4 ms·

> I see people on HN defending Zoom all the time. > its product development has been based in China, and that some Zoom calls were accidentally routed through

by est 6y ago

> I see people on HN defending Zoom all the time. > its product development has been based in China, and that some Zoom calls were accidentally routed through Chinese servers. Curious, did you background check every employee/contractor to make sure they are Chinese race free? Did you do every byte of your network traffic audit to make sure they are not Chinese IP routable? How often do you update your firewall rules? Because if you don't do either of these, if you run a successful company, someone will write an article to complain you have employed a Chinese developer and routed traffic to China.

johncolanduoni 6y ago
There’s a big difference between routing an encrypted packet through China and decrypting that packet on a server located in China. Likewise, there’s a big difference between employing a Chinese national in the US and having a large part of you engineering organization operate from within China.
- est 6y ago
  > having a large part of you engineering organization operate from within China Shockingly, Microsoft, Google, Facebook, IBM, Redhat, Cisco all have engineering team in mainland China. Do a job list search please. > decrypting that packet on a server located in China In your infrastructure setup, for hostnames in a cluster, how do you separate China servers and non-China servers? Do you put a subdomain or something? And how do you link user's nationality to which server they are supposed to connect to? What if there's a US hosted meeting, a mainland Chinese user joins the meeting? Is it an ethical thing to happen? Should the packet decrypting happen in a US server? China server? or server located in a third neutral country instead? What if a US citizen joins a mainland Chinese hosted meeting? Is it wrong for Zoom to decrypt packets in China?
  - microcolonel 6y ago
    > In your infrastructure setup, for hostnames in a cluster, how do you separate China servers and non-China servers? Do you put a subdomain or something? Yes, these are exactly the sorts of things one does. The PRC is so distinct in terms of legal norms that servers hosted there need to be treated differently. If PRC would adhere to the legal norms of most of the rest of the world, and stop trying to start a cold war with the U.S, this would not be necessary. > And how do you link user's nationality to which server they are supposed to connect to? It's not so much about nationality, but about jurisdiction. For calls where no participants' connections originate from a PRC IP block, don't use the PRC infrastructure. For calls where at least one connection originates from the PRC, terminate the call wherever meets the legal requirements (that PRC participant may have special obligations to their government) and is technically convenient. It's not really that hard. > What if a US citizen joins a mainland Chinese hosted meeting? Is it wrong for Zoom to decrypt packets in China? Again, it is not a matter of citizenship, but of jurisdiction. If the call is hosted in PRC, that's not even a question; if PLA asks, you must decrypt the packets on the host, or at least provide keys. In each case, you bring up nationality or citizenship, but when it comes to these scenarios, these are not relevant. Chinese nationals legally present in U.S. jurisdiction have most of the same rights as U.S. citizens, and all of the same legal obligations. In terms of obligations, the same is true in PRC: if you are present in PRC, you are obligated to follow the PRC's law, whether or not you are a national.
    - est 6y ago
      That's what happens when a lawyer designs IM/conf app. Follow your design, the switches/routers need to confirm the "jurisdiction" of each TCP/IP packet? What wonderful idea, please do submit your RFC to IETF. > but about jurisdiction. For calls where no participants' connections originate from a PRC IP block, don't use the PRC infrastructure. That's basically where the Chinese got the idea of building the Great Firewall started. Some IP addresses are from evil capitalist USA and need to be filtered.
microcolonel 6y ago
> Curious, did you background check every employee/contractor to make sure they are Chinese race free? That's immoral, illegal, and silly; effectively nobody is doing this, and if most people found out about that, they would try to put a stop to it. The PRC is a state, that state does not have a monopoly on representing any race. This is not a Chinese people problem, it's a CCP problem. Chinese people in the ROC don't do this sort of thing. 這不是華人的問題，這是中共的問題啊。中華民國的華人不這樣做。 > Do you audit every every byte of your network traffic to make sure it is not Chinese IP routable? How often do you update your firewall rules? Yes, I operate servers and routers that simply do not route to or from PRC IP blocks. It's often the right thing to do, given that “reputable” server operators like Baidu seem to be the source of a huge proportion of the impersonation and spam, and often zero legitimate connections. When I get DMARC reports, more than half of the reports are PRC IPs impersonating my mail host, hopefully for reflection rather than full-on impersonation.
- est 6y ago
  > effectively nobody is doing this effectively every US media is name calling companies/universities who have a slightest business with China or Chinese people.
  - microcolonel 6y ago
    > effectively every US media is name calling companies/universities who have a slightest business with China or Chinese people. Business with PRC and business with Chinese people are separate matters. I don't know of any North American university that doesn't have "the slightest business" with Chinese people; and "effectively every U.S. media" is not "name calling" them all. What I have seen, is a select few journalists reporting on the proven PRC-funded academic espionage schemes, where the PRC is illegally bribing academics to privately provide advance copies of U.S. government funded research. The coverage of this has been sparse, and there are whole major outlets who simply have not mentioned it.

