4 ms·
To be fair, so is the US (NSA) , but people rarely suggest that packages from the US should be monitored extra closely for some reason. Of course every package
by tirpen 7y ago
To be fair, so is the US (NSA) , but people rarely suggest that packages from the US should be monitored extra closely for some reason.
Of course every package used in any code that contains sensitive data should be audited along with its dependant, but I see no reason to be more afraid of this particular package than anything people happily install from npm.
- cbnotfromthere 7y agoYou're equating a democracy with a totalitarian state.
- TomMarius 7y agoThere is not as much history of state inference in companies in the USA as there is in China
- StreamBright 7y agoGiven Snowden’s book and other leaks this is rather silly to claim.
- TomMarius 7y agoSnowden was not talking about forced state inference in companies like with e.g. Huawei or Alibaba or many other, even small Chinese companies. While it happens, it certainly does not happen that much (while it's normal occurence in China) and if the companies are forced to something, it's most of the time through a court.
- StreamBright 7y agohttps://www.bbc.com/news/world-europe-32542140 https://www.bbc.com/news/world-europe-32542140 https://theintercept.com/2014/12/13/belgacom-hack-gchq-inside-story/ https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid... https://en.wikipedia.org/wiki/Operation_Socialist https://en.wikipedia.org/wiki/Operation_Socialist https://www.infoworld.com/article/2608141/snowden--the-nsa-planted-backdoors-in-cisco-products.html https://www.infoworld.com/article/2608141/snowden--the-nsa-p...
- iudqnolq 7y agoTwo main reasons: better track record in the specific domain of forced modifications for intelligence collection, and US-based projects already have the same level of risk. I would assume that for sensitive Chinese projects US software is considered risky.
- Vesuvium 7y agoThere's a good reason for that: US does not really need to put backdoors in software to spy. They have the largest tech companies under their legislation and can already force them to disclose information on users. Most companies won't argue and hand over things silently. They have international agreements with a number of countries for surveillance. This means that unless an app is completely hosted, in all parts from source code to production, in a privacy-friendly country, on servers provided by a privacy-friendly company and the app is made by a company in similar conditions, the US and EU have all they need.
- jjeaff 7y agoWhile there have been some serious breaches of trust, US companies have a track record of fighting governments openly in court to avoid sharing data with them. Chinese companies absolutely do not have this track record. Chinese companies are essentially an extension of the heavy hand of the Chinese Communist Party.