4 ms·

You don't need a whitepaper to say "Any device with over-the-air updates (or server-side processing) controlled by a Chinese company can receive anytime new sof

by ovi256 7y ago

You don't need a whitepaper to say "Any device with over-the-air updates (or server-side processing) controlled by a Chinese company can receive anytime new software (thus a payload) controlled by the Chinese intelligence services". This is what's implied.

vkou 7y ago
This is a great argument against all OTA devices. But if the US actually took that threat seriously, half of the Valley would be out of a job tomorrow.
- howard941 7y ago
  > This is a great argument against all OTA devices Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update. [0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing
  - beenBoutIT 7y ago
    It's a great argument for devices made in the US. We can't trust Chinese tech yet we don't make our own.
close04 7y ago
It feels more likely to imply that "we have no hard evidence". So the argument still boils down to "because China", not "because spying". Which isn't a strong argument if you like to (at least try to) draw your own conclusion and not be fed one. Are you worried that your iPhone or Tesla will be hijacked the same way? You already know this happened before with the knowledge of the companies involved (secret subpoenas or national security letters) or without it (beacon implants).
- Tsubasachan 7y ago
  Lets be real here "because China" is a decent enough argument in the US at the moment. Just swallow the propaganda.
- CharlesColeman 7y ago
  > It feels more likely to imply that "we have no hard evidence". There is hard evidence of the vulnerability, which logically follows from any OTA update capability, but there may be no hard evidence of exploitation yet. Think of it this way: if your software has a RCE, you fix or mitigate it regardless if it's actively being exploited or not. > Are you worried that your iPhone or Tesla will be hijacked the same way? That's a very valid concern for some people. Ultimately, software security boils down to "who do you trust?". Say what you will about the US, but your goals and values are very likely less incompatible with those of the US than with those of authoritarian China [1] [2]. [1] https://www.nytimes.com/2013/08/20/world/asia/chinas-new-leadership-takes-hard-line-in-secret-memo.html https://www.nytimes.com/2013/08/20/world/asia/chinas-new-lea... [2] https://en.wikipedia.org/wiki/Document_Number_Nine https://en.wikipedia.org/wiki/Document_Number_Nine
  - close04 7y ago
    The lesser evil. The enemy of my enemy is my friend. History is full of examples where people followed short term aligned interests straight into long term suffering. Do you think it's more about your values or somebody's ego and interests?

by ovi256 7y ago

vkou 7y ago

This is a great argument against all OTA devices. But if the US actually took that threat seriously, half of the Valley would be out of a job tomorrow.

howard941 7y ago
> This is a great argument against all OTA devices Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update. [0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing
- beenBoutIT 7y ago
  It's a great argument for devices made in the US. We can't trust Chinese tech yet we don't make our own.

close04 7y ago

It feels more likely to imply that "we have no hard evidence". So the argument still boils down to "because China", not "because spying". Which isn't a strong argument if you like to (at least try to) draw your own conclusion and not be fed one. Are you worried that your iPhone or Tesla will be hijacked the same way? You already know this happened before with the knowledge of the companies involved (secret subpoenas or national security letters) or without it (beacon implants).

Tsubasachan 7y ago
Lets be real here "because China" is a decent enough argument in the US at the moment. Just swallow the propaganda.
CharlesColeman 7y ago
> It feels more likely to imply that "we have no hard evidence". There is hard evidence of the vulnerability, which logically follows from any OTA update capability, but there may be no hard evidence of exploitation yet. Think of it this way: if your software has a RCE, you fix or mitigate it regardless if it's actively being exploited or not. > Are you worried that your iPhone or Tesla will be hijacked the same way? That's a very valid concern for some people. Ultimately, software security boils down to "who do you trust?". Say what you will about the US, but your goals and values are very likely less incompatible with those of the US than with those of authoritarian China [1] [2]. [1] https://www.nytimes.com/2013/08/20/world/asia/chinas-new-leadership-takes-hard-line-in-secret-memo.html https://www.nytimes.com/2013/08/20/world/asia/chinas-new-lea... [2] https://en.wikipedia.org/wiki/Document_Number_Nine https://en.wikipedia.org/wiki/Document_Number_Nine
- close04 7y ago
  The lesser evil. The enemy of my enemy is my friend. History is full of examples where people followed short term aligned interests straight into long term suffering. Do you think it's more about your values or somebody's ego and interests?