7 ms·

I'm surprised HN is full of knee jerk assumption without first checking what the government required disclosure policy is. Here it is: Verify. Report to 'vendo

I'm surprised HN is full of knee jerk assumption without first checking what the government required disclosure policy is. Here it is: Verify. Report to 'vendor'. Immediately. Report to government including an analysis within 2 days. Link to policy: http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Link to past HN comment on this on another story on this topic: https://news.ycombinator.com/item?id=29653352 https://news.ycombinator.com/item?id=29653352

marderfarker2 5y ago
- ycombinete 5y ago
  There is usually a contingent of counter-jerkers that balance things out, with equally unsubstantiated commentary. This hyperbole is expected on any politically polarising topic.
boston_clone 5y ago
I don't think there are any knee jerk assumptions happening; TFA details the differences, including the policy you're referencing. (archived version of the article: https://archive.md/Yvsca https://archive.md/Yvsca) From your linked policy (translated by Apple): >Article 7 Network product providers shall fulfill the following security vulnerability management obligations >(2) Relevant vulnerability information shall be submitted [...] within 2 days In this case, an Alibaba researcher found a bug in an Apache product, so this policy wouldn't seem to apply as Alibaba is not the vendor of the product.
- sudosysgen 5y ago
  Plainly the linked policy does not ask Alibaba to do what the article says it should do, ie, notify the government first, as per machine translation. It seems to say that they should notify the vendor (ie, Apache) as soon as possible, and notify the government within 2 days (according to rfoo they are not at all required to disclose it to the government since it's not their product, but they are encouraged to do so), not that they should notify the government first and then wait for approval to notify Apache. According to google translate: (1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately. (2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products. So according to machine translation, the article is incorrect, and they do not have to notify the CCP first, instead they should have notified Apache first, and then the government within 2 days.
  - rfoo 5y ago
    > and then the government within 2 days. That's wrong. According to the text Alibaba is not required to report the bug to government at all. The 2 days term apply to "domestic network product provider" which would be ASF/log4j maintainers in this case. But they are not domestic so this does not apply.
    - oefrha 5y ago
      Alibaba Cloud, like the other big clouds, has many Java-based products. They’re certainly the vendor of their own vulnerable Java-based products. Whether some other party wrote the code in question doesn’t change that.
      - rfoo 5y ago
        Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products. AFAIK when the bug became popular on Dec 9, there are still many Java-based services running by Alibaba Cloud remain unfixed, and it caused chaos and panic among their "SRE"s. However reading the regulation text again, now I'm not sure in this case what Alibaba should report: > （二）应当在2日内向工业和信息化部网络安全威胁和漏洞信息共享平台报送相关漏洞信息。报送内容应当包括存在网络产品安全漏洞的产品名称、型号、版本以及漏洞的技术特点、危害和影响范围等。 It said they should report "the name, type and version of the product with the vulnerability, the 'technical characteristics' of the vulnerability and the impact". Does this mean, Alibaba should report, for example: "Alibaba Cloud hosted Apache Flink stream computing service (whatever brand name they use) contains a pre-auth critical RCE vulnerability due to insecure processing of user input in version a.b.c till x.y.z"? I'm not seeing how could the government know what the bug really is if "the product" means Alibaba Cloud's own product.
