you really think that a country the size of China cannot afford the intelligence service needed in order to get IBM's source code? US intelligence officers have been compromised for 6-7 figures, for decades. Yet IBM's gonna make sure well funded countries cannot slip in a hire? Come on.
vegabook 11y ago
China requires all industries, including aerospace, cars, energy, FMCG, and IT, to cough up IP for free in return for access to its markets. Yet we provide access to our huge markets, gratis. Even if Western access to Chinese markets is inevitably sporadic and subject to the whims of regulatory Chinese quangos who can withdraw it at any time they feel like it, equity markets encourage companies to play the game and cough the secrets, in the name of the next quarterly targets. Unlike the actual human beings involved, equities don't care if the IP moves from one society to the next. They can literally rebalance their portfolios from West to East in seconds. Yet much of the IP thus surrendered was created not directly by those Western companies, but by the societies which fostered the freedoms, intellectual, physical, and political, for such discoveries to be possible, encouraged and nurtured. Those freedoms cost dearly, often literally in blood. That we're selling this patrimony, hard-won by our forefathers, on the cheap, is criminal.
- Pyxl101 11y ago
  What you say might be going on, but I would not expect this source code sharing to constitute IP transfer. It's an audit or inspection. The government isn't allowed to use the code, and I doubt they intend to or have the ability to. I haven't been involved in government audits of source code, but I have been involved in private audits. We invite the third party into our offices, where we provide them access to a laptop that has the source code loaded onto it. The laptop's network access has been disabled. They're free to examine it for as long as they wish, but they're not allowed to copy it or remove it from the network. These kinds of mitigations are presumably what they're referring to when they say: “Strict procedures are in place within these technology demonstration centers to ensure that no software source code is released, copied or altered in any way.” Note the term technology demonstration center, that is, physical location. This kind of audit is fairly routine when an important customer is considering your product, for a number of reasons. After all of the security events in the news recently, any foreign government would be right to worry about backdoors in technology provided by US firms. Source code access is one way to mitigate those concerns. It's an audit, not a technology transfer. Last but not least: I could imagine a certain kind of software where it could be damaging, and could reveal IP, to allow anyone to see any part of the code. Imagine if I invent a better audio compression algorithm that's twice as good as typical MP3 compressors, while producing MP3 format. Then showing someone even a snippet of code could give away my trade secret of how it works. However, the source code of large software products like IBM's is unlikely to have any especially valuable secret sauce. The value of the IP comes from the whole, not of any one special part. In that circumstance, allowing someone to peruse the code at their leisure doesn't give much away.
intrasight 11y ago
It's been a long time (or perhaps never) that the source code had any real value. The value is in the organization - as in both meanings of the word. The noun - organization as legal entity. And the verbish meaning - the organization of all that complexity towards getting something accomplished. Also, I think all software systems tend to be improved by having more people look at the code. It eliminates the temptation of "security through obscurity". So if you're not willing to show your stuff, you either a) still falsely believe that your code has intrinsic value, or b) you are ashamed of or at least don't have much confidence in your code.

59 points by pavornyoh 11y ago

haosdent 11y ago

I believe nobody could understand those stale and tricky code.

douche 11y ago

Would have maybe been somewhat informative if the article had said what products IBM was giving source code for.

blumkvist 11y ago
I opened the link just to read that...

AdmiralAsshat 11y ago

Beijing won’t receive client data or “back doors” into the technology, International Business Machines Corp. said Friday in a statement. I assume this means that IBM won't specially code backdoors into the software for the Chinese government to use, but I initially read that sentence to mean that there are backdoors in the software, but IBM won't show them to China. Which kinda defeats the purpose of letting them see the source code.

pjc50 11y ago
It increases the effort required; if you can make the binary line up with 99% of the source code, the remaining 1% is where the back door is. It's unlikely to have entirely reproducible builds, but simply making the callgraphs line up will give you a lot of information.

tacotuesday 11y ago

It seems the Chinese policy is very smart by demanding inspection of software before it goes into deployment/production. It's common sense really. We should demand as much in the US. Too bad we have laws and agencies that demand the exact opposite: https://www.fsf.org/blogs/licensing/epa-opposed-dmca-exemptions-that-could-have-revealed-volkswagen-fraud https://www.fsf.org/blogs/licensing/epa-opposed-dmca-exempti... I wonder who in our government thinks deploying code without review or testing is a good idea? Does anyone know where one might find a full list of these people/agencies?

noarchy 11y ago
It is one thing to have the government get access to software, and quite another to have truly open source software. Does the entire Chinese population have access to the source? I seriously doubt it.

dogma1138 11y ago

Microsoft and many other companies share code with governments and not just the US. https://en.wikipedia.org/wiki/Shared_source#Microsoft_Government_Security_Program https://en.wikipedia.org/wiki/Shared_source#Microsoft_Govern... This isn't that uncommon, and originally this wasn't even necessarily done form a security POV, office source code was shared so governments could build extensions on it for their own internal use before addon's were introduced or when addon functionality wasn't sufficient. Windows source code including kernel source code was often shared to pass various inspections, and in many cases to integrate proprietary tech such as hardware encryption into the system.

