7 ms·

How is security taken care of when contributions are being done by Huawei (backdoors in 41k lines of sourcode?)? But I am guessing there is no real fight betwee

How is security taken care of when contributions are being done by Huawei (backdoors in 41k lines of sourcode?)? But I am guessing there is no real fight between open source software and state actors - perhaps someone who knows more about the security of the kernel can comment.

harikb 6y ago
If a state actor really wants to do it and someone could get it past reviews, I am sure they could bribe any contributor from any country (including US). Why single out China? We never raised concerns with Russian contributors.
- deleted 6y ago
  [deleted]
- b0rsuk 6y ago
  Maybe not single out China, but many people think China is particularly untrustworthy: they insist Chinese law is used outside China, and lecture people how they should refer to China in public; they operate concentration camps; the Chinese language has no word for *mutuality*, China benefits from free speech and access to institutions in the West but doesn't allow the same in China for journalists or businessmen; China treats Chinese-speaking minority in Western countries as Chinese citizens, and even blackmails them by threating their family; Winnie the Pooh is extremely thin-skinned and can have games like Devotion removed from Steam and GOG even after the reference is removed from the secret area in the game; there are many instances where businesses with Chinese shareholders were pressured not to publish anything mildly critical of China. BBC team visiting China investigating covid19 faced obstacles reminiscent of The Truman Show; WHO scientists investigating covid19 recently not permitted into China; China doesn't even formally frown at corruption; Journalists disappear or regularly get sentences in China; Western liberal democracies have flaws, but I'll take Western values over Chinese values, thank you very much. Also, the West has less leverage over China than over Russia so it's important not to yield any ground.
  - netsharc 6y ago
    Here's me being European and thinking, how many of these could be applied to USA as well. At least Xi Jinping is a properly ruthless politician, his thinner-skinned equivalent in the USA is just a fucking idiot running around screaming. Yeah, yeah, "whataboutism". BTW, Chinese values, or Chinese government values? I'm sure the average Chinese would speak up if they knew they wouldn't end up in reeducation camp. Yeah I'll give you one thing, at least in the West it's still possible to speak up. Meanwhile, in Washington DC at the moment, there are violence-ready Americans openly demanding democracy be ignored and to install their preferred fuckwit as ruler. Seems like they're just as brainwashed as a Chinese who's been fed CCP propaganda.
    - b0rsuk 6y ago
      I'll give you another example. A man was removed from a Polish reality TV show because he had been accused of rape outside Poland. The TV station was TVN, owned by US. The participant had received a sexual favor from a 16 year old. The age of consent in Poland is 15. I'm not impressed by ruthless politicians. Ruthlessness is good for action movie thrills. It takes much more skill and leadership to forge compromises and unite people using respect. By the way Spartans sucked even at combat, they just had really good PR. No matter how you slice it, they were completely average, even if you exclude naval battles or battles which included their allies. (extremely long reads for those interested in history) https://acoup.blog/2019/08/16/collections-this-isnt-sparta-part-i-spartan-school/ https://acoup.blog/2019/08/16/collections-this-isnt-sparta-p... https://acoup.blog/2020/01/17/collections-the-fremen-mirage-part-i-war-at-the-dawn-of-civilization/ https://acoup.blog/2020/01/17/collections-the-fremen-mirage-... re: whataboutism. Whataboutism has no place here because it's not even on the same order of magnitude. You're comparing tons to kilograms. We don't even know the full extent of what China is doing because free press is not allowed to operate there, doctors and journalists get sentences.
    - brianwawok 6y ago
      > I'm sure the average Chinese would speak up if they knew they wouldn't end up in reeducation camp What is the average standard of living in China 50 years ago vs today? There has been remarkable growth for millions of people. If your standard of living was 10x your parents, you might not view life as that bad?
- raverbashing 6y ago
  Reality check: if a state actor wants to add a backdoor it's easier at the parts closest to the consumer: the integrators, not the fundamental technology Of course you could be playing the long game as well like with Dual-EC-DRBG
