4 ms·

is there any hard evidence that huawei is a legitimate security concern? Checking the wiki it seems like this is the commerce department trying to piss in the

is there any hard evidence that huawei is a legitimate security concern? Checking the wiki it seems like this is the commerce department trying to piss in the cheerios of a company that doesnt subscribe to the jackboot regimes of US foreign and copyright policy. theyve sold to iran, and have been accused of industrial espionage, but Symantec sold to iran and violated the GPL numerous times without so much as a scolding.

maccio92 8y ago
> jackboot regimes of US foreign and copyright policy protecting people's IP is now a "jackboot regime"?
- ionised 8y ago
  'Protecting people's IP' is an extremely charitable view of US copyright and IP policy.
JumpCrisscross 8y ago
> is there any hard evidence that huawei is a legitimate security concern? Yes, quite a bit [1]. Here’s an apolitical example: “In July 2012, Felix Lindner and Gregor Kopf gave a conference at Defcon to announce that they uncovered several critical vulnerabilities in Huawei routers (models AR18 and AR29)which could be used to get remote access to the device. The researchers said that Huawei ‘doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates’, and as a result, the vulnerabilities have not been publicly disclosed.” In summary, the best case is Huawei is incompetent. [1] https://en.m.wikipedia.org/wiki/Huawei#Controversies https://en.m.wikipedia.org/wiki/Huawei#Controversies
- neomax 8y ago
  It's one thing Huawei's products have severe vulnerabilities (as every other IT companies do), and another thing the company is actively engaging in espionage. If this is the best hard evidence the US can bring forward, then the whole allegation sounds entirely political-driven.
  - jchw 8y ago
    If you can't tell, does it matter? If you're hoping for espionage to be obvious and blatant, I think you must be underestimating people's creativity.
    - jake_the_third 8y ago
      Then we shouldn't deal with Cisco, Juniper, and pretty much every other network equipment manufacturer. What kind of logic is that?
      - jchw 8y ago
        Trust is not binary.
        jake_the_third 8y ago
        I fail to see how this ties into your original point.
      - adventured 8y ago
        It's this kind of logic: it depends on whether you believe the US is as big of a security or IP-theft threat to you as China is. Your premise relies on the US == China. If that isn't the case, your premise collapses in one form or another. Taiwan, Japan and South Korea aren't afraid of the US. They are afraid of China. Finland, Romania, Poland, Ukraine and Estonia aren't afraid the US will invade and annex their territory. They are afraid of Russia's territorial ambitions in Eastern Europe. For example, how do you think Australia feels about it right now? "China’s peak security agency has directed a surge in cyber attacks on Australian companies over the past year, breaching an agreement struck between Premier Li Keqiang and former Prime Minister Malcolm Turnbull to not steal each other’s commercial secrets." https://www.smh.com.au/business/companies/china-uses-the-cloud-to-step-up-spying-on-australian-business-20181119-p50gze.html https://www.smh.com.au/business/companies/china-uses-the-clo... "China reportedly steps up efforts to steal Australian company secrets" https://www.cnbc.com/2018/11/21/cybersecurity-china-reportedly-increased-attacks-on-australian-firms.html https://www.cnbc.com/2018/11/21/cybersecurity-china-reported...
- dnomad 8y ago
  If you think that demonstrates a legitimate security concern then every telecom manufacturer is a security concern. Spend some time comparing the known security issues with Huawei routers to Cisco's routers for example.
- charleslmunger 8y ago
  To be fair, their main competitor, Cisco, has had a significant number of hardcoded password backdoors found in their products. While their reporting and patching story is better, their security track record is still awful. It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco. The real difference would be if they were actively aiding espionage, which has been talked about a lot but never backed up with evidence. https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
  - JumpCrisscross 8y ago