    - sudosysgen 5y ago
      Thanks for the correction. I am not convinced however, if Alibaba ships a single product with Log4J it would be their own product too.
      - rfoo 5y ago
- deleted 5y ago
  [deleted]
smokey_circles 5y ago
Why does the Chinese Government need to be told _at all_? You're saying that doesn't seem strange to you? The government busy silently exterminating a people and who employ mass surveillance and other obvious human rights violations, that they ask for cyber vulnerabilities to be specifically delivered to them doesn't register a reaction with you at all?
- marderfarker2 5y ago
- beambot 5y ago
  To be fair... CERT has affiliations with the US government. https://en.wikipedia.org/wiki/CERT_Coordination_Center https://en.wikipedia.org/wiki/CERT_Coordination_Center > The CERT Coordination Center (CERT/CC) is the coordination center of the computer emergency response team (CERT) for the Software Engineering Institute (SEI), a non-profit United States federally funded research and development center.
dopa42365 5y ago
randomly hating 20% of the worlds population for being born in the WRONG country? seems reasonable!
- garbagetime 5y ago
  What's this comment made in reference to?
- deleted 5y ago
  [deleted]
- rblatz 5y ago
  You can dislike the actions of a government without hating the people governed by that government.
  - 3np 5y ago
    I think one has to be really careful about the language one uses. To step above this, I urge everyone to not criticize "China" (which, while often intended to address the administration, can easily be interpreted as the country as such and its population) but instead be more precise with "the CCP", "the PRC administration", or similar. Similarly, just talking about "China" as opposed to "The PRC" opens it up to inclusion of Taiwan and other territories not de-facto part of the nation. So many people attach their identity to their country of origin or citizenship. You can think of that what you want, but by avoiding "attacking the country" verbally, you shield your argument from that flavor of wumao vitriol. The OP does this right: "CCP pulls support", not "China pulls support". I see a similar thing with Israel - don't want to be portrayed as antisemitic? Address the administration, not the country.
    - prmoustache 5y ago
      man synecdoche
      - iszomer 5y ago
        Learned a new word..
gscott 5y ago
Well... https://amp.scmp.com/tech/article/2138114/china-discourages-its-cybersecurity-experts-global-hacking-competitions https://amp.scmp.com/tech/article/2138114/china-discourages-...
- authed 5y ago
  de-amped link, I think: https://www.scmp.com/tech/article/2138114/china-discourages-its-cybersecurity-experts-global-hacking-competitions https://www.scmp.com/tech/article/2138114/china-discourages-...
refurb 5y ago
Sure, Alibaba broke the law. But there is no rule of law in China. If laws were truly enforced the entire system would collapse. This was using the law as a weapon to keep companies in check. If this had been another company firmly in the pocket of the CCP, this would have been overlooked and never made public.
- curiousgal 5y ago
  > But there is no rule of law in China. Shit HN says. Can we avoid making such blanket statements, please and thank you.
  - space_rock 5y ago
    Define rule of laws? Most people don't consider a system where judge, jury and executioner are a single political party that cannot be criticised. If this is rule of law then it's the lowest bar possible

