4 ms·

Tech firms let Russia probe software widely used by U.S. government

34 points by tonyztan 9y ago

dfox 9y ago
For me to some extent the fact that it is supposedly bad thing says more about the article author than about the firms that allowed that.
- blakesterz 9y ago
  That's what I thought too... like this quote: “Even letting people look at source code for a minute is incredibly dangerous,” said Steve Quane, executive vice president for network defense at Trend Micro, which sells TippingPoint security software to the U.S. military.
  - ineedasername 9y ago
    It can be dangerous... I once caught a glimpse of some befunge source code, and haven't had a sound night's sleep since.
- flatfilefan 9y ago
  When even a news agency cannot hide incompetence and bias the media has a problem.
- ineedasername 9y ago
  This was exactly my feeling. Especially so given that licenses for ERP software often include some form of source code access for the purpose of customization to organization needs. It's not open source, but much of the source is readily available. At a quick check, I have ready access to much source code through my support portal for the system used where I work.
blakesterz 9y ago
Would it also be fair to say most likely these same places (SAP, Symantec and McAfee) probably let other governments "probe" their software as well? I'd be surprised if 5 Eyes countries weren't all over it as well.
- auntienomen 9y ago
  You would hope so. Longstanding practice in crypto is to assume that 'the enemy knows the system'. It should apply here, as well.
cat199 9y ago
In other news: Thompson-reuters finds procedural flaw in outsourcing of critical software to uninterested 3rd party companies; uses to frame russia as malicious and and create lingering mental justification for trade embargoes
dsl 9y ago
"Probing" software in this context means doing security audits. Nothing would have stopped the Russians from breaking into a big company like Ford or General Electric and stealing a copy of the software for them to then look for vulnerabilities. This is like the Oracle rat hole where they tried to claim that security audits of their products could only be done with prior approval. That cat is way out of the bag.
ldiracdelta 9y ago
If the firms are allowed to sell their software to non-US entities, why would Russia buy it if they couldn't inspect it. We already know from Snowden that the United States Government tries to pwn the entire world. Why would they trust anything from the U.S.A. without doing a very careful code review and then compiling it themselves?

34 points by tonyztan 9y ago

dfox 9y ago

For me to some extent the fact that it is supposedly bad thing says more about the article author than about the firms that allowed that.

blakesterz 9y ago
That's what I thought too... like this quote: “Even letting people look at source code for a minute is incredibly dangerous,” said Steve Quane, executive vice president for network defense at Trend Micro, which sells TippingPoint security software to the U.S. military.
- ineedasername 9y ago
  It can be dangerous... I once caught a glimpse of some befunge source code, and haven't had a sound night's sleep since.
flatfilefan 9y ago
When even a news agency cannot hide incompetence and bias the media has a problem.
ineedasername 9y ago
This was exactly my feeling. Especially so given that licenses for ERP software often include some form of source code access for the purpose of customization to organization needs. It's not open source, but much of the source is readily available. At a quick check, I have ready access to much source code through my support portal for the system used where I work.

blakesterz 9y ago

Would it also be fair to say most likely these same places (SAP, Symantec and McAfee) probably let other governments "probe" their software as well? I'd be surprised if 5 Eyes countries weren't all over it as well.

auntienomen 9y ago
You would hope so. Longstanding practice in crypto is to assume that 'the enemy knows the system'. It should apply here, as well.

cat199 9y ago

In other news: Thompson-reuters finds procedural flaw in outsourcing of critical software to uninterested 3rd party companies; uses to frame russia as malicious and and create lingering mental justification for trade embargoes

dsl 9y ago

"Probing" software in this context means doing security audits. Nothing would have stopped the Russians from breaking into a big company like Ford or General Electric and stealing a copy of the software for them to then look for vulnerabilities. This is like the Oracle rat hole where they tried to claim that security audits of their products could only be done with prior approval. That cat is way out of the bag.

ldiracdelta 9y ago

If the firms are allowed to sell their software to non-US entities, why would Russia buy it if they couldn't inspect it. We already know from Snowden that the United States Government tries to pwn the entire world. Why would they trust anything from the U.S.A. without doing a very careful code review and then compiling it themselves?