3 ms·
Anyone who has worked with Chinese companies operating within China can tell you that very similar laws were enacted a year ago. The CCP has a law that any vuln
by no-dr-onboard 4y ago
Anyone who has worked with Chinese companies operating within China can tell you that very similar laws were enacted a year ago. The CCP has a law that any vulnerabilities made aware to private companies need to be disclosed to the federal government. This was done in the name of "national security". IMO, this seems to be a more veiled version of that same mindset.
http://www.cac.gov.cn/2021-07/13/c_1627761607640342.htm http://www.cac.gov.cn/2021-07/13/c_1627761607640342.htm
https://www.cpomagazine.com/cyber-security/is-china-looking-to-stockpile-zero-days-new-vulnerability-disclosure-rules-could-create-closed-pipeline-from-security-researchers-to-ccp/ https://www.cpomagazine.com/cyber-security/is-china-looking-...
- adamckay 4y agoThis is the opposite, though. It's a part of the UK's security services running scans for vulnerabilities they already know about to tell you that you've got an issue.
- franga2000 4y agoI was about to say how great I think that law is, but then I checked the link you provided... > anything discovered in the country must now be reported to the CCP *and to no one else* (in most cases). The "no one else" part is terrible and completely changes the story. However, I do generally support a "tell the government about discovered vulnerabilities" law. Ideally, the government would then inform affected users and investigate whether the vuln could be considered negligence and the company prosecuted. I've been in a few situations where I reported very easily exploitable vulns that leaked sensitive user data and in all cases, I couldn't for the life of me convince the companies to disclose the leak. Yes, I could've gone public myself where I didn't have a contract, but I would've 100% ended up in jail for some poorly defined crime of "hacking".