5 ms·

Any time I hear that a Chinese company is investing in a product I use, it's as if the Chinese government is now part owner of it as well. This may be general p

Any time I hear that a Chinese company is investing in a product I use, it's as if the Chinese government is now part owner of it as well. This may be general paranoia, but given the latest crackdown on VPNs and privacy, I don't know that I want a foreign government with a significant stake in Alibaba have access to direct the future of MariaDB. Is anyone else feeling this?

gnbfrdjng 9y ago
What would the concrete concern be in this case? Any backdoor would destroy the company brand and be excised immediately in a fork. I suspect they’ll treat it like a piece of critical infrastructure; their political concerns would be at the gfw level, and I just don’t see the likelihood of weaponized attacks. Databases are usually locked down for egress and any outgoing attempts would be rapidly detected.
- finnh 9y ago
  > excised immediately Only if the backdoor is obvious. I doubt they would introduce a backdoor that reads `if ($PWD = "supersecretbackdoorpwd") loginAs("root");` But a subtle buffer overrun resulting in a 0day that's only obvious to the writers - that's much more likely. Check out the Underhanded C contest for examples of ways exploits can hide in plain sight. EDIT: I'm not saying that's what going to happen with Alibaba & MariaDb. I'm just saying that "open source" != "free of exploits and backdoors". One of the biggest untruths about open source is that, with enough eyeballs, all bugs are shallow.
  - gnbfrdjng 9y ago
    The backdoor would either be obvious (ie make outgoing connections) or it would have debatable value (maybe a killswitch?)
- mtgx 9y ago
  Lenovo seems to get caught with a backdoor every 6 months or so lately. Although I do think that has tainted its brand, I think it's still pretty far off from "destroying the brand".
  - gnbfrdjng 9y ago
    Lenovo doesn’t make databases.
  - srcmap 9y ago
    https://www.techpowerup.com/209925/nsa-hides-spying-backdoors-into-hard-drive-firmware https://www.techpowerup.com/209925/nsa-hides-spying-backdoor... This kind of stories doesn't seems to hurt the US HDD maker 's brand, neither. Most of the world just don't care or don't have a choice.
patrickaljord 9y ago
Not everything has to be about politics. Sometimes a big company investing in an open source database it already uses is just trying to improve its own infrastructure, not trying to hack your country.
- scarmig 9y ago
  That's besides the point. Even if every single employee at Alibaba is well-intentioned (which is close enough to reality to be considered the case), in the end the government of the PRC has the capability to coerce the company to exert influence in a direction we almost certainly wouldn't like. The only question is whether the PRC would consider the trade offs worth it.
  - sangnoir 9y ago
    > in the end the government of the PRC has the capability to coerce the company to exert influence in a direction we almost certainly wouldn't like. It's open source- when that happens, you can fork it and influence it in the direction that you like. I mean if the GCHQ has an active github account[1] - I think the PRC gets a pass to publish open source, let alone Alibaba. 1. https://github.com/gchq https://github.com/gchq
- QAPereo 9y ago
  Everything involving huge amounts of money in China is at least tangentially political.
AsyncAwait 9y ago
> Is anyone else feeling this? Yes, but the Western governments are moving in a similar direction. I'd rather Alibaba sponsor MariaDB than not.
- ppeetteerr 9y ago
  How so?
yeukhon 9y ago
If you look at Alibaba's investment portfolio [1], you will see Alibaba has invested in a number of popular US-based startups like Snapchat and Lyft, so are they owning part of Snapchat as much as other VCs (depending on the % of course). One can say about Google / Facebook / Amazon investing in startups and non-profits inevitably influence these organizations' directions; that's just the nature of any investments. When you donate money to a cause you support, you indirectly influence how the cause is headed, because you can pull the pledge, and when enough people pull the pledge, then the people running the cause/non-profits will have to do something to the demand of the donators. China is the biggest creditor of the US national debt, and even before that US was careful with its relationship with China anyway. So we can't say there is a cause and effect, the best is a weak correlation, and even that is a stretch. [1]: https://www.crunchbase.com/organization/alibaba/investments https://www.crunchbase.com/organization/alibaba/investments
- mmanfrin 9y ago
  China is the biggest creditor to the US national debt Uh, no it ain't. Not even close. Domestic funds are the lions share, with Social Security Trust holding 2.5x what China does (2.8t vs 1.1t).
  - yeukhon 9y ago
    Uh, excuse me, can you check this? http://money.cnn.com/2017/08/16/investing/china-us-debt-treasuries/index.html http://money.cnn.com/2017/08/16/investing/china-us-debt-trea... Do you want me to be more precise? Foreign creditor? "The Treasury Department has ranked China as the biggest foreign creditor to the U.S. for the overwhelming majority of the past nine years. "
    - deleted 9y ago
      [deleted]
    - tkfu 9y ago
      "Biggest foreign creditor" and "biggest creditor" are worlds apart; it's not just about being more precise. More than two thirds of US debt is held domestically.
jordanlev 9y ago
Yeah, would be better if a US company like Oracle were in charge of it ;) (Not agreeing or disagreeing with you, just kind of funny/ironic that we're talking about a fork of an open source project that exists because of disagreement with the steward of MySQL... if Alibaba negatively impacts MariaDB, couldn't we just then move on to another fork. MylantaDB anyone?)
- theduncan 9y ago
  I don't know if Monty has anymore kids to name databases after. Monty is the one who first created MySQL, and later foked MySQL to create MariaDB. There is also MaxDB, but it looks to be a SAP product.
  - microcolonel 9y ago
    Maybe some grandkids will come into the picture by the time the PRC betrays MariaDB.
martin1975 9y ago
I'd be concerned if they got a sizable chunk of legislative/executive power... until that happens, I wouldn't worry.
throwawaymanbot 9y ago
No not feeling it. Its a database technology. Ali Baba was part owned by yahoo wasn't it? Anyway the code is at least open source. It can be vetted.
projectramo 9y ago
I hear you. We should keep these companies in the hands of US tech companies that would never dream of violating our privacy or collaborating with a government entity against our wishes.
whooshee 9y ago
Interesting, If Google or another tech giant in the U.S. are investing it, would you worry about that? I remember Project PRISM did happen, didn't it ? Alibaba invested it to its own advantage by contributing back to opensource and try to get more Startups in China to use it, that's simple as that. And MariaDB is opensource and community-driven, I don't think it will be controlled.
dreamfactored 9y ago
I assumed they were doing this precisely not to be under the US yoke of Oracle, Google, AWS

