12 ms·

Apache Log4j bug: China’s industry ministry pulls support from Alibaba Cloud

316 points by chaostheory 5y ago

shell0x 5y ago
Glad to live in a free country where we don't praise dictatorships and authoritarianism. The world should just boycott fucking China.
- savant_penguin 5y ago
  We did skip a COVID variant Greek letter to appease the dictator though
  - addicted 5y ago
    That’s not even close to true. There’s tens of millions of people with that name. The WHO did not want to stigmatize all of them which is why they skipped the letter. It had little to do with Xi Jinping alone. The WHO moved to Greek lettering to avoid stigmatization faced by people who were being associated with different variants. It wouldn’t make much sense to do the same when you can avoid it by just skipping a letter.
    - eloisius 5y ago
      Mu is a more common surname than Xi, but they weren't so worried about stigmatizing that name. I have no doubt that they _would_ have avoided it, had anyone brought it to their attention, but they didn't. Yet somehow they avoided Xi.
    - herendin 5y ago
      Chinese surnames pronounced 'Mu' are similarly common to 'Xi'. There is a Mu variant of Covid[0] [0] https://en.wikipedia.org/wiki/SARS-CoV-2_Mu_variant https://en.wikipedia.org/wiki/SARS-CoV-2_Mu_variant
- deleted 5y ago
  [deleted]
- johnebgd 5y ago
  Agreed. Watching ADV China really helped me understand how bad the government is over there: https://youtube.com/c/ADVChina https://youtube.com/c/ADVChina
  - droopyEyelids 5y ago
    Don't take this to mean I support china or think everything is roses over there, but that channel is simply propaganda. Genorously 40% of it is valid criticism, but if someone in china stubs a toe they will make a 30 minute video about the unsafe furniture epidemic.
    - philliphaydon 5y ago
      I don’t watch that channel but have seen a couple of videos from laowhy86 before he left China, so would be curious to know what is not true on their channel.
      - wh313 5y ago
        Here's a two of his videos where he claims that COVID-19 emerged from a lab: https://www.youtube.com/watch?v=bpQFCcSI0pU https://www.youtube.com/watch?v=bpQFCcSI0pU https://www.youtube.com/watch?v=a-GVcfP1zrg https://www.youtube.com/watch?v=a-GVcfP1zrg And here's a pretty thorough analysis of the flaws with this theory: https://www.youtube.com/watch?v=ab-r0capbzk https://www.youtube.com/watch?v=ab-r0capbzk
        philliphaydon 5y ago
        I'm unsure how he claims to have found the source. The theory begain at the beginning of Jan 2020 but he posted in April 2020. Just watching the 'thorough' analysis video, he talks about some person who posted a paper about the source, and in the screenshot it shows Feb 2020. And says the source of the paper was from laowhy86's video, which is published April 2020. I stopped watching there because it already makes no sense.
- sniperjzp 5y ago
  - ApolloFortyNine 5y ago
    Honestly this comment is the problem with the western world. Don't let perfect be the enemy of good. The U.S is not even on the same plane of evil as the Chinese government is.
    - aaomidi 5y ago
      On many aspects it's more evil. On many other aspects it's less. Shits not a binary. In just pure number of lives fucked, the US has the record for now. We shouldn't let China's shit mean that we should praise the US and not thrive to fixing our own problems.
      - deleted 5y ago
        [deleted]
    - dathinab 5y ago
      the problem is that the US is not just "not perfect" the US is a weird twist between a "first world"(1) state and a failing state. Between being a bacon of democracy, and a country you can't rely call full democratic anymore. (1) I don't like the terminology but it convais the point. --- To elaborate: For something between 15% and 50% of the population the US is a failing state, failing in healthcare, economics/job availability, safety, chances to get the right you have by law, political representation, protection for governmental/police overreach, projection from company overreach, .. Also a political system which in practice only allow a two parties is fundamentally non-democratic (more like oligarchy). To name some points. (There are more). Sure, China is way worse wrt. many of the points mentioned above. Which puts the EU in quite a bit of trouble it's in different ways dependent on both the US and China, but at the same time many of it's values do not sign with either of them and both try (in different ways) to force some of their views on the EU.
      - 5y ago
- beckman466 5y ago
  > Glad to live in a free country what country is that?
- dang 5y ago
  Nationalistic flamewar will get you banned here. No more of this, please. No, that's not because we're secretly in cahoots with communists—it's because we don't want a site that consists of lame flamewars and then turns itself into scorched earth and then heat death. We want thoughtful, curious conversation. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful. Edit: your previous two comments were egregiously breaking the rules here as well—even worse actually. That's seriously not ok. Please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stop posting like that, regardless of how strongly you feel about $country, and regardless of how legitimate your reasons are (which I'm sure they are). I don't want to ban you but we can't have accounts carrying on like that here.
gred 5y ago
Silver lining: The more audacious the CCP gets, the faster their rule will collapse.
- chitowneats 5y ago
  Wishful thinking. Nothing guarantees that.
  - gred 5y ago
    Optimistic, sure. But historical examples abound.
- bostonsre 5y ago
  I wish but I think they are well enough entrenched so that only a major economic collapse could threaten their rule.
- BurningFrog 5y ago
  Then again, the CCP under Mao was a lot worse, without any hint of collapse.
  - addicted 5y ago
