5 ms·

Fascinating, so China will be the #1 supporter of open source software? All their code must be open sourced, in order to win foreign contracts. And all it took

Fascinating, so China will be the #1 supporter of open source software? All their code must be open sourced, in order to win foreign contracts. And all it took was a little trade war.

yorwba 7y ago
Not open source, just available for review by government agencies. The UK's Huawei Cyber Security Evaluation Centre has had access to Huawei's source for a while now, and has been complaining about bugs for about as long. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2019 https://www.gov.uk/government/publications/huawei-cyber-secu...
- ngcc_hk 7y ago
  Hardware open sourced and audited ? Are you joking ? They can be changed by a fix and it is networked. Also vulnerability is another vector. You concentrate on what you know but not others left open is very hard to know.
- blackrock 7y ago
  This is actually even more interesting. Now, China can get buy-in from the UK. The two are basically married now. Huawei can require that the UK certifies the source code, and to even do the actual compilation step itself, and to sign the final executable programs and configuration files. At which point, the binaries are created, and the UK will have a cryptographic signature of the file. Thus the binary is now cryptographically secured, that even China, with their mysterious black magic, cannot break the mathematical and thermodynamic laws of nature. /s The UK team then approves this binary, and allows Huawei to begin mass installation on the hardware via firmware flashing. Then Huawei will initiate mass production, and begin shipping out the hardware to worldwide customers. Then the UK can post-certify that the same source code that they compiled and published, is the exact same code that is in the hardware. The same process can be done for continuing code updates. Huawei can mandate that the UK provides a team to do the final compilation and verification step, and this team must promise (by penalty of law) to remove themselves from any conflict of interest, meaning they cannot work on similar technologies in the future, to compete against Huawei. It’s like a non-compete agreement. And they also cannot disclose any Huawei trade secrets, or algorithmic details of Huawei’s 5G hardware. Their responsibility is to just ensure security, and do penetration testing for security weaknesses. And China can even mandate that the UK team relocate to China, to view the source code onsite. And they can even run this for all hardware blueprints too. And monitor the code that also goes into the other chips on the SoC motherboard. Then Huawei and China can claim that the code was validated by the UK itself, and here’s the genuine certification ID. And that it’s free of any known defects or spyware code.

Fascinating, so China will be the #1 supporter of open source software? All their code must be open sourced, in order to win foreign contracts. And all it took was a little trade war.

yorwba 7y ago

Not open source, just available for review by government agencies. The UK's Huawei Cyber Security Evaluation Centre has had access to Huawei's source for a while now, and has been complaining about bugs for about as long. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2019 https://www.gov.uk/government/publications/huawei-cyber-secu...

ngcc_hk 7y ago
Hardware open sourced and audited ? Are you joking ? They can be changed by a fix and it is networked. Also vulnerability is another vector. You concentrate on what you know but not others left open is very hard to know.
blackrock 7y ago
This is actually even more interesting. Now, China can get buy-in from the UK. The two are basically married now. Huawei can require that the UK certifies the source code, and to even do the actual compilation step itself, and to sign the final executable programs and configuration files. At which point, the binaries are created, and the UK will have a cryptographic signature of the file. Thus the binary is now cryptographically secured, that even China, with their mysterious black magic, cannot break the mathematical and thermodynamic laws of nature. /s The UK team then approves this binary, and allows Huawei to begin mass installation on the hardware via firmware flashing. Then Huawei will initiate mass production, and begin shipping out the hardware to worldwide customers. Then the UK can post-certify that the same source code that they compiled and published, is the exact same code that is in the hardware. The same process can be done for continuing code updates. Huawei can mandate that the UK provides a team to do the final compilation and verification step, and this team must promise (by penalty of law) to remove themselves from any conflict of interest, meaning they cannot work on similar technologies in the future, to compete against Huawei. It’s like a non-compete agreement. And they also cannot disclose any Huawei trade secrets, or algorithmic details of Huawei’s 5G hardware. Their responsibility is to just ensure security, and do penetration testing for security weaknesses. And China can even mandate that the UK team relocate to China, to view the source code onsite. And they can even run this for all hardware blueprints too. And monitor the code that also goes into the other chips on the SoC motherboard. Then Huawei and China can claim that the code was validated by the UK itself, and here’s the genuine certification ID. And that it’s free of any known defects or spyware code.