5 ms·

It's not actually been accused, has it? The proposed rules are on the basis of hypothetical future spying capabilities. (Personally and technically, I don't t

by ethbro 7y ago

It's not actually been accused, has it? The proposed rules are on the basis of hypothetical future spying capabilities. (Personally and technically, I don't think the ban is a terrible idea. Non-audited software, from a country without an independent legal system, running on privileged network hardware seems a reasonable concern. Especially deployed by rural ISPs who can't perform security due diligence. Even if the public debate is being framed poorly)

tyingq 7y ago
It is at least not hypothetical for the US. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
- ethbro 7y ago
  The US NSA TAO implants are a bit different ball of wax. Fundamentally, they illustrate that the NSA (government) can't / won't ask Cisco (vendor) to directly install backdoors for them. So in many ways a validation that checks and balances are working as intended, whatever you think of TAO separately, if supply chain interdiction is required. The Huawei bans are predicated on the belief that Huawei is not an independent vendor, separate from the interests of the mainland Chinese government.
  - tyingq 7y ago
    Sure. But, of course, most cell phones and network equipment is made in China. Vendor cooperation doesn't seem to be needed.
    - ethbro 7y ago
      This is an argument of nuances, but I would make the point that the design and software / firmware stages provide fundamentally different capabilities than manufacturing. You have entire industries around supply chain assurance, so manufacturing corruption is still an issue (although usually more targeted at lower-cost, replaced components). But as the post-SuperMicro reporting laid out, it's an order of magnitude more difficult to embed physical components on a board, in an undetected manner, that create covert communication channels. Vs doing so at privileged software layers.
  - tqkxzugoaupvwqr 7y ago
    Cisco was repeatedly caught hardcoding username+password into devices/software. Repeatedly as in “They never seem to learn from their mistakes”. I simply cannot believe Cisco as large vendor will make the same mistakes over and over again. It’s like they try to sneak backdoors into their products, get called out, but continue, yet no one ever cries that the US is spying. Probably because the other four eyes profit from it, as well as some other western countries that have intelligence-sharing deals with US intelligence agencies. Huawei is only called out because their backdoors (… if any exist at all) are not our backdoors.

by ethbro 7y ago

tyingq 7y ago

It is at least not hypothetical for the US. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

ethbro 7y ago
The US NSA TAO implants are a bit different ball of wax. Fundamentally, they illustrate that the NSA (government) can't / won't ask Cisco (vendor) to directly install backdoors for them. So in many ways a validation that checks and balances are working as intended, whatever you think of TAO separately, if supply chain interdiction is required. The Huawei bans are predicated on the belief that Huawei is not an independent vendor, separate from the interests of the mainland Chinese government.
- tyingq 7y ago
  Sure. But, of course, most cell phones and network equipment is made in China. Vendor cooperation doesn't seem to be needed.
  - ethbro 7y ago
    This is an argument of nuances, but I would make the point that the design and software / firmware stages provide fundamentally different capabilities than manufacturing. You have entire industries around supply chain assurance, so manufacturing corruption is still an issue (although usually more targeted at lower-cost, replaced components). But as the post-SuperMicro reporting laid out, it's an order of magnitude more difficult to embed physical components on a board, in an undetected manner, that create covert communication channels. Vs doing so at privileged software layers.
- tqkxzugoaupvwqr 7y ago
  Cisco was repeatedly caught hardcoding username+password into devices/software. Repeatedly as in “They never seem to learn from their mistakes”. I simply cannot believe Cisco as large vendor will make the same mistakes over and over again. It’s like they try to sneak backdoors into their products, get called out, but continue, yet no one ever cries that the US is spying. Probably because the other four eyes profit from it, as well as some other western countries that have intelligence-sharing deals with US intelligence agencies. Huawei is only called out because their backdoors (… if any exist at all) are not our backdoors.