    People’s expectations were also lower. And there wasn’t any incentive for other countries to be involved. Both those factors have changed. The Chinese people are not gonna tolerate an extended reduction in their quality of life. Anything short of rapid quality of life growth may be catastrophic for the people in power. And on the other side, other countries have a lot of incentive to further make things difficult for China and it’s leadership.
    - 88913527 5y ago
      The tang ping moment to some degree validates that quality of life has at least plateaued for many, or that the effort involved to further improve QOL isn't worth it. However, that problem doesn't seem unique to China, and other countries are starting at a higher baseline standard of living.
xupybd 5y ago
Why? Did they want to protect themselves before alerting anyone? Did they want to use this to infiltrate others?
- clouddrover 5y ago
  > Did they want to protect themselves before alerting anyone? Probably yes. > Did they want to use this to infiltrate others? Also probably yes. The NSA does the same thing. They stockpile security vulnerabilities and selectively tell the software vendors about some of them. They like to keep the "high value" vulnerabilities to themselves for use in exploits. The WannaCry ransomware (see https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack and https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue) did worldwide economic damage and was built on an NSA developed exploit. The NSA knew about this vulnerability in Windows for years and never told Microsoft. Unfortunately all intelligence agencies everywhere will continue to take this cowboy approach. Until we can get these bad actors under control, their constant undermining of internet infrastructure will continue to hinder efforts to improve internet security.
  - ButtSpark69 5y ago
    It's not the same thing to develop and keep an exploit for yourself, as it is to require the public companies in your country to report the important bugs they find while effectively also under a temporary gag order. They are super different things.
    - clouddrover 5y ago
      The super result is super the same: more vulnerabilities exploited for longer.
      - mlyle 5y ago
        Surely you can see there's some difference in magnitude here, right? Which one does it more? And even if the end result has some overlap, there's a bit of an ethical difference between: * developing an exploit that you keep quiet * preventing others from talking about exploits they discover
chaostheory 5y ago
"China’s internet security regulator has disciplined Alibaba Group Holding’s cloud computing services unit for failing to first report to the government a critical vulnerability in Apache’s Log4j software that has alarmed the cybersecurity community, Chinese media reported on Wednesday. The Ministry of Industry and Information Technology (MIIT) is suspending work with Alibaba Cloud as a cybersecurity threat intelligence partner for six months because the company did not immediately report a severe bug in the widely used logging software to the government agency, the 21st Century Business Herald reported. The ministry also said it would reassess whether to resume the partnership at that time, based on measures Alibaba has taken to correct the problem. Losing the support of the agency could affect business prospects for the cloud computing unit of Alibaba, the owner of the South China Morning Post. However, specific losses for the country’s largest cloud business are hard to determine. The MIIT launched a cybersecurity threat intelligence sharing platform in December 2019 to serve as a state-led alliance in dealing with security threats. Membership in the platform is government recognition of the member’s capabilities in spotting and managing threats. The MIIT did not publish a public statement about its decision, and Alibaba did not respond to a request for comment. The Log4j vulnerability has been described as a “nightmare” and “catastrophic”, with some experts saying it is the most severe cybersecurity threat ever by number of devices affected. The simple piece of Java-based software can be found in countless internet-connected devices, from Internet-of-Things products like televisions and cameras to the servers running cloud operations for tech giants like Amazon, Google and Microsoft. The flaw first received widespread attention when it was publicly disclosed on December 9, after Alibaba Cloud Security Team engineer Chen Zhoujun discovered the flaw. Chen notified the Apache Software Foundation, the non-profit corporation that develops the open-source Log4j tool, by email on November 24. According to a regulation passed this year, Chinese companies are obliged to report vulnerabilities in their own software to the MIIT through its National Vulnerability Database website. However, the Internet Product Security Loophole Management Regulation, which went into effect in September, only “encourages” companies to report bugs found in others’ software. The MIIT cybersecurity management bureau released a statement on December 9 saying it was notified about the vulnerability by “relevant” cybersecurity institutions. The ministry summoned Alibaba Cloud and other cybersecurity firms to discuss the situation, it said. It also urged companies and the public to monitor for updates to patch their systems. Cybersecurity industry norms encourage notifying vendors of security flaws first, giving them ample time to address the problem, before disclosing the issue to the public. Apache released a patch for the Log4j bug on December 6, three days before public disclosure. Still, the effect of the bug’s discovery is expected to be wide-ranging because of Log4j’s ubiquity. Many people may not even be aware that their systems are compromised. The exploit, known as Log4Shell, allows hackers to remotely execute code by getting it logged by the software. This became a problem in the Java edition of Microsoft’s game Minecraft, for example, allowing players’ to compromise others’ systems by sending malicious code through chat messages. Cybersecurity experts on Twitter have commended the Alibaba Cloud engineer for responsibly disclosing the vulnerability directly to the tool’s developers. Since the bug’s public disclosure, cybersecurity experts have warned of an increase in activity scanning for Log4j on vulnerable systems. Microsoft said on December 11 that it found that state actors connected with China, Iran, North Korea and Turkey have been both experimenting and exploiting the vulnerability."
