5 ms·

The malware is a cherry on top, but the story before that is pretty awful already, and unfortunately seems to be representative of specialized software like tha

The malware is a cherry on top, but the story before that is pretty awful already, and unfortunately seems to be representative of specialized software like that: proprietary (with constant risk of malware, indeed), awkward, poorly (if at all) documented, likely the protocols to speak to the hardware without it are kept in secret, and occasional shipment of Windows machines where just software would do (but probably it's written to just barely work on a given system, and won't run on others easily). I think the main and annoying problem is those general practices, not just a single instance of malware. Edit: Apparently some focus on the "Chinese" part, but I suspect that hardware being specialized and software being shipped by the hardware manufacturer are larger factors here: at least all the awkwardness before the malware part I've observed to be approximately similar with hardware+software produced by Chinese, European, and US companies.

StreamBright 5y ago
> proprietary (with constant risk of malware, indeed) being proprietary has nothing to do with risk of malware, indeed
- defanor 5y ago
  To be precise, I had in mind closed-source software: the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And especially in case of specialized software, that wasn't inspected by others either. Though these terms seem to be used interchangeably quite commonly [1], likely because of a strong correlation. [1] https://en.wikipedia.org/wiki/Proprietary_software https://en.wikipedia.org/wiki/Proprietary_software Edit: wording.
  - karmoka 5y ago
    Proprietary or open sourced doesn't matter much if you're not verifying the checksums of all the binaries that come per-installed on your system. If the majority of tech savvy people can't be bothered to do it, then average joe is doomed.
  - ChrisLomont 5y ago
    >the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.
    - emiliobumachar 5y ago
      For a whole computer stack, that's true enough. Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.
      - ChrisLomont 5y ago
        I don't think that's true. Care to pick some metric to check it? If anything, having source also makes it easier to auto scan for flaws at the source level and find holes. I know from CVEs that OS projects has a significant number of high profile long standing holes in it.
      - squarefoot 5y ago
        > Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source. Case in point, the famous Borland InterBase backdoor that went unnoticed for about 7 years and 3 versions of the software but was discovered in 8 months by one developer after Borland released InterBase as Open Source. https://www.zdnet.com/article/borland-interbase-backdoor-detected/ https://www.zdnet.com/article/borland-interbase-backdoor-det...
      - StreamBright 5y ago
        > Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source. Citation needed. On the other hand: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
    - defanor 5y ago
      I think the context somehow gets lost in this discussion. You indeed need a chain of trust in general, and can't inspect all the software alone even if it's FLOSS, but I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about) and similar one-off ones that come from an untrusted source: there's no trust there, no reliance on others inspecting it, but if you have the source code, it's often reasonable to read. Also occasionally desirable to fix or otherwise modify, to integrate into your overall system (that's what I tend to do pretty much each time when interacting with such sotfware+hardware, sometimes reverse engineering and reimplementing it, so maybe my view is a bit skewed). So FLOSS is good, closed source and proprietary is less trustworthy and less usable.
  - StreamBright 5y ago
    > the software you can't inspect with reasonable effort/time before running What was the last time you inspected any command or application you executed on your computer? How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running? You have absolutely unrealistic view on this subject. Btw. Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.
    - defanor 5y ago
      I'm surprised how this discussion turns out: didn't expect those bits to be controversial at all, and sibling comments make it sound like it's almost better to not have access to sources. > What was the last time you inspected any command or application you executed on your computer? A few months ago, and didn't run new code from untrusted sources since. > How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running? So far I haven't run into languages I can't read. Spotting malicious code could indeed be tricky, a subtle but critical vulnerability would easily evade quick skimming, just as malware is still possible even when it comes from a somewhat trusted source. But I'm more certain that a program does what it says it does after skimming its code. > Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables. That's how basic antiviruses work, not specific to Apple. They have to first add that checksum into a database, which isn't viable when we're talking about a small hardware manufacturer shipping their custom software to dozens of clients.
  - StreamBright 5y ago
    It took only 13 years to spot this in a FOSS project: https://linux.slashdot.org/story/22/01/25/2259214/major-linux-policykit-security-vulnerability-uncovered-pwnkit https://linux.slashdot.org/story/22/01/25/2259214/major-linu...
toyg 5y ago
Tbf, the focus on secrecy is probably because everything in China is at risk of being copied / ripped off by competitors at the drop of a hat. Being an IP wild west has its drawbacks.
- dathinab 5y ago
  The problem is this approaches tend to not really prevent the rip of as any of this obscuring methods tend to not hold against someone with expertise in subverting them. Which companies which do this kind of rip-offs tend to have...
- bsder 5y ago
  A pick and place really is one of those things that would benefit from being open source--the vision algorithms are very annoying and require high technical skill while the motion algorithms are stupid simple.

