3 ms·

As I understand it, the issue is not whether Huawei radically worse/better than other competitors. The issue is whether the code is of high enough quality that

As I understand it, the issue is not whether Huawei radically worse/better than other competitors. The issue is whether the code is of high enough quality that UK auditors can perform additional verification that it's safe to use. To provide some context for this, UK officials have a real (and reasonable) concern that building out their 5G infrastructure with Huawei equipment will expose them to attacks by the Chinese government. They have this fear because this is exactly the sort of thing that the "Five Eyes" nations (including the UK) have been doing to other nations. (You can argue about right and wrong and hypocrisy, but at the end of the day those arguments aren't going to make the UK's concerns illegitimate, and they won't assuage those concerns.) At the same time, UK companies want to take advantage of the cost savings they can get from deploying Huawei equipment. To try and square this circle, the UK government established a local cybersecurity operation dedicated reviewing Huawei's software. This organization -- composed of UK citizens, some with security clearance, and overseen by NCSC -- was supposed to resolve these concerns by performing deep source audits of Huawei products before they were deployed. The problem that inspired this article is that Huawei's software is not of high enough quality to make this kind of "trust but verify" review work. So the compromise isn't functioning, and this article is someone ringing the alarm bell. Is Huawei's stuff radically worse than other vendors'? Maybe, maybe not. Is it true that Huawei is being held to a higher code-quality standard than, say, Cisco just because the UK feels that's the only safe way to bring a nation-state competitors' software/hardware into their critical infrastructure? Absolutely yes, that is true. In some abstract sense it's also unfair. However, is the UK wrong to ask for this? I can't really say that they are. Sometimes life isn't fair. These are nation states trying to protect themselves from non-theoretical risks, and Huawei happens to be caught in the middle. What's important is that these complaints about code quality should not be read as claims that Huawei is backdooring their software. They should instead be read as arguments that Huawei needs to significantly up their code quality game if they want access to these big markets.

dangerface 7y ago
I agree with what you said, as a UK citizen I do worry about other countries spying on me in the same way that the UK spys on them. I want our infrastructure to be secure but a biased evaluation will give biased results not secure ones. If the UK was really worried about foreign powers invading their infrastructure(they should be) the real solution is to evaluate the security of that infrastructure (anything foreign in an unbiased way) or roll your own. Instead of doing this we play security pantomime with no more substance than "maybe the chinks are up to something?" thats not security its the government trying to make the public feel safe, and it's a massive failing of my nanny state government. Cut GCHQ budget pour it into rolling our own silicon thats how to protect UK infrastructure and economy.

dangerface 7y ago

I agree with what you said, as a UK citizen I do worry about other countries spying on me in the same way that the UK spys on them. I want our infrastructure to be secure but a biased evaluation will give biased results not secure ones. If the UK was really worried about foreign powers invading their infrastructure(they should be) the real solution is to evaluate the security of that infrastructure (anything foreign in an unbiased way) or roll your own. Instead of doing this we play security pantomime with no more substance than "maybe the chinks are up to something?" thats not security its the government trying to make the public feel safe, and it's a massive failing of my nanny state government. Cut GCHQ budget pour it into rolling our own silicon thats how to protect UK infrastructure and economy.