gnbfrdjng 9y ago

What would the concrete concern be in this case? Any backdoor would destroy the company brand and be excised immediately in a fork. I suspect they’ll treat it like a piece of critical infrastructure; their political concerns would be at the gfw level, and I just don’t see the likelihood of weaponized attacks. Databases are usually locked down for egress and any outgoing attempts would be rapidly detected.

finnh 9y ago
> excised immediately Only if the backdoor is obvious. I doubt they would introduce a backdoor that reads `if ($PWD = "supersecretbackdoorpwd") loginAs("root");` But a subtle buffer overrun resulting in a 0day that's only obvious to the writers - that's much more likely. Check out the Underhanded C contest for examples of ways exploits can hide in plain sight. EDIT: I'm not saying that's what going to happen with Alibaba & MariaDb. I'm just saying that "open source" != "free of exploits and backdoors". One of the biggest untruths about open source is that, with enough eyeballs, all bugs are shallow.
- gnbfrdjng 9y ago
  The backdoor would either be obvious (ie make outgoing connections) or it would have debatable value (maybe a killswitch?)
mtgx 9y ago
Lenovo seems to get caught with a backdoor every 6 months or so lately. Although I do think that has tainted its brand, I think it's still pretty far off from "destroying the brand".
- gnbfrdjng 9y ago
  Lenovo doesn’t make databases.
- srcmap 9y ago
  https://www.techpowerup.com/209925/nsa-hides-spying-backdoors-into-hard-drive-firmware https://www.techpowerup.com/209925/nsa-hides-spying-backdoor... This kind of stories doesn't seems to hurt the US HDD maker 's brand, neither. Most of the world just don't care or don't have a choice.

patrickaljord 9y ago

Not everything has to be about politics. Sometimes a big company investing in an open source database it already uses is just trying to improve its own infrastructure, not trying to hack your country.