chenzhekl 5y ago
[flagged]
- echelon 5y ago
  Alibaba shared the vulnerability with Apache Foundation directly. China's Ministry of IT wanted the details and are mad it didn't happen. (Unclear if this means "first", "privately / exclusively", "within a week", "cc us on the email", etc.) > Alibaba Cloud recently discovered a remote code execution vulnerability in the Apache Log4j2 component, notifying the U.S.-based Apache Software Foundation, according to the statement. > Alibaba Cloud did not immediately report vulnerabilities in the popular, open-source logging framework Apache Log4j2 to China's telecommunications regulator, according to 21st Century Business Herald, citing a recent notice by the Ministry of Industry and Information Technology (MIIT). https://www.reuters.com/world/china/china-regulator-suspends-cyber-security-deal-with-alibaba-cloud-2021-12-22/ https://www.reuters.com/world/china/china-regulator-suspends...
  - chenzhekl 5y ago
    If the contract between MIIT and Alibaba Cloud doesn't require sharing vulnerabilities in the first place, MIIT should be the one to blame. And if it is an exclusive contract, I would feel worried, as the vulnerability might be secretly exploited. But by reading the news, we only knew that Alibaba didn't sharing the information with MIIT immediately. There's high probability that it violates the contract, as this is what we usually know as a cybersecurity partner. Look at the other comments. People are only interested in political attacks.
  - sudosysgen 5y ago
    It seems to be within 2 days, and they are legally obligated to share the information to them, but it seems that they are obligated to disclose it to Apache before disclosing it to the government, according to machine translation of this : http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Apparently there is no legal requirement for disclosure in the case of a vulnerability in a foreign product at all.
- 5y ago
addicted 5y ago
This is why for all the fear of China, the country cannot succeed on its current trajectory. Things look great until the leaders are doing well, but all it takes is for 1 bad set of leadership for all to fall apart. And Xi Jinping has guaranteed failure by removing term limits. Term limits meant that other ambitious political leaders were willing to wait and try their luck next turn. But with no term limits multiple generations of leaders are locked out of even the possibility of becoming the party leader, which means they have become a threat to Jinping. And since so many people are now a threat to him, his selection criteria for people to lead different parts of the party and government has to be based entirely on loyalty rather than competence. Which almost guarantees a lot of counter productive incompetence.
- manigandham 5y ago
  The ease with which the term limits were removed indicates that they were never a real limitation in the first place. What prior leader was actually bounded by them?
  - xbeta 5y ago
    Jiang and Hu both stepped down after 2 terms. So yes they agreed to it.
    - manigandham 5y ago
      Doesn't seem like much of a limitation if they have to agree to it. What happens if they don't? Wasn't Jiang still leading the military? Hu appears to be the only one that stepped down on time - but more from the rise of Xi rather than this rule.
- baybal2 5y ago
  This is not how China works. Previous leaders only exited power because they were pretty much ousted, and their power was never really institutionally checked. Mainland China never been ever close to constitutional rule. It's unbelievably naive to think that term limits would've ever been something other than a decoration, and a propaganda point with communists.
sydthrowaway 5y ago
- noah_buddy 5y ago
  This is a total non-sequitur. A subreddit that is pro-CCP and a communist subreddit (in the literal sense, not the hyperbolic sense) don't criticize China. Did you expect different? These two groups are by no means even remotely representative of western thought or opinion, they're hardly held up as arbitrators or authorities on anything, besides being too online. Perhaps, if you don't like the analysis or discussion in those places, you should step out of those bubbles.
  - sudosysgen 5y ago
    Generally whether or not to support China is very very controversial in the West even amongst communists, and even those that do support it tend to offer a lot of criticism. It's very controversial to support China in the West, as you said, and even in the most fringe of communities this remains true to a large extent. Basically the only reason Sino is the way it is is because the moderators aggressively ban anyone who even slightly criticizes the Chinese government.
dathinab 5y ago
My deepest thanks for whoever did that decision in Alibaba. I hope the price Alibaba has to pay for it won't be too high. Through I expect Alibaba to now fall-in-line wrt. Future decisions of this kind, it's not that they have much choice.
- duxup 5y ago
  I worry more about the price of the he individuals who made that call.
  - dmix 5y ago
    Curious what “saving face” will look like in practice here.
    - dathinab 5y ago