    > It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco Given “Cisco [has previosuly] revealed parts of [an] independent expert's report produced for [a] case which proved that Huawei had stolen Cisco code and directly copied it into their products,” that wouldn’t be surprising. At the end of the day, you have a company with strong links (down to its founder) to the military of an adversarial dictatorship and which has been proven to have violated international sanctions with Iran, North Korea, Syria and Venezuela. This isn’t a “beyond reasonable doubt” criminal case. It’s a reasonable weighing of odds determination. [1] https://en.m.wikipedia.org/wiki/Huawei https://en.m.wikipedia.org/wiki/Huawei
    - jake_the_third 8y ago
      Then again, at the end of the day, you have companies with strong links to an adversarial government and which has been proven to have conducted economic espionage for the benefit of domestic companies, regularly violated (and violates) human rights, overthrown elected governments, invaded countries under false pretenses, and sentence people to death without a fair trial. If that's your line of logic, then there's more than enough shit to go around. Both sides are shitty. The point being made is that industry-level security is not real evidence of malicious behavior on huawei's part. If you want people to avoid huawei, present proof.
    - dnomad 8y ago
      > At the end of the day, you have a company with strong links (down to its founder) to the military This sort of pure propaganda just undermines your case. The founder of Huawei was never more than a low level engineer in the military, was forbidden from joining the CCP for many years [1]. [1] https://en.wikipedia.org/wiki/Ren_Zhengfei https://en.wikipedia.org/wiki/Ren_Zhengfei
neomax 8y ago
There is none in recent years. Huawei even offered to open its complete source code to the US government for inspection but got turned down. There is evidence that the US spy agency hacked in Huawei HQ for years and still the US cannot produce evidence of Huawei wrongdoing. But then again it's possible the US don't want to disclose it's intel source.
dnomad 8y ago
No, there's absolutely no evidence that Huawei equipment is a legitmate security concern. In fact it's just the opposite. Huawei equipment has been extensively and continuously studied by the best security researchers in the world. Britain, alone, spent roughly $25 million dollars going over all Huawei equipment with a fine tooth comb and their "big conclusion" was that they can only offer "limited assurances" of Huawei equipment [1]. USA and France and Germany and Brazil have also extensively analyzed Huawei equipment and come up with nothing. Ironically, as the discussion in India and Japan and the Phillipines now show, the Western obsession with Huawei and has only made the case for Huawei's equipment much, much stronger. [1] https://www.reuters.com/article/us-huawei-security-britain-exclusive/exclusive-britain-says-huawei-shortcomings-expose-new-telecom-networks-risks-idUSKBN1K92BX https://www.reuters.com/article/us-huawei-security-britain-e...
jake_the_third 8y ago
> is there any hard evidence that huawei is a legitimate security concern? As someone with a lot of huawei in their infrastructure, this is what I really want to know as well. The US government has lost a lot of credibility over the last few decades with its lopsided foreign policies that completely tip towards self-serving and agenda-pushing rather than decency and public good. There is nothing indicating that this particular issue is any different. Unless the US government shows hard evidence that the company is harming us, we're not ditching them. Innocent until proven guilty applies to entities you don't like too.
- e3b0c 8y ago
  The difference is when the US government does something nasty, it's relatively transparent and accountable. It is not the case for the China government.
  - jake_the_third 8y ago
    From where I'm sitting, both are not transparent and accountable.
    - e3b0c 8y ago
      Both Chinese and Americans can protest about the US government's scandals on an internet forum hosted on the US, not the other way around though.
      - RidingPegasus 8y ago
        Do you actually have any firsthand experience with Chinese internet culture? There's plenty of discontent and protestation about government policy, it's everywhere.
  - HillaryBriss 8y ago
    ... in other words, information about the nastiness is leaked
  - deleted 8y ago