marderfarker2 5y ago

ycombinete 5y ago
There is usually a contingent of counter-jerkers that balance things out, with equally unsubstantiated commentary. This hyperbole is expected on any politically polarising topic.

boston_clone 5y ago

I don't think there are any knee jerk assumptions happening; TFA details the differences, including the policy you're referencing. (archived version of the article: https://archive.md/Yvsca https://archive.md/Yvsca) From your linked policy (translated by Apple): >Article 7 Network product providers shall fulfill the following security vulnerability management obligations >(2) Relevant vulnerability information shall be submitted [...] within 2 days In this case, an Alibaba researcher found a bug in an Apache product, so this policy wouldn't seem to apply as Alibaba is not the vendor of the product.

sudosysgen 5y ago
Plainly the linked policy does not ask Alibaba to do what the article says it should do, ie, notify the government first, as per machine translation. It seems to say that they should notify the vendor (ie, Apache) as soon as possible, and notify the government within 2 days (according to rfoo they are not at all required to disclose it to the government since it's not their product, but they are encouraged to do so), not that they should notify the government first and then wait for approval to notify Apache. According to google translate: (1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately. (2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products. So according to machine translation, the article is incorrect, and they do not have to notify the CCP first, instead they should have notified Apache first, and then the government within 2 days.
- rfoo 5y ago
  > and then the government within 2 days. That's wrong. According to the text Alibaba is not required to report the bug to government at all. The 2 days term apply to "domestic network product provider" which would be ASF/log4j maintainers in this case. But they are not domestic so this does not apply.
  - oefrha 5y ago
    Alibaba Cloud, like the other big clouds, has many Java-based products. They’re certainly the vendor of their own vulnerable Java-based products. Whether some other party wrote the code in question doesn’t change that.
    - rfoo 5y ago
      Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products. AFAIK when the bug became popular on Dec 9, there are still many Java-based services running by Alibaba Cloud remain unfixed, and it caused chaos and panic among their "SRE"s. However reading the regulation text again, now I'm not sure in this case what Alibaba should report: > （二）应当在2日内向工业和信息化部网络安全威胁和漏洞信息共享平台报送相关漏洞信息。报送内容应当包括存在网络产品安全漏洞的产品名称、型号、版本以及漏洞的技术特点、危害和影响范围等。 It said they should report "the name, type and version of the product with the vulnerability, the 'technical characteristics' of the vulnerability and the impact". Does this mean, Alibaba should report, for example: "Alibaba Cloud hosted Apache Flink stream computing service (whatever brand name they use) contains a pre-auth critical RCE vulnerability due to insecure processing of user input in version a.b.c till x.y.z"? I'm not seeing how could the government know what the bug really is if "the product" means Alibaba Cloud's own product.
  - sudosysgen 5y ago
    Thanks for the correction. I am not convinced however, if Alibaba ships a single product with Log4J it would be their own product too.
    - rfoo 5y ago
deleted 5y ago
[deleted]

smokey_circles 5y ago

Why does the Chinese Government need to be told _at all_? You're saying that doesn't seem strange to you? The government busy silently exterminating a people and who employ mass surveillance and other obvious human rights violations, that they ask for cyber vulnerabilities to be specifically delivered to them doesn't register a reaction with you at all?

marderfarker2 5y ago
beambot 5y ago
To be fair... CERT has affiliations with the US government. https://en.wikipedia.org/wiki/CERT_Coordination_Center https://en.wikipedia.org/wiki/CERT_Coordination_Center > The CERT Coordination Center (CERT/CC) is the coordination center of the computer emergency response team (CERT) for the Software Engineering Institute (SEI), a non-profit United States federally funded research and development center.

dopa42365 5y ago

randomly hating 20% of the worlds population for being born in the WRONG country? seems reasonable!

garbagetime 5y ago
What's this comment made in reference to?
deleted 5y ago
[deleted]
rblatz 5y ago
You can dislike the actions of a government without hating the people governed by that government.
- 3np 5y ago
  I think one has to be really careful about the language one uses. To step above this, I urge everyone to not criticize "China" (which, while often intended to address the administration, can easily be interpreted as the country as such and its population) but instead be more precise with "the CCP", "the PRC administration", or similar. Similarly, just talking about "China" as opposed to "The PRC" opens it up to inclusion of Taiwan and other territories not de-facto part of the nation. So many people attach their identity to their country of origin or citizenship. You can think of that what you want, but by avoiding "attacking the country" verbally, you shield your argument from that flavor of wumao vitriol. The OP does this right: "CCP pulls support", not "China pulls support". I see a similar thing with Israel - don't want to be portrayed as antisemitic? Address the administration, not the country.
  - prmoustache 5y ago
    man synecdoche
    - iszomer 5y ago
      Learned a new word..

gscott 5y ago

Well... https://amp.scmp.com/tech/article/2138114/china-discourages-its-cybersecurity-experts-global-hacking-competitions https://amp.scmp.com/tech/article/2138114/china-discourages-...

authed 5y ago
de-amped link, I think: https://www.scmp.com/tech/article/2138114/china-discourages-its-cybersecurity-experts-global-hacking-competitions https://www.scmp.com/tech/article/2138114/china-discourages-...

refurb 5y ago

Sure, Alibaba broke the law. But there is no rule of law in China. If laws were truly enforced the entire system would collapse. This was using the law as a weapon to keep companies in check. If this had been another company firmly in the pocket of the CCP, this would have been overlooked and never made public.

curiousgal 5y ago
> But there is no rule of law in China. Shit HN says. Can we avoid making such blanket statements, please and thank you.
- space_rock 5y ago
  Define rule of laws? Most people don't consider a system where judge, jury and executioner are a single political party that cannot be criticised. If this is rule of law then it's the lowest bar possible