      Very speculative: It probably gets labeled as a procedural error, i.e. the one(s) who report it to the log4j project thought it is already reported to the government, and the ones on the other side say they thought the first team would report it to the government. Then they "fall-in-line" by implementing a security report system where you can't make the mistake, which automatically reports to the government and you need to get "clearance" to report to the project authors. Which, might have been what actually happened if I think about it.
mrjin 5y ago
Let's cut the BS. The fact was that Ali Cloud failed to report the issue to MIIT (required by law, it has to be report cyber security incidents to MIIT immediately) weeks after notifying Apache(a foreign entity). I'm not sure if such behaviors would be desirable in any country.
- deleted 5y ago
  [deleted]
- ggm 5y ago
  Classic HN. you're getting downvoted by fools. I made your point independently, before finding this comment.
  - sudosysgen 5y ago
    It really is worrying how little pause a factually correct comment gave the people reading the thread. We really live in a post-truth world.
  - mrjin 5y ago
    Well, it's a pity that doesn't matter how hard we try, it's just impossible to make some ppl understand the fact.
zhte415 5y ago
I'm surprised HN is full of knee jerk assumption without first checking what the government required disclosure policy is. Here it is: Verify. Report to 'vendor'. Immediately. Report to government including an analysis within 2 days. Link to policy: http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Link to past HN comment on this on another story on this topic: https://news.ycombinator.com/item?id=29653352 https://news.ycombinator.com/item?id=29653352
- marderfarker2 5y ago
  - ycombinete 5y ago
    There is usually a contingent of counter-jerkers that balance things out, with equally unsubstantiated commentary. This hyperbole is expected on any politically polarising topic.
- boston_clone 5y ago
  I don't think there are any knee jerk assumptions happening; TFA details the differences, including the policy you're referencing. (archived version of the article: https://archive.md/Yvsca https://archive.md/Yvsca) From your linked policy (translated by Apple): >Article 7 Network product providers shall fulfill the following security vulnerability management obligations >(2) Relevant vulnerability information shall be submitted [...] within 2 days In this case, an Alibaba researcher found a bug in an Apache product, so this policy wouldn't seem to apply as Alibaba is not the vendor of the product.
  - sudosysgen 5y ago
    Plainly the linked policy does not ask Alibaba to do what the article says it should do, ie, notify the government first, as per machine translation. It seems to say that they should notify the vendor (ie, Apache) as soon as possible, and notify the government within 2 days (according to rfoo they are not at all required to disclose it to the government since it's not their product, but they are encouraged to do so), not that they should notify the government first and then wait for approval to notify Apache. According to google translate: (1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately. (2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products. So according to machine translation, the article is incorrect, and they do not have to notify the CCP first, instead they should have notified Apache first, and then the government within 2 days.
tom_dancer 5y ago
yesbut 5y ago
- kelnos 5y ago
  I agree, but I think there's good reason. There's a lot of well-justified fear and expectation that China will become the next world superpower, and an authoritarian government in that position isn't great for other sovereign states' autonomy and ability to adhere to and promote democratic principles.
  - yesbut 5y ago
    - anothernewdude 5y ago
      Whatabout the rest?
      - yesbut 5y ago
        A great starter book on the topic you can download directly from CIA.gov: Killing Hope: Military and CIA Interventions Since World War II, William Blum https://www.cia.gov/library/abbottabad-compound/13/130AEF1531746AAD6AC03EF59F91E1A1_Killing_Hope_Blum_William.pdf https://www.cia.gov/library/abbottabad-compound/13/130AEF153...
    - dmix 5y ago
      This is always the answer that China defenders give. Always. Regardless of content or context. The problem is there’s way more countries in the world than China and America.
      - sudosysgen 5y ago
        I'm pretty sure that's the point of the whataboutism. China's rise is mostly a problem if you are aligned to the US or in direct conflict with China, otherwise their influence is not really materially much worse than that of the current hegemon.
ggm 5y ago
Do people really think AWS did not report to the federal agencies about potential risks? If AWS didn't then their contract for service is deficient. If they had risks which affected their stock price they had obligations to other agencies too. The department of commerce, the federal communications agency, the US Cert, you name it. Please, no accusations of whataboutery: I am trying to point out that if you are big enough to have economically relevant importance, OR if you supply goods and services to the state, any state, you have obligations in that state relationship. if I was in government in China and ali baba cloud didn't check in, I might be witholding business too.
akyoan 5y ago
Absolutely shameless. I’m glad that they’re doing this in the complete open instead of painting themselves as the good guys (unlike, ahem, other western countries)
neonate 5y ago
https://archive.md/Yvsca https://archive.md/Yvsca
Borrible 5y ago
Would love to know whether their Specialized military network warfare forces and PLA - authorized forces knew about the flaw beforehand.
pagutierrezn 5y ago
>And since so many people are now a threat to him, his selection criteria for people to lead different parts of the party and government has to be based entirely on loyalty rather than competence. >Which almost guarantees a lot of counter productive incompetence. This applies to every goverment and public institution regardless of its democratic roots