- dvfjsdhgfv 6y ago
  It's not even necessary to mention China and Russia, the NSA is equally interested in placing a backdoor in the Linux kernel. People were paranoid about it already 20 years ago [0], but according to Linus' father, NSA actually tried to pull it off [1]. [0] https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-... [1] https://www.omgubuntu.co.uk/2013/11/nsa-ask-linus-torvalds-include-backdoors-linux-father-says-yes https://www.omgubuntu.co.uk/2013/11/nsa-ask-linus-torvalds-i...
secfirstmd 6y ago
Eh you may want to read up about the NSA history of backdoors.
- barbacoa 6y ago
  Saving people the google search, I believe secfirstmd is referring to: https://www.youtube.com/watch?v=7gRsgkdfYJ8 https://www.youtube.com/watch?v=7gRsgkdfYJ8 For anyone not good with faces the guy responding is Linus Torvalds who created and still manages Linux.
- curiousgal 6y ago
  Honestly, people seem to forget that this happened. They lose their shit at the slightest mention of Huawei/China but don't even have an issue using software released by the NSA[0]. Unpopular opinion, but if I had to choose between China and the U.S. spying on me, I would pick the one who's less likely to have me extradited from whatever country I am in or ban me from flying. 0.https://en.m.wikipedia.org/wiki/Ghidra https://en.m.wikipedia.org/wiki/Ghidra
  - philliphaydon 6y ago
    So you choose the US?
    - rat9988 6y ago
      I understood china.
      - philliphaydon 6y ago
        china has extradition laws just like the US. But the major difference (other than the list of countries they have treaties with) is if you insult the US government, nothing would happen, if you insulted the ccp, they would make up some false accusations to extradite you and throw you in jail, like whats happening already with Hong Kong. So you're definitely safer with the US than you are with china.
  - 6y ago
ronanyeah 6y ago
Huawei has already made some 'careless mistakes': https://www.zdnet.com/article/huawei-denies-involvement-in-buggy-linux-kernel-patch-proposal/ https://www.zdnet.com/article/huawei-denies-involvement-in-b...
- mlindner 6y ago
  And they follow the "deny, deny, lie" aspect of their government as well. Wish they would have some honesty. You can't call a project named after your company not involved with your company.
haukem 6y ago
Normally the identity of contributors is not really checked when you want to contribute to an open source project. A valid email address and a name is sufficient to contribute to the Linux kernel. All changes to The Linux kernel are getting publicly reviewed, so the hard thing is passing this technical review if you want to introduce a backdoor. If people know you, based on previous contributions, the review could be less hard, so it could make sense to build up a reputation before. In the Linux kernel not the company builds up the reputation, but the individual engineer who contributes. If this is a Huawei hardware it could be easier for an engineer with a Huawei mail address to get changes integrated, because people assume he known the driver and hardware well and people trust claims like, "this can not happen because the closed source firmware takes care of this". If the Chinese intelligence agency wants to integrate a backdoor into mainline Linux it would be easier to just build up some own fake identities and use them. It probably would be easier to just analyze the Linux kernel and use bugs introduced by other people. The NSA also contributed to the Linux kernel, look for contributes from a nsa.gov mail address.
- LinuxBender 6y ago
  I would expect that malicious code would itself not be a proper backdoor, but rather a framework or hook or API that makes it easier to bypass restrictions. Subtle behavioral changes in the kernel combined with user space code could empower a state actor to move unnoticed. I think of it like 20 parts of a munition. Each piece by itself may look mostly harmless. This is all theory of course, but that is how I would do something malicious in the kernel. A theoretical example would be a simple kernel API combined with something like systemd's binfmt mount and a benign looking PNG image file that when parsed by binfmt, instructs the kernel to do something interesting such as tickle an undocumented CPU instruction.
- dcolkitt 6y ago
  Not just contributed. SELinux is primarily authored by the NSA.
  - haukem 6y ago
    Now Huawei is fixing bugs in SELinux: https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e4de7b7db5 https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e... Or reports them, so the NSA can fix them: https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5fa730e936 https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5...

