5 ms·

* Huawei sells better and cheaper network hardware than anyone else. * The US has previously kept Huawei's market share at bay using every political trick in t

* Huawei sells better and cheaper network hardware than anyone else. * The US has previously kept Huawei's market share at bay using every political trick in the book, but the US's reach only goes so far, and other nations are buying large amounts of Huawei hardware, making it even better and cheaper. * Modern mobile networks work far better if you buy all the gear from one company. That makes it even harder to persuade companies not to use huawei gear. It also makes it even harder for competitors, who now have dwindling sales, to keep up.

kyrra 3y ago
The UK did a good job writing this up in a security report. It's not just a baseless attack, Huawei has poor software engineering practices. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2020 https://www.gov.uk/government/publications/huawei-cyber-secu...
- londons_explore 3y ago
  Sure - but security isn't the major focus for many buyers. As long as it routes data from A to B and can keep the population connected, many governments and companies are happy to take the increased spy-risk in return for lower costs. Lets be honest, the future is end-2-end encryption and a dumb network, and then the security of the network becomes far less important.
  - sodality2 3y ago
    Never overlook the ex NSA chief Hayden’s timeless remark: “We kill people based on metadata”. Owning or controlling these dumb pipes still means wielding enormous amounts of power, political or military.
  - kube-system 3y ago
    There's not a network out there that won't work smoothly without support. Hardware breaks, software breaks, vulnerabilities are found. When sanctions ratchet up or bombs start falling, which support contract is still honored?
    - blitzar 3y ago
      > When sanctions ratchet up or bombs start falling, which support contract is still honored? The contract with the company owned by the right honourable member of the house of lords of course. Not only will they fulfill the contract at the highest possible price, but they will fulfill it with the cheapest, least compliant product possible and worry about being sued later ...
- vlovich123 3y ago
  As someone who’s seen the code for Qualcomm’s cellular modem (granted in 2009) and worked with their engineers, it would be impressive if it was tangible worse. I think we should be clear about the strategic threat of having a foreign company own telecommunication infrastructure, but that’s technically true for US allies as well. The main distinction is that China is not an ally. Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well (& doesn’t touch the question of who owns the infrastructure).
  - girvo 3y ago
    As someone who works with cell modems from basically all major and a couple minor manufacturers (mostly NB-IoT and 2G but not just) — they’re all bug ridden crap lol
  - thaumasiotes 3y ago
    > Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well It can't even theoretically accomplish much given easy naturalization.
  - mderazon 3y ago
    Honest question, if all communication is E2E encrypted (it's not, but let's assume), what's the risk of foreign countries controlling the infra ?
    - kredd 3y ago
      At the very least, the ability to bring down the public comm channels is pretty risky.
    - myself248 3y ago
      1: Simply bringing it down. If tensions escalate and someone has the ability to cripple their adversary's communications, obviously it's a string they can only pull once, but knowing they can pull it when the time is right, is a big deal. 2: E2EE doesn't insulate you from baseband vulnerabilities. You can think of a modern phone as having two processors, though in practice it's many more, think of the Application Processor (AP) and the Baseband (BB). The AP is basically the CPU that user code runs on. The baseband (so called because it deals with the radio signals once they've been downconverted from their broadband modulations) is sort of like a NIC, it provides connectivity to the main CPU. Now, if you're familiar with server NICs, imagine a server BMC that has god-level access to the hardware on which the application runs. That's roughly how the baseband is situated in the phone. Obviously you'd only connect such a BMC to an internal management network that's only accessible to trusted parties, right? Not to one that your adversary controls? YEahhhhh. If the adversary controls the cellular network and talks directly to the BB/BMC, it doesn't matter how secure the AP/CPU is, it's game over.
- croes 3y ago
  > It's not just a baseless attack, Huawei has poor software engineering practices. Incompetence is not malice or do you accuse Cisco of the same thing?
bastawhiz 3y ago
> Modern mobile networks work far better if you buy all the gear from one company The web is a lot easier to build for if you only support one browser! /s
- BHSPitMonkey 3y ago
  I don't understand the /s tag here. Both statements are categorically true; These facts just have consequences we don't like, and somehow must go out of our way to counteract if we care about our ideals.
  - kortilla 3y ago
    No, they aren’t “categorically true”. Anyone who has worked with big vendors know they manage to fuck up fully vertically integrated protocols. Vendors skipping standards and using proprietary stuff allows them to get way to sloppy and stuff has a habit of becoming unstable or hard to debug.
  - bastawhiz 3y ago