StreamBright 5y ago

> proprietary (with constant risk of malware, indeed) being proprietary has nothing to do with risk of malware, indeed

defanor 5y ago
To be precise, I had in mind closed-source software: the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And especially in case of specialized software, that wasn't inspected by others either. Though these terms seem to be used interchangeably quite commonly [1], likely because of a strong correlation. [1] https://en.wikipedia.org/wiki/Proprietary_software https://en.wikipedia.org/wiki/Proprietary_software Edit: wording.
- karmoka 5y ago
  Proprietary or open sourced doesn't matter much if you're not verifying the checksums of all the binaries that come per-installed on your system. If the majority of tech savvy people can't be bothered to do it, then average joe is doomed.
- ChrisLomont 5y ago
  >the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.
  - emiliobumachar 5y ago
    For a whole computer stack, that's true enough. Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.
    - ChrisLomont 5y ago
      I don't think that's true. Care to pick some metric to check it? If anything, having source also makes it easier to auto scan for flaws at the source level and find holes. I know from CVEs that OS projects has a significant number of high profile long standing holes in it.
    - squarefoot 5y ago
      > Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source. Case in point, the famous Borland InterBase backdoor that went unnoticed for about 7 years and 3 versions of the software but was discovered in 8 months by one developer after Borland released InterBase as Open Source. https://www.zdnet.com/article/borland-interbase-backdoor-detected/ https://www.zdnet.com/article/borland-interbase-backdoor-det...
    - StreamBright 5y ago
      > Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source. Citation needed. On the other hand: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
  - defanor 5y ago
    I think the context somehow gets lost in this discussion. You indeed need a chain of trust in general, and can't inspect all the software alone even if it's FLOSS, but I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about) and similar one-off ones that come from an untrusted source: there's no trust there, no reliance on others inspecting it, but if you have the source code, it's often reasonable to read. Also occasionally desirable to fix or otherwise modify, to integrate into your overall system (that's what I tend to do pretty much each time when interacting with such sotfware+hardware, sometimes reverse engineering and reimplementing it, so maybe my view is a bit skewed). So FLOSS is good, closed source and proprietary is less trustworthy and less usable.
- StreamBright 5y ago
  > the software you can't inspect with reasonable effort/time before running What was the last time you inspected any command or application you executed on your computer? How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running? You have absolutely unrealistic view on this subject. Btw. Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.
  - defanor 5y ago
    I'm surprised how this discussion turns out: didn't expect those bits to be controversial at all, and sibling comments make it sound like it's almost better to not have access to sources. > What was the last time you inspected any command or application you executed on your computer? A few months ago, and didn't run new code from untrusted sources since. > How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running? So far I haven't run into languages I can't read. Spotting malicious code could indeed be tricky, a subtle but critical vulnerability would easily evade quick skimming, just as malware is still possible even when it comes from a somewhat trusted source. But I'm more certain that a program does what it says it does after skimming its code. > Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables. That's how basic antiviruses work, not specific to Apple. They have to first add that checksum into a database, which isn't viable when we're talking about a small hardware manufacturer shipping their custom software to dozens of clients.
- StreamBright 5y ago
  It took only 13 years to spot this in a FOSS project: https://linux.slashdot.org/story/22/01/25/2259214/major-linux-policykit-security-vulnerability-uncovered-pwnkit https://linux.slashdot.org/story/22/01/25/2259214/major-linu...

toyg 5y ago

Tbf, the focus on secrecy is probably because everything in China is at risk of being copied / ripped off by competitors at the drop of a hat. Being an IP wild west has its drawbacks.

dathinab 5y ago
The problem is this approaches tend to not really prevent the rip of as any of this obscuring methods tend to not hold against someone with expertise in subverting them. Which companies which do this kind of rip-offs tend to have...
bsder 5y ago
A pick and place really is one of those things that would benefit from being open source--the vision algorithms are very annoying and require high technical skill while the motion algorithms are stupid simple.