harikb 6y ago

If a state actor really wants to do it and someone could get it past reviews, I am sure they could bribe any contributor from any country (including US). Why single out China? We never raised concerns with Russian contributors.

deleted 6y ago
[deleted]
b0rsuk 6y ago
Maybe not single out China, but many people think China is particularly untrustworthy: they insist Chinese law is used outside China, and lecture people how they should refer to China in public; they operate concentration camps; the Chinese language has no word for *mutuality*, China benefits from free speech and access to institutions in the West but doesn't allow the same in China for journalists or businessmen; China treats Chinese-speaking minority in Western countries as Chinese citizens, and even blackmails them by threating their family; Winnie the Pooh is extremely thin-skinned and can have games like Devotion removed from Steam and GOG even after the reference is removed from the secret area in the game; there are many instances where businesses with Chinese shareholders were pressured not to publish anything mildly critical of China. BBC team visiting China investigating covid19 faced obstacles reminiscent of The Truman Show; WHO scientists investigating covid19 recently not permitted into China; China doesn't even formally frown at corruption; Journalists disappear or regularly get sentences in China; Western liberal democracies have flaws, but I'll take Western values over Chinese values, thank you very much. Also, the West has less leverage over China than over Russia so it's important not to yield any ground.
- netsharc 6y ago
  Here's me being European and thinking, how many of these could be applied to USA as well. At least Xi Jinping is a properly ruthless politician, his thinner-skinned equivalent in the USA is just a fucking idiot running around screaming. Yeah, yeah, "whataboutism". BTW, Chinese values, or Chinese government values? I'm sure the average Chinese would speak up if they knew they wouldn't end up in reeducation camp. Yeah I'll give you one thing, at least in the West it's still possible to speak up. Meanwhile, in Washington DC at the moment, there are violence-ready Americans openly demanding democracy be ignored and to install their preferred fuckwit as ruler. Seems like they're just as brainwashed as a Chinese who's been fed CCP propaganda.
  - b0rsuk 6y ago
    I'll give you another example. A man was removed from a Polish reality TV show because he had been accused of rape outside Poland. The TV station was TVN, owned by US. The participant had received a sexual favor from a 16 year old. The age of consent in Poland is 15. I'm not impressed by ruthless politicians. Ruthlessness is good for action movie thrills. It takes much more skill and leadership to forge compromises and unite people using respect. By the way Spartans sucked even at combat, they just had really good PR. No matter how you slice it, they were completely average, even if you exclude naval battles or battles which included their allies. (extremely long reads for those interested in history) https://acoup.blog/2019/08/16/collections-this-isnt-sparta-part-i-spartan-school/ https://acoup.blog/2019/08/16/collections-this-isnt-sparta-p... https://acoup.blog/2020/01/17/collections-the-fremen-mirage-part-i-war-at-the-dawn-of-civilization/ https://acoup.blog/2020/01/17/collections-the-fremen-mirage-... re: whataboutism. Whataboutism has no place here because it's not even on the same order of magnitude. You're comparing tons to kilograms. We don't even know the full extent of what China is doing because free press is not allowed to operate there, doctors and journalists get sentences.
  - brianwawok 6y ago
    > I'm sure the average Chinese would speak up if they knew they wouldn't end up in reeducation camp What is the average standard of living in China 50 years ago vs today? There has been remarkable growth for millions of people. If your standard of living was 10x your parents, you might not view life as that bad?
raverbashing 6y ago
Reality check: if a state actor wants to add a backdoor it's easier at the parts closest to the consumer: the integrators, not the fundamental technology Of course you could be playing the long game as well like with Dual-EC-DRBG
dvfjsdhgfv 6y ago
It's not even necessary to mention China and Russia, the NSA is equally interested in placing a backdoor in the Linux kernel. People were paranoid about it already 20 years ago [0], but according to Linus' father, NSA actually tried to pull it off [1]. [0] https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-... [1] https://www.omgubuntu.co.uk/2013/11/nsa-ask-linus-torvalds-include-backdoors-linux-father-says-yes https://www.omgubuntu.co.uk/2013/11/nsa-ask-linus-torvalds-i...