316 points by chaostheory 5y ago

Glad to live in a free country where we don't praise dictatorships and authoritarianism. The world should just boycott fucking China.

savant_penguin 5y ago
We did skip a COVID variant Greek letter to appease the dictator though
- addicted 5y ago
  That’s not even close to true. There’s tens of millions of people with that name. The WHO did not want to stigmatize all of them which is why they skipped the letter. It had little to do with Xi Jinping alone. The WHO moved to Greek lettering to avoid stigmatization faced by people who were being associated with different variants. It wouldn’t make much sense to do the same when you can avoid it by just skipping a letter.
  - eloisius 5y ago
    Mu is a more common surname than Xi, but they weren't so worried about stigmatizing that name. I have no doubt that they _would_ have avoided it, had anyone brought it to their attention, but they didn't. Yet somehow they avoided Xi.
  - herendin 5y ago
    Chinese surnames pronounced 'Mu' are similarly common to 'Xi'. There is a Mu variant of Covid[0] [0] https://en.wikipedia.org/wiki/SARS-CoV-2_Mu_variant https://en.wikipedia.org/wiki/SARS-CoV-2_Mu_variant
deleted 5y ago
[deleted]
johnebgd 5y ago
Agreed. Watching ADV China really helped me understand how bad the government is over there: https://youtube.com/c/ADVChina https://youtube.com/c/ADVChina
- droopyEyelids 5y ago
  Don't take this to mean I support china or think everything is roses over there, but that channel is simply propaganda. Genorously 40% of it is valid criticism, but if someone in china stubs a toe they will make a 30 minute video about the unsafe furniture epidemic.
  - philliphaydon 5y ago
    I don’t watch that channel but have seen a couple of videos from laowhy86 before he left China, so would be curious to know what is not true on their channel.
    - wh313 5y ago
      Here's a two of his videos where he claims that COVID-19 emerged from a lab: https://www.youtube.com/watch?v=bpQFCcSI0pU https://www.youtube.com/watch?v=bpQFCcSI0pU https://www.youtube.com/watch?v=a-GVcfP1zrg https://www.youtube.com/watch?v=a-GVcfP1zrg And here's a pretty thorough analysis of the flaws with this theory: https://www.youtube.com/watch?v=ab-r0capbzk https://www.youtube.com/watch?v=ab-r0capbzk
      - philliphaydon 5y ago
        I'm unsure how he claims to have found the source. The theory begain at the beginning of Jan 2020 but he posted in April 2020. Just watching the 'thorough' analysis video, he talks about some person who posted a paper about the source, and in the screenshot it shows Feb 2020. And says the source of the paper was from laowhy86's video, which is published April 2020. I stopped watching there because it already makes no sense.
sniperjzp 5y ago
- ApolloFortyNine 5y ago
  Honestly this comment is the problem with the western world. Don't let perfect be the enemy of good. The U.S is not even on the same plane of evil as the Chinese government is.
  - aaomidi 5y ago
    On many aspects it's more evil. On many other aspects it's less. Shits not a binary. In just pure number of lives fucked, the US has the record for now. We shouldn't let China's shit mean that we should praise the US and not thrive to fixing our own problems.
    - deleted 5y ago
      [deleted]
  - dathinab 5y ago
    the problem is that the US is not just "not perfect" the US is a weird twist between a "first world"(1) state and a failing state. Between being a bacon of democracy, and a country you can't rely call full democratic anymore. (1) I don't like the terminology but it convais the point. --- To elaborate: For something between 15% and 50% of the population the US is a failing state, failing in healthcare, economics/job availability, safety, chances to get the right you have by law, political representation, protection for governmental/police overreach, projection from company overreach, .. Also a political system which in practice only allow a two parties is fundamentally non-democratic (more like oligarchy). To name some points. (There are more). Sure, China is way worse wrt. many of the points mentioned above. Which puts the EU in quite a bit of trouble it's in different ways dependent on both the US and China, but at the same time many of it's values do not sign with either of them and both try (in different ways) to force some of their views on the EU.
    - 5y ago
beckman466 5y ago
> Glad to live in a free country what country is that?
dang 5y ago
Nationalistic flamewar will get you banned here. No more of this, please. No, that's not because we're secretly in cahoots with communists—it's because we don't want a site that consists of lame flamewars and then turns itself into scorched earth and then heat death. We want thoughtful, curious conversation. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful. Edit: your previous two comments were egregiously breaking the rules here as well—even worse actually. That's seriously not ok. Please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stop posting like that, regardless of how strongly you feel about $country, and regardless of how legitimate your reasons are (which I'm sure they are). I don't want to ban you but we can't have accounts carrying on like that here.

gred 5y ago

Silver lining: The more audacious the CCP gets, the faster their rule will collapse.