scarmig 9y ago
That's besides the point. Even if every single employee at Alibaba is well-intentioned (which is close enough to reality to be considered the case), in the end the government of the PRC has the capability to coerce the company to exert influence in a direction we almost certainly wouldn't like. The only question is whether the PRC would consider the trade offs worth it.
- sangnoir 9y ago
  > in the end the government of the PRC has the capability to coerce the company to exert influence in a direction we almost certainly wouldn't like. It's open source- when that happens, you can fork it and influence it in the direction that you like. I mean if the GCHQ has an active github account[1] - I think the PRC gets a pass to publish open source, let alone Alibaba. 1. https://github.com/gchq https://github.com/gchq
QAPereo 9y ago
Everything involving huge amounts of money in China is at least tangentially political.

AsyncAwait 9y ago

> Is anyone else feeling this? Yes, but the Western governments are moving in a similar direction. I'd rather Alibaba sponsor MariaDB than not.

ppeetteerr 9y ago
How so?

yeukhon 9y ago

If you look at Alibaba's investment portfolio [1], you will see Alibaba has invested in a number of popular US-based startups like Snapchat and Lyft, so are they owning part of Snapchat as much as other VCs (depending on the % of course). One can say about Google / Facebook / Amazon investing in startups and non-profits inevitably influence these organizations' directions; that's just the nature of any investments. When you donate money to a cause you support, you indirectly influence how the cause is headed, because you can pull the pledge, and when enough people pull the pledge, then the people running the cause/non-profits will have to do something to the demand of the donators. China is the biggest creditor of the US national debt, and even before that US was careful with its relationship with China anyway. So we can't say there is a cause and effect, the best is a weak correlation, and even that is a stretch. [1]: https://www.crunchbase.com/organization/alibaba/investments https://www.crunchbase.com/organization/alibaba/investments

mmanfrin 9y ago
China is the biggest creditor to the US national debt Uh, no it ain't. Not even close. Domestic funds are the lions share, with Social Security Trust holding 2.5x what China does (2.8t vs 1.1t).
- yeukhon 9y ago
  Uh, excuse me, can you check this? http://money.cnn.com/2017/08/16/investing/china-us-debt-treasuries/index.html http://money.cnn.com/2017/08/16/investing/china-us-debt-trea... Do you want me to be more precise? Foreign creditor? "The Treasury Department has ranked China as the biggest foreign creditor to the U.S. for the overwhelming majority of the past nine years. "
  - deleted 9y ago
    [deleted]
  - tkfu 9y ago
    "Biggest foreign creditor" and "biggest creditor" are worlds apart; it's not just about being more precise. More than two thirds of US debt is held domestically.

jordanlev 9y ago

Yeah, would be better if a US company like Oracle were in charge of it ;) (Not agreeing or disagreeing with you, just kind of funny/ironic that we're talking about a fork of an open source project that exists because of disagreement with the steward of MySQL... if Alibaba negatively impacts MariaDB, couldn't we just then move on to another fork. MylantaDB anyone?)

theduncan 9y ago
I don't know if Monty has anymore kids to name databases after. Monty is the one who first created MySQL, and later foked MySQL to create MariaDB. There is also MaxDB, but it looks to be a SAP product.
- microcolonel 9y ago
  Maybe some grandkids will come into the picture by the time the PRC betrays MariaDB.

martin1975 9y ago

I'd be concerned if they got a sizable chunk of legislative/executive power... until that happens, I wouldn't worry.

throwawaymanbot 9y ago

No not feeling it. Its a database technology. Ali Baba was part owned by yahoo wasn't it? Anyway the code is at least open source. It can be vetted.

projectramo 9y ago

I hear you. We should keep these companies in the hands of US tech companies that would never dream of violating our privacy or collaborating with a government entity against our wishes.

whooshee 9y ago

Interesting, If Google or another tech giant in the U.S. are investing it, would you worry about that? I remember Project PRISM did happen, didn't it ? Alibaba invested it to its own advantage by contributing back to opensource and try to get more Startups in China to use it, that's simple as that. And MariaDB is opensource and community-driven, I don't think it will be controlled.

dreamfactored 9y ago

I assumed they were doing this precisely not to be under the US yoke of Oracle, Google, AWS