4 ms·

Nope so far the people criticising Huawei have not provided any evidence of malpractice. Huawei on the other hand have been very open and review by independent

Nope so far the people criticising Huawei have not provided any evidence of malpractice. Huawei on the other hand have been very open and review by independent third party auditors [1]. When you consider that the only one in the world who seems to have a problem with Huawei security is NSA and GCHQ who have both encouraged the use of broken security so that they can hack their own citizens I think its clear this is just baseless western propaganda. [1] https://disruptive.asia/huawei-german-source-code-review-lab/ https://disruptive.asia/huawei-german-source-code-review-lab...

colinb 7y ago
I don't think your first sentence is true [1]. Though I admit that there's no such thing as unbiased reporting. [1] https://news.ycombinator.com/item?id=19612473 https://news.ycombinator.com/item?id=19612473
- dangerface 7y ago
  Thanks thats a much better article with some evidence of poor security. But I still feel the GCHQ claims are not substantiated enough, for example the criticism that they don't use reproducible builds, fair enough but then who does outside open source? For GCHQ to exaggerate this as shoddy I think shows the true intentions of the review.
Para2016 7y ago
I don't want my data siphoned or even sampled by the CCP who controls their own Han Chinese citizens with surveillance AI. Or a regime that imprisons the Falun Gong, Uighur, or political dissidents. If you think this is some nonsense Western propaganda then it's simple, you're a collaborationist. I work with plenty of Chinese nationals who confirm all of what is said by Western "propaganda". One of them from a very well off family actually said "how much freedom do people actually need"? So, if I have to live in a world that picks NSA surveillance or Chinese surveillance, then I choose NSA.
matthewdgreen 7y ago
As I understand it, the issue is not whether Huawei radically worse/better than other competitors. The issue is whether the code is of high enough quality that UK auditors can perform additional verification that it's safe to use. To provide some context for this, UK officials have a real (and reasonable) concern that building out their 5G infrastructure with Huawei equipment will expose them to attacks by the Chinese government. They have this fear because this is exactly the sort of thing that the "Five Eyes" nations (including the UK) have been doing to other nations. (You can argue about right and wrong and hypocrisy, but at the end of the day those arguments aren't going to make the UK's concerns illegitimate, and they won't assuage those concerns.) At the same time, UK companies want to take advantage of the cost savings they can get from deploying Huawei equipment. To try and square this circle, the UK government established a local cybersecurity operation dedicated reviewing Huawei's software. This organization -- composed of UK citizens, some with security clearance, and overseen by NCSC -- was supposed to resolve these concerns by performing deep source audits of Huawei products before they were deployed. The problem that inspired this article is that Huawei's software is not of high enough quality to make this kind of "trust but verify" review work. So the compromise isn't functioning, and this article is someone ringing the alarm bell. Is Huawei's stuff radically worse than other vendors'? Maybe, maybe not. Is it true that Huawei is being held to a higher code-quality standard than, say, Cisco just because the UK feels that's the only safe way to bring a nation-state competitors' software/hardware into their critical infrastructure? Absolutely yes, that is true. In some abstract sense it's also unfair. However, is the UK wrong to ask for this? I can't really say that they are. Sometimes life isn't fair. These are nation states trying to protect themselves from non-theoretical risks, and Huawei happens to be caught in the middle. What's important is that these complaints about code quality should not be read as claims that Huawei is backdooring their software. They should instead be read as arguments that Huawei needs to significantly up their code quality game if they want access to these big markets.
- dangerface 7y ago
  I agree with what you said, as a UK citizen I do worry about other countries spying on me in the same way that the UK spys on them. I want our infrastructure to be secure but a biased evaluation will give biased results not secure ones. If the UK was really worried about foreign powers invading their infrastructure(they should be) the real solution is to evaluate the security of that infrastructure (anything foreign in an unbiased way) or roll your own. Instead of doing this we play security pantomime with no more substance than "maybe the chinks are up to something?" thats not security its the government trying to make the public feel safe, and it's a massive failing of my nanny state government. Cut GCHQ budget pour it into rolling our own silicon thats how to protect UK infrastructure and economy.

colinb 7y ago

I don't think your first sentence is true [1]. Though I admit that there's no such thing as unbiased reporting. [1] https://news.ycombinator.com/item?id=19612473 https://news.ycombinator.com/item?id=19612473

dangerface 7y ago
Thanks thats a much better article with some evidence of poor security. But I still feel the GCHQ claims are not substantiated enough, for example the criticism that they don't use reproducible builds, fair enough but then who does outside open source? For GCHQ to exaggerate this as shoddy I think shows the true intentions of the review.

Para2016 7y ago

I don't want my data siphoned or even sampled by the CCP who controls their own Han Chinese citizens with surveillance AI. Or a regime that imprisons the Falun Gong, Uighur, or political dissidents. If you think this is some nonsense Western propaganda then it's simple, you're a collaborationist. I work with plenty of Chinese nationals who confirm all of what is said by Western "propaganda". One of them from a very well off family actually said "how much freedom do people actually need"? So, if I have to live in a world that picks NSA surveillance or Chinese surveillance, then I choose NSA.

matthewdgreen 7y ago

As I understand it, the issue is not whether Huawei radically worse/better than other competitors. The issue is whether the code is of high enough quality that UK auditors can perform additional verification that it's safe to use. To provide some context for this, UK officials have a real (and reasonable) concern that building out their 5G infrastructure with Huawei equipment will expose them to attacks by the Chinese government. They have this fear because this is exactly the sort of thing that the "Five Eyes" nations (including the UK) have been doing to other nations. (You can argue about right and wrong and hypocrisy, but at the end of the day those arguments aren't going to make the UK's concerns illegitimate, and they won't assuage those concerns.) At the same time, UK companies want to take advantage of the cost savings they can get from deploying Huawei equipment. To try and square this circle, the UK government established a local cybersecurity operation dedicated reviewing Huawei's software. This organization -- composed of UK citizens, some with security clearance, and overseen by NCSC -- was supposed to resolve these concerns by performing deep source audits of Huawei products before they were deployed. The problem that inspired this article is that Huawei's software is not of high enough quality to make this kind of "trust but verify" review work. So the compromise isn't functioning, and this article is someone ringing the alarm bell. Is Huawei's stuff radically worse than other vendors'? Maybe, maybe not. Is it true that Huawei is being held to a higher code-quality standard than, say, Cisco just because the UK feels that's the only safe way to bring a nation-state competitors' software/hardware into their critical infrastructure? Absolutely yes, that is true. In some abstract sense it's also unfair. However, is the UK wrong to ask for this? I can't really say that they are. Sometimes life isn't fair. These are nation states trying to protect themselves from non-theoretical risks, and Huawei happens to be caught in the middle. What's important is that these complaints about code quality should not be read as claims that Huawei is backdooring their software. They should instead be read as arguments that Huawei needs to significantly up their code quality game if they want access to these big markets.

dangerface 7y ago
I agree with what you said, as a UK citizen I do worry about other countries spying on me in the same way that the UK spys on them. I want our infrastructure to be secure but a biased evaluation will give biased results not secure ones. If the UK was really worried about foreign powers invading their infrastructure(they should be) the real solution is to evaluate the security of that infrastructure (anything foreign in an unbiased way) or roll your own. Instead of doing this we play security pantomime with no more substance than "maybe the chinks are up to something?" thats not security its the government trying to make the public feel safe, and it's a massive failing of my nanny state government. Cut GCHQ budget pour it into rolling our own silicon thats how to protect UK infrastructure and economy.