chitowneats 5y ago
Wishful thinking. Nothing guarantees that.
- gred 5y ago
  Optimistic, sure. But historical examples abound.
bostonsre 5y ago
I wish but I think they are well enough entrenched so that only a major economic collapse could threaten their rule.
BurningFrog 5y ago
Then again, the CCP under Mao was a lot worse, without any hint of collapse.
- addicted 5y ago
  People’s expectations were also lower. And there wasn’t any incentive for other countries to be involved. Both those factors have changed. The Chinese people are not gonna tolerate an extended reduction in their quality of life. Anything short of rapid quality of life growth may be catastrophic for the people in power. And on the other side, other countries have a lot of incentive to further make things difficult for China and it’s leadership.
  - 88913527 5y ago
    The tang ping moment to some degree validates that quality of life has at least plateaued for many, or that the effort involved to further improve QOL isn't worth it. However, that problem doesn't seem unique to China, and other countries are starting at a higher baseline standard of living.

xupybd 5y ago

Why? Did they want to protect themselves before alerting anyone? Did they want to use this to infiltrate others?

clouddrover 5y ago
> Did they want to protect themselves before alerting anyone? Probably yes. > Did they want to use this to infiltrate others? Also probably yes. The NSA does the same thing. They stockpile security vulnerabilities and selectively tell the software vendors about some of them. They like to keep the "high value" vulnerabilities to themselves for use in exploits. The WannaCry ransomware (see https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack and https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue) did worldwide economic damage and was built on an NSA developed exploit. The NSA knew about this vulnerability in Windows for years and never told Microsoft. Unfortunately all intelligence agencies everywhere will continue to take this cowboy approach. Until we can get these bad actors under control, their constant undermining of internet infrastructure will continue to hinder efforts to improve internet security.
- ButtSpark69 5y ago
  It's not the same thing to develop and keep an exploit for yourself, as it is to require the public companies in your country to report the important bugs they find while effectively also under a temporary gag order. They are super different things.
  - clouddrover 5y ago
    The super result is super the same: more vulnerabilities exploited for longer.
    - mlyle 5y ago
      Surely you can see there's some difference in magnitude here, right? Which one does it more? And even if the end result has some overlap, there's a bit of an ethical difference between: * developing an exploit that you keep quiet * preventing others from talking about exploits they discover

chaostheory 5y ago

"China’s internet security regulator has disciplined Alibaba Group Holding’s cloud computing services unit for failing to first report to the government a critical vulnerability in Apache’s Log4j software that has alarmed the cybersecurity community, Chinese media reported on Wednesday. The Ministry of Industry and Information Technology (MIIT) is suspending work with Alibaba Cloud as a cybersecurity threat intelligence partner for six months because the company did not immediately report a severe bug in the widely used logging software to the government agency, the 21st Century Business Herald reported. The ministry also said it would reassess whether to resume the partnership at that time, based on measures Alibaba has taken to correct the problem. Losing the support of the agency could affect business prospects for the cloud computing unit of Alibaba, the owner of the South China Morning Post. However, specific losses for the country’s largest cloud business are hard to determine. The MIIT launched a cybersecurity threat intelligence sharing platform in December 2019 to serve as a state-led alliance in dealing with security threats. Membership in the platform is government recognition of the member’s capabilities in spotting and managing threats. The MIIT did not publish a public statement about its decision, and Alibaba did not respond to a request for comment. The Log4j vulnerability has been described as a “nightmare” and “catastrophic”, with some experts saying it is the most severe cybersecurity threat ever by number of devices affected. The simple piece of Java-based software can be found in countless internet-connected devices, from Internet-of-Things products like televisions and cameras to the servers running cloud operations for tech giants like Amazon, Google and Microsoft. The flaw first received widespread attention when it was publicly disclosed on December 9, after Alibaba Cloud Security Team engineer Chen Zhoujun discovered the flaw. Chen notified the Apache Software Foundation, the non-profit corporation that develops the open-source Log4j tool, by email on November 24. According to a regulation passed this year, Chinese companies are obliged to report vulnerabilities in their own software to the MIIT through its National Vulnerability Database website. However, the Internet Product Security Loophole Management Regulation, which went into effect in September, only “encourages” companies to report bugs found in others’ software. The MIIT cybersecurity management bureau released a statement on December 9 saying it was notified about the vulnerability by “relevant” cybersecurity institutions. The ministry summoned Alibaba Cloud and other cybersecurity firms to discuss the situation, it said. It also urged companies and the public to monitor for updates to patch their systems. Cybersecurity industry norms encourage notifying vendors of security flaws first, giving them ample time to address the problem, before disclosing the issue to the public. Apache released a patch for the Log4j bug on December 6, three days before public disclosure. Still, the effect of the bug’s discovery is expected to be wide-ranging because of Log4j’s ubiquity. Many people may not even be aware that their systems are compromised. The exploit, known as Log4Shell, allows hackers to remotely execute code by getting it logged by the software. This became a problem in the Java edition of Microsoft’s game Minecraft, for example, allowing players’ to compromise others’ systems by sending malicious code through chat messages. Cybersecurity experts on Twitter have commended the Alibaba Cloud engineer for responsibly disclosing the vulnerability directly to the tool’s developers. Since the bug’s public disclosure, cybersecurity experts have warned of an increase in activity scanning for Log4j on vulnerable systems. Microsoft said on December 11 that it found that state actors connected with China, Iran, North Korea and Turkey have been both experimenting and exploiting the vulnerability."