tacotuesday 11y ago
Indeed. This is, presumably, how the NSA managed to backdoor all major hard drive manufacturers' firmware. http://www.dailykos.com/story/2015/02/17/1364910/-Breaking-Kaspersky-Exposes-NSA-s-Worldwide-Backdoor-Hacking-of-Virtually-All-Hard-Drive-Firmware http://www.dailykos.com/story/2015/02/17/1364910/-Breaking-K... The NSA buys lots of storage, so it's only natural they would demand and have access to poorly tested/reviewed code hiding behind closed sources.
pohungc 11y ago
How would you even reliably audit something as big and complex as the Windows source code?
- dogma1138 11y ago
  I'm not sure how many of them actually audited it and how many of them had to get access to the source code to tick a box. Government contracts for software often include having the rights for the source code in case the vendor goes out of business. In other cases they might want to audit only certain parts of the OS, or just to integrate their own code at a level that out of the box Windows interoperability doesn't support. If you say have a hardware encryption & security module which connects directly to the hard hard drive and includes a smart card reader for access you will probably need the ability to run custom code in the BIOS, boot loader and OS levels. Then again if you have the resources of a US, major European power, Russian or Chinese state agency you might have the ability to also audit the full source code.

fredkbloggs 11y ago

'“Strict procedures are in place within these technology demonstration centers to ensure that no software source code is released, copied or altered in any way,”' So... if I were an IBM shareholder (I'm not), I'd certainly hope that this means the code has been provided as a series of highly-compressed JPEGs of the code in a non-OCRable font (i.e., with randomness injected). Otherwise you can go ahead and set your forecasts for IBM's software sales in China to 0 for 2019 or so and beyond.

Pyxl101 11y ago
See my other comment in this thread for details about how these audits are usually done.
- fredkbloggs 11y ago
  Thanks. Hopefully that's what's happening here. The article wasn't clear at all as to whether what's happening is what you describe or simply China getting copies of the source (in some form). What a difference it makes!
brianwawok 11y ago
Pretty sure they could just hire 20k people to type in the OCR proof code.. i.e. the turk solution.
- fredkbloggs 11y ago
  Still best to make it as expensive as possible.
douche 11y ago
Given the current trends that I've been seeing, I think you could probably pencil in $0 for IBM software sales in 2019 anyway. IBM doesn't seem to be very interested in selling software.
MichaelGG 11y ago
Do you really think that a country the size of China cannot afford the intelligence service needed in order to get IBM's source code? US intelligence officers have been compromised for 6-7 figures, for decades. Yet IBM's gonna make sure well funded countries cannot slip in a hire? Come on.

vegabook 11y ago

China requires all industries, including aerospace, cars, energy, FMCG, and IT, to cough up IP for free in return for access to its markets. Yet we provide access to our huge markets, gratis. Even if Western access to Chinese markets is inevitably sporadic and subject to the whims of regulatory Chinese quangos who can withdraw it at any time they feel like it, equity markets encourage companies to play the game and cough the secrets, in the name of the next quarterly targets. Unlike the actual human beings involved, equities don't care if the IP moves from one society to the next. They can literally rebalance their portfolios from West to East in seconds. Yet much of the IP thus surrendered was created not directly by those Western companies, but by the societies which fostered the freedoms, intellectual, physical, and political, for such discoveries to be possible, encouraged and nurtured. Those freedoms cost dearly, often literally in blood. That we're selling this patrimony, hard-won by our forefathers, on the cheap, is criminal.

Pyxl101 11y ago
What you say might be going on, but I would not expect this source code sharing to constitute IP transfer. It's an audit or inspection. The government isn't allowed to use the code, and I doubt they intend to or have the ability to. I haven't been involved in government audits of source code, but I have been involved in private audits. We invite the third party into our offices, where we provide them access to a laptop that has the source code loaded onto it. The laptop's network access has been disabled. They're free to examine it for as long as they wish, but they're not allowed to copy it or remove it from the network. These kinds of mitigations are presumably what they're referring to when they say: “Strict procedures are in place within these technology demonstration centers to ensure that no software source code is released, copied or altered in any way.” Note the term technology demonstration center, that is, physical location. This kind of audit is fairly routine when an important customer is considering your product, for a number of reasons. After all of the security events in the news recently, any foreign government would be right to worry about backdoors in technology provided by US firms. Source code access is one way to mitigate those concerns. It's an audit, not a technology transfer. Last but not least: I could imagine a certain kind of software where it could be damaging, and could reveal IP, to allow anyone to see any part of the code. Imagine if I invent a better audio compression algorithm that's twice as good as typical MP3 compressors, while producing MP3 format. Then showing someone even a snippet of code could give away my trade secret of how it works. However, the source code of large software products like IBM's is unlikely to have any especially valuable secret sauce. The value of the IP comes from the whole, not of any one special part. In that circumstance, allowing someone to peruse the code at their leisure doesn't give much away.

intrasight 11y ago

It's been a long time (or perhaps never) that the source code had any real value. The value is in the organization - as in both meanings of the word. The noun - organization as legal entity. And the verbish meaning - the organization of all that complexity towards getting something accomplished. Also, I think all software systems tend to be improved by having more people look at the code. It eliminates the temptation of "security through obscurity". So if you're not willing to show your stuff, you either a) still falsely believe that your code has intrinsic value, or b) you are ashamed of or at least don't have much confidence in your code.