by est 6y ago

johncolanduoni 6y ago

There’s a big difference between routing an encrypted packet through China and decrypting that packet on a server located in China. Likewise, there’s a big difference between employing a Chinese national in the US and having a large part of you engineering organization operate from within China.

est 6y ago
> having a large part of you engineering organization operate from within China Shockingly, Microsoft, Google, Facebook, IBM, Redhat, Cisco all have engineering team in mainland China. Do a job list search please. > decrypting that packet on a server located in China In your infrastructure setup, for hostnames in a cluster, how do you separate China servers and non-China servers? Do you put a subdomain or something? And how do you link user's nationality to which server they are supposed to connect to? What if there's a US hosted meeting, a mainland Chinese user joins the meeting? Is it an ethical thing to happen? Should the packet decrypting happen in a US server? China server? or server located in a third neutral country instead? What if a US citizen joins a mainland Chinese hosted meeting? Is it wrong for Zoom to decrypt packets in China?
- microcolonel 6y ago
  > In your infrastructure setup, for hostnames in a cluster, how do you separate China servers and non-China servers? Do you put a subdomain or something? Yes, these are exactly the sorts of things one does. The PRC is so distinct in terms of legal norms that servers hosted there need to be treated differently. If PRC would adhere to the legal norms of most of the rest of the world, and stop trying to start a cold war with the U.S, this would not be necessary. > And how do you link user's nationality to which server they are supposed to connect to? It's not so much about nationality, but about jurisdiction. For calls where no participants' connections originate from a PRC IP block, don't use the PRC infrastructure. For calls where at least one connection originates from the PRC, terminate the call wherever meets the legal requirements (that PRC participant may have special obligations to their government) and is technically convenient. It's not really that hard. > What if a US citizen joins a mainland Chinese hosted meeting? Is it wrong for Zoom to decrypt packets in China? Again, it is not a matter of citizenship, but of jurisdiction. If the call is hosted in PRC, that's not even a question; if PLA asks, you must decrypt the packets on the host, or at least provide keys. In each case, you bring up nationality or citizenship, but when it comes to these scenarios, these are not relevant. Chinese nationals legally present in U.S. jurisdiction have most of the same rights as U.S. citizens, and all of the same legal obligations. In terms of obligations, the same is true in PRC: if you are present in PRC, you are obligated to follow the PRC's law, whether or not you are a national.
  - est 6y ago
    That's what happens when a lawyer designs IM/conf app. Follow your design, the switches/routers need to confirm the "jurisdiction" of each TCP/IP packet? What wonderful idea, please do submit your RFC to IETF. > but about jurisdiction. For calls where no participants' connections originate from a PRC IP block, don't use the PRC infrastructure. That's basically where the Chinese got the idea of building the Great Firewall started. Some IP addresses are from evil capitalist USA and need to be filtered.

microcolonel 6y ago

> Curious, did you background check every employee/contractor to make sure they are Chinese race free? That's immoral, illegal, and silly; effectively nobody is doing this, and if most people found out about that, they would try to put a stop to it. The PRC is a state, that state does not have a monopoly on representing any race. This is not a Chinese people problem, it's a CCP problem. Chinese people in the ROC don't do this sort of thing. 這不是華人的問題，這是中共的問題啊。中華民國的華人不這樣做。 > Do you audit every every byte of your network traffic to make sure it is not Chinese IP routable? How often do you update your firewall rules? Yes, I operate servers and routers that simply do not route to or from PRC IP blocks. It's often the right thing to do, given that “reputable” server operators like Baidu seem to be the source of a huge proportion of the impersonation and spam, and often zero legitimate connections. When I get DMARC reports, more than half of the reports are PRC IPs impersonating my mail host, hopefully for reflection rather than full-on impersonation.

est 6y ago
> effectively nobody is doing this effectively every US media is name calling companies/universities who have a slightest business with China or Chinese people.
- microcolonel 6y ago
  > effectively every US media is name calling companies/universities who have a slightest business with China or Chinese people. Business with PRC and business with Chinese people are separate matters. I don't know of any North American university that doesn't have "the slightest business" with Chinese people; and "effectively every U.S. media" is not "name calling" them all. What I have seen, is a select few journalists reporting on the proven PRC-funded academic espionage schemes, where the PRC is illegally bribing academics to privately provide advance copies of U.S. government funded research. The coverage of this has been sparse, and there are whole major outlets who simply have not mentioned it.