chenzhekl 5y ago

[flagged]

echelon 5y ago
Alibaba shared the vulnerability with Apache Foundation directly. China's Ministry of IT wanted the details and are mad it didn't happen. (Unclear if this means "first", "privately / exclusively", "within a week", "cc us on the email", etc.) > Alibaba Cloud recently discovered a remote code execution vulnerability in the Apache Log4j2 component, notifying the U.S.-based Apache Software Foundation, according to the statement. > Alibaba Cloud did not immediately report vulnerabilities in the popular, open-source logging framework Apache Log4j2 to China's telecommunications regulator, according to 21st Century Business Herald, citing a recent notice by the Ministry of Industry and Information Technology (MIIT). https://www.reuters.com/world/china/china-regulator-suspends-cyber-security-deal-with-alibaba-cloud-2021-12-22/ https://www.reuters.com/world/china/china-regulator-suspends...
- chenzhekl 5y ago
  If the contract between MIIT and Alibaba Cloud doesn't require sharing vulnerabilities in the first place, MIIT should be the one to blame. And if it is an exclusive contract, I would feel worried, as the vulnerability might be secretly exploited. But by reading the news, we only knew that Alibaba didn't sharing the information with MIIT immediately. There's high probability that it violates the contract, as this is what we usually know as a cybersecurity partner. Look at the other comments. People are only interested in political attacks.
- sudosysgen 5y ago
  It seems to be within 2 days, and they are legally obligated to share the information to them, but it seems that they are obligated to disclose it to Apache before disclosing it to the government, according to machine translation of this : http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Apparently there is no legal requirement for disclosure in the case of a vulnerability in a foreign product at all.
5y ago

addicted 5y ago

This is why for all the fear of China, the country cannot succeed on its current trajectory. Things look great until the leaders are doing well, but all it takes is for 1 bad set of leadership for all to fall apart. And Xi Jinping has guaranteed failure by removing term limits. Term limits meant that other ambitious political leaders were willing to wait and try their luck next turn. But with no term limits multiple generations of leaders are locked out of even the possibility of becoming the party leader, which means they have become a threat to Jinping. And since so many people are now a threat to him, his selection criteria for people to lead different parts of the party and government has to be based entirely on loyalty rather than competence. Which almost guarantees a lot of counter productive incompetence.

manigandham 5y ago
The ease with which the term limits were removed indicates that they were never a real limitation in the first place. What prior leader was actually bounded by them?
- xbeta 5y ago
  Jiang and Hu both stepped down after 2 terms. So yes they agreed to it.
  - manigandham 5y ago
    Doesn't seem like much of a limitation if they have to agree to it. What happens if they don't? Wasn't Jiang still leading the military? Hu appears to be the only one that stepped down on time - but more from the rise of Xi rather than this rule.
baybal2 5y ago
This is not how China works. Previous leaders only exited power because they were pretty much ousted, and their power was never really institutionally checked. Mainland China never been ever close to constitutional rule. It's unbelievably naive to think that term limits would've ever been something other than a decoration, and a propaganda point with communists.

sydthrowaway 5y ago

noah_buddy 5y ago
This is a total non-sequitur. A subreddit that is pro-CCP and a communist subreddit (in the literal sense, not the hyperbolic sense) don't criticize China. Did you expect different? These two groups are by no means even remotely representative of western thought or opinion, they're hardly held up as arbitrators or authorities on anything, besides being too online. Perhaps, if you don't like the analysis or discussion in those places, you should step out of those bubbles.
- sudosysgen 5y ago
  Generally whether or not to support China is very very controversial in the West even amongst communists, and even those that do support it tend to offer a lot of criticism. It's very controversial to support China in the West, as you said, and even in the most fringe of communities this remains true to a large extent. Basically the only reason Sino is the way it is is because the moderators aggressively ban anyone who even slightly criticizes the Chinese government.

dathinab 5y ago

My deepest thanks for whoever did that decision in Alibaba. I hope the price Alibaba has to pay for it won't be too high. Through I expect Alibaba to now fall-in-line wrt. Future decisions of this kind, it's not that they have much choice.

duxup 5y ago
I worry more about the price of the he individuals who made that call.
- dmix 5y ago
  Curious what “saving face” will look like in practice here.
  - dathinab 5y ago
    Very speculative: It probably gets labeled as a procedural error, i.e. the one(s) who report it to the log4j project thought it is already reported to the government, and the ones on the other side say they thought the first team would report it to the government. Then they "fall-in-line" by implementing a security report system where you can't make the mistake, which automatically reports to the government and you need to get "clearance" to report to the project authors. Which, might have been what actually happened if I think about it.

