4 ms·
> We have no real (at least not this in depth) assurance that products from rival vendors are more secure. This. Huawei may be bad but most embeded devices (ro
by KingMachiavelli 8y ago
> We have no real (at least not this in depth) assurance that products from rival vendors are more secure.
This. Huawei may be bad but most embeded devices (routers, switches, motherboards, etc) are just bad accross the board. The fact that embeded devices are treated like black boxes allows to ship messy code and out of date libraries. Hopefully, governments and companies will wise up and start demanding realeasing (a portion of) the source and/or requiring 3rd party audits/code review which would insentivize manufacturers to consolidate code bases and fix bugs not individual products.
- chousuke 8y agoI suspect using really old and shoddily cobbled together software is one of the reasons vendors usually don't like you looking under the hood. I recently figured out how to poweroff a brocade switch (there is no native command for it) and ended up enabling a hidden command that allowed me to run poweroff via bash. Bash was version 2.04, almost 20 years old! Now, it hopefully isn't used in any security-sensitive contexts to enable exploitation (or maybe it's a custom patched version), but it is sort of indicative of how these things get built.