maccio92 8y ago

> jackboot regimes of US foreign and copyright policy protecting people's IP is now a "jackboot regime"?

ionised 8y ago
'Protecting people's IP' is an extremely charitable view of US copyright and IP policy.

JumpCrisscross 8y ago

> is there any hard evidence that huawei is a legitimate security concern? Yes, quite a bit [1]. Here’s an apolitical example: “In July 2012, Felix Lindner and Gregor Kopf gave a conference at Defcon to announce that they uncovered several critical vulnerabilities in Huawei routers (models AR18 and AR29)which could be used to get remote access to the device. The researchers said that Huawei ‘doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates’, and as a result, the vulnerabilities have not been publicly disclosed.” In summary, the best case is Huawei is incompetent. [1] https://en.m.wikipedia.org/wiki/Huawei#Controversies https://en.m.wikipedia.org/wiki/Huawei#Controversies

neomax 8y ago
It's one thing Huawei's products have severe vulnerabilities (as every other IT companies do), and another thing the company is actively engaging in espionage. If this is the best hard evidence the US can bring forward, then the whole allegation sounds entirely political-driven.
- jchw 8y ago
  If you can't tell, does it matter? If you're hoping for espionage to be obvious and blatant, I think you must be underestimating people's creativity.
  - jake_the_third 8y ago
    Then we shouldn't deal with Cisco, Juniper, and pretty much every other network equipment manufacturer. What kind of logic is that?
    - jchw 8y ago
      Trust is not binary.
      - jake_the_third 8y ago
        I fail to see how this ties into your original point.
    - adventured 8y ago
      It's this kind of logic: it depends on whether you believe the US is as big of a security or IP-theft threat to you as China is. Your premise relies on the US == China. If that isn't the case, your premise collapses in one form or another. Taiwan, Japan and South Korea aren't afraid of the US. They are afraid of China. Finland, Romania, Poland, Ukraine and Estonia aren't afraid the US will invade and annex their territory. They are afraid of Russia's territorial ambitions in Eastern Europe. For example, how do you think Australia feels about it right now? "China’s peak security agency has directed a surge in cyber attacks on Australian companies over the past year, breaching an agreement struck between Premier Li Keqiang and former Prime Minister Malcolm Turnbull to not steal each other’s commercial secrets." https://www.smh.com.au/business/companies/china-uses-the-cloud-to-step-up-spying-on-australian-business-20181119-p50gze.html https://www.smh.com.au/business/companies/china-uses-the-clo... "China reportedly steps up efforts to steal Australian company secrets" https://www.cnbc.com/2018/11/21/cybersecurity-china-reportedly-increased-attacks-on-australian-firms.html https://www.cnbc.com/2018/11/21/cybersecurity-china-reported...
dnomad 8y ago
If you think that demonstrates a legitimate security concern then every telecom manufacturer is a security concern. Spend some time comparing the known security issues with Huawei routers to Cisco's routers for example.
charleslmunger 8y ago
To be fair, their main competitor, Cisco, has had a significant number of hardcoded password backdoors found in their products. While their reporting and patching story is better, their security track record is still awful. It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco. The real difference would be if they were actively aiding espionage, which has been talked about a lot but never backed up with evidence. https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
- JumpCrisscross 8y ago
  > It's believable that Huawei as awful security and backdoors, but that is just as bad as Cisco Given “Cisco [has previosuly] revealed parts of [an] independent expert's report produced for [a] case which proved that Huawei had stolen Cisco code and directly copied it into their products,” that wouldn’t be surprising. At the end of the day, you have a company with strong links (down to its founder) to the military of an adversarial dictatorship and which has been proven to have violated international sanctions with Iran, North Korea, Syria and Venezuela. This isn’t a “beyond reasonable doubt” criminal case. It’s a reasonable weighing of odds determination. [1] https://en.m.wikipedia.org/wiki/Huawei https://en.m.wikipedia.org/wiki/Huawei
  - jake_the_third 8y ago
    Then again, at the end of the day, you have companies with strong links to an adversarial government and which has been proven to have conducted economic espionage for the benefit of domestic companies, regularly violated (and violates) human rights, overthrown elected governments, invaded countries under false pretenses, and sentence people to death without a fair trial. If that's your line of logic, then there's more than enough shit to go around. Both sides are shitty. The point being made is that industry-level security is not real evidence of malicious behavior on huawei's part. If you want people to avoid huawei, present proof.
  - dnomad 8y ago
    > At the end of the day, you have a company with strong links (down to its founder) to the military This sort of pure propaganda just undermines your case. The founder of Huawei was never more than a low level engineer in the military, was forbidden from joining the CCP for many years [1]. [1] https://en.wikipedia.org/wiki/Ren_Zhengfei https://en.wikipedia.org/wiki/Ren_Zhengfei

neomax 8y ago

There is none in recent years. Huawei even offered to open its complete source code to the US government for inspection but got turned down. There is evidence that the US spy agency hacked in Huawei HQ for years and still the US cannot produce evidence of Huawei wrongdoing. But then again it's possible the US don't want to disclose it's intel source.

dnomad 8y ago

No, there's absolutely no evidence that Huawei equipment is a legitmate security concern. In fact it's just the opposite. Huawei equipment has been extensively and continuously studied by the best security researchers in the world. Britain, alone, spent roughly $25 million dollars going over all Huawei equipment with a fine tooth comb and their "big conclusion" was that they can only offer "limited assurances" of Huawei equipment [1]. USA and France and Germany and Brazil have also extensively analyzed Huawei equipment and come up with nothing. Ironically, as the discussion in India and Japan and the Phillipines now show, the Western obsession with Huawei and has only made the case for Huawei's equipment much, much stronger. [1] https://www.reuters.com/article/us-huawei-security-britain-exclusive/exclusive-britain-says-huawei-shortcomings-expose-new-telecom-networks-risks-idUSKBN1K92BX https://www.reuters.com/article/us-huawei-security-britain-e...

jake_the_third 8y ago

> is there any hard evidence that huawei is a legitimate security concern? As someone with a lot of huawei in their infrastructure, this is what I really want to know as well. The US government has lost a lot of credibility over the last few decades with its lopsided foreign policies that completely tip towards self-serving and agenda-pushing rather than decency and public good. There is nothing indicating that this particular issue is any different. Unless the US government shows hard evidence that the company is harming us, we're not ditching them. Innocent until proven guilty applies to entities you don't like too.

e3b0c 8y ago
The difference is when the US government does something nasty, it's relatively transparent and accountable. It is not the case for the China government.
- jake_the_third 8y ago
  From where I'm sitting, both are not transparent and accountable.
  - e3b0c 8y ago
    Both Chinese and Americans can protest about the US government's scandals on an internet forum hosted on the US, not the other way around though.
    - RidingPegasus 8y ago
      Do you actually have any firsthand experience with Chinese internet culture? There's plenty of discontent and protestation about government policy, it's everywhere.
- HillaryBriss 8y ago
  ... in other words, information about the nastiness is leaked
- deleted 8y ago