mrjin 5y ago

Let's cut the BS. The fact was that Ali Cloud failed to report the issue to MIIT (required by law, it has to be report cyber security incidents to MIIT immediately) weeks after notifying Apache(a foreign entity). I'm not sure if such behaviors would be desirable in any country.

deleted 5y ago
[deleted]
ggm 5y ago
Classic HN. you're getting downvoted by fools. I made your point independently, before finding this comment.
- sudosysgen 5y ago
  It really is worrying how little pause a factually correct comment gave the people reading the thread. We really live in a post-truth world.
- mrjin 5y ago
  Well, it's a pity that doesn't matter how hard we try, it's just impossible to make some ppl understand the fact.

zhte415 5y ago

I'm surprised HN is full of knee jerk assumption without first checking what the government required disclosure policy is. Here it is: Verify. Report to 'vendor'. Immediately. Report to government including an analysis within 2 days. Link to policy: http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Link to past HN comment on this on another story on this topic: https://news.ycombinator.com/item?id=29653352 https://news.ycombinator.com/item?id=29653352

marderfarker2 5y ago
- ycombinete 5y ago
  There is usually a contingent of counter-jerkers that balance things out, with equally unsubstantiated commentary. This hyperbole is expected on any politically polarising topic.
boston_clone 5y ago
I don't think there are any knee jerk assumptions happening; TFA details the differences, including the policy you're referencing. (archived version of the article: https://archive.md/Yvsca https://archive.md/Yvsca) From your linked policy (translated by Apple): >Article 7 Network product providers shall fulfill the following security vulnerability management obligations >(2) Relevant vulnerability information shall be submitted [...] within 2 days In this case, an Alibaba researcher found a bug in an Apache product, so this policy wouldn't seem to apply as Alibaba is not the vendor of the product.
- sudosysgen 5y ago
  Plainly the linked policy does not ask Alibaba to do what the article says it should do, ie, notify the government first, as per machine translation. It seems to say that they should notify the vendor (ie, Apache) as soon as possible, and notify the government within 2 days (according to rfoo they are not at all required to disclose it to the government since it's not their product, but they are encouraged to do so), not that they should notify the government first and then wait for approval to notify Apache. According to google translate: (1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately. (2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products. So according to machine translation, the article is incorrect, and they do not have to notify the CCP first, instead they should have notified Apache first, and then the government within 2 days.

tom_dancer 5y ago

yesbut 5y ago

kelnos 5y ago
I agree, but I think there's good reason. There's a lot of well-justified fear and expectation that China will become the next world superpower, and an authoritarian government in that position isn't great for other sovereign states' autonomy and ability to adhere to and promote democratic principles.
- yesbut 5y ago
  - anothernewdude 5y ago
    Whatabout the rest?
    - yesbut 5y ago
      A great starter book on the topic you can download directly from CIA.gov: Killing Hope: Military and CIA Interventions Since World War II, William Blum https://www.cia.gov/library/abbottabad-compound/13/130AEF1531746AAD6AC03EF59F91E1A1_Killing_Hope_Blum_William.pdf https://www.cia.gov/library/abbottabad-compound/13/130AEF153...
  - dmix 5y ago
    This is always the answer that China defenders give. Always. Regardless of content or context. The problem is there’s way more countries in the world than China and America.
    - sudosysgen 5y ago
      I'm pretty sure that's the point of the whataboutism. China's rise is mostly a problem if you are aligned to the US or in direct conflict with China, otherwise their influence is not really materially much worse than that of the current hegemon.

ggm 5y ago

Do people really think AWS did not report to the federal agencies about potential risks? If AWS didn't then their contract for service is deficient. If they had risks which affected their stock price they had obligations to other agencies too. The department of commerce, the federal communications agency, the US Cert, you name it. Please, no accusations of whataboutery: I am trying to point out that if you are big enough to have economically relevant importance, OR if you supply goods and services to the state, any state, you have obligations in that state relationship. if I was in government in China and ali baba cloud didn't check in, I might be witholding business too.

akyoan 5y ago

Absolutely shameless. I’m glad that they’re doing this in the complete open instead of painting themselves as the good guys (unlike, ahem, other western countries)

neonate 5y ago

https://archive.md/Yvsca https://archive.md/Yvsca

Borrible 5y ago

Would love to know whether their Specialized military network warfare forces and PLA - authorized forces knew about the flaw beforehand.

pagutierrezn 5y ago

>And since so many people are now a threat to him, his selection criteria for people to lead different parts of the party and government has to be based entirely on loyalty rather than competence. >Which almost guarantees a lot of counter productive incompetence. This applies to every goverment and public institution regardless of its democratic roots