secfirstmd 6y ago

Eh you may want to read up about the NSA history of backdoors.

barbacoa 6y ago
Saving people the google search, I believe secfirstmd is referring to: https://www.youtube.com/watch?v=7gRsgkdfYJ8 https://www.youtube.com/watch?v=7gRsgkdfYJ8 For anyone not good with faces the guy responding is Linus Torvalds who created and still manages Linux.
curiousgal 6y ago
Honestly, people seem to forget that this happened. They lose their shit at the slightest mention of Huawei/China but don't even have an issue using software released by the NSA[0]. Unpopular opinion, but if I had to choose between China and the U.S. spying on me, I would pick the one who's less likely to have me extradited from whatever country I am in or ban me from flying. 0.https://en.m.wikipedia.org/wiki/Ghidra https://en.m.wikipedia.org/wiki/Ghidra
- philliphaydon 6y ago
  So you choose the US?
  - rat9988 6y ago
    I understood china.
    - philliphaydon 6y ago
      china has extradition laws just like the US. But the major difference (other than the list of countries they have treaties with) is if you insult the US government, nothing would happen, if you insulted the ccp, they would make up some false accusations to extradite you and throw you in jail, like whats happening already with Hong Kong. So you're definitely safer with the US than you are with china.
- 6y ago

ronanyeah 6y ago

Huawei has already made some 'careless mistakes': https://www.zdnet.com/article/huawei-denies-involvement-in-buggy-linux-kernel-patch-proposal/ https://www.zdnet.com/article/huawei-denies-involvement-in-b...

mlindner 6y ago
And they follow the "deny, deny, lie" aspect of their government as well. Wish they would have some honesty. You can't call a project named after your company not involved with your company.

haukem 6y ago

Normally the identity of contributors is not really checked when you want to contribute to an open source project. A valid email address and a name is sufficient to contribute to the Linux kernel. All changes to The Linux kernel are getting publicly reviewed, so the hard thing is passing this technical review if you want to introduce a backdoor. If people know you, based on previous contributions, the review could be less hard, so it could make sense to build up a reputation before. In the Linux kernel not the company builds up the reputation, but the individual engineer who contributes. If this is a Huawei hardware it could be easier for an engineer with a Huawei mail address to get changes integrated, because people assume he known the driver and hardware well and people trust claims like, "this can not happen because the closed source firmware takes care of this". If the Chinese intelligence agency wants to integrate a backdoor into mainline Linux it would be easier to just build up some own fake identities and use them. It probably would be easier to just analyze the Linux kernel and use bugs introduced by other people. The NSA also contributed to the Linux kernel, look for contributes from a nsa.gov mail address.

LinuxBender 6y ago
I would expect that malicious code would itself not be a proper backdoor, but rather a framework or hook or API that makes it easier to bypass restrictions. Subtle behavioral changes in the kernel combined with user space code could empower a state actor to move unnoticed. I think of it like 20 parts of a munition. Each piece by itself may look mostly harmless. This is all theory of course, but that is how I would do something malicious in the kernel. A theoretical example would be a simple kernel API combined with something like systemd's binfmt mount and a benign looking PNG image file that when parsed by binfmt, instructs the kernel to do something interesting such as tickle an undocumented CPU instruction.
dcolkitt 6y ago
Not just contributed. SELinux is primarily authored by the NSA.
- haukem 6y ago
  Now Huawei is fixing bugs in SELinux: https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e4de7b7db5 https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e... Or reports them, so the NSA can fix them: https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5fa730e936 https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5...