    My statement, at least, is categorically untrue. I had the displeasure of building for the web in the time before Firefox became mainstream. IE6 was essentially the only option. And it sucked! No competition meant bugs didn't get fixed. The web was IE and Microsoft couldn't give a flying fuck whether it followed the standard let alone behaved consistently even between page loads of the same site.
    - BHSPitMonkey 3y ago
      But no matter how good or bad a particular browser is, you still have less work to do if you only care about users on a single browser (compared to that browser _and_ other browsers). Even if the other N-1 browsers have no quirks relative to the first one, that's still more testing to do and support to give. It's objectively easier to target fewer platforms, which is why you see the laziest web developers put up warnings (or even block requests) for clients with the "wrong" User-Agent strings.
  - 3y ago
COGlory 3y ago
>Modern mobile networks work far better if you buy all the gear from one company Do they really? How resilient/robust is such a network? What does "better" mean in this context?
- londons_explore 3y ago
  It's akin to everyone in a company using outlook and an exchange server, vs everyone using a variety of mail clients and a mixture of server software. A bunch of features only work well if everyone uses outlook (integration with address books, calendars, free/busy info, auto video call invites, recalling messages). And you're gonna have far more headaches if you try to run a mis-mash of different servers and clients - although it is technically possible to get it all working.
  - mbreese 3y ago
    But that’s the point of standardization. You are trying to ensure that the core functionality works for everyone regardless of who the vendor is. A mobile network much more akin to SMTP/IMAP than it is to intra office calendaring (but even then, CalDAV might have an opinion to offer). But this interoperability requires standards and vendors to adhere to those standards. But the only way you can get true interoperability is to test it, which is what this funding is about (IIUC).
    - g_p 3y ago
      Absolutely. Part of the challenge is that Open RAN opens up more (and new) interfaces that have to "play nice" and interoperate. Another part of the challenge is the commercial business models part - monolithic RAN vendors can integrate vertically and horizontally to offer a fully tested suite that goes beyond just what's in the standards. To get like-for-like performance in things that matter, you often need more than the base standards. For example there's all manner of proprietary data exchanged between radios to coordinate performance and interference, which is vendor proprietary. That's needed to win an edge over others and win contracts, in the eyes of big vendors. The issue right now is that even just getting 2 standardised boxes to work together needs exactly that testing you refer to - different versions of ASN.1 schemas for example, can break interop. There's often vendor tweaks to edge cases to fix interop. In the old world of a single vendor networks there was some "goods out" testing carried out on equipment to ensure it worked together as a solution. When you buy components and put them together, you need to do that testing (hence labs like this). One final interesting challenge will be around funding future R&D. Big telecoms vendors need to invest many billions per "G" to keep up and get patents into standards. Open RAN is likely to drive disaggregation and cost savings for operators, which will reduce margin and "fat" in contracts. That might make it harder for innovation in the "next big thing", if they can't make a profit from charging a margin on some COTS servers or software platform. Which isn't to say that more competition is a bad thing, but just that disaggregation might cause a slow-down in future innovation if reduced margins can't sustain it. Operators want Open RAN for cost savings, and that means someone's margin needs squeezed.
tick_tock_tick 3y ago
No one cares; in the end no one is going to use it. It's just not worth the risk.
SV_BubbleTime 3y ago
>Huawei sells better and cheaper network hardware than anyone else. “Better” well put aside for the moment. Why do you think it’s cheaper?
- thaumasiotes 3y ago
  Economies of scale, lower labor costs, and lower materials costs?
  - SV_BubbleTime 3y ago
    State-funded, information dominance, exploitive labor?
tw04 3y ago
>* Huawei sells better and cheaper network hardware than anyone else. If you spend a decade spending 10s of millions of dollars (or more) on R&D into cellular networks, and then I just take all of your findings and build a competing product, do you think I can sell my product for less money? If we assume all network gear is backdoored (it isn't but let's just assume it is because I know that will be the retort) would you rather the backdoor be controlled by a friendly, democratic nation, or an openly hostile, expansionist, quasi-communist/quasi-dicatorship? If you answer both of those questions truthfully, on what planet and by what logic would you suggest the world standardize on Huawei networking gear?
- lmz 3y ago
  > If you spend a decade spending 10s of millions of dollars (or more) on R&D into cellular networks, and then I just take all of your findings and build a competing product, do you think I can sell my product for less money? This argument would be more convincing if the others had a competing product first, but it seems like they don't.
  - p_l 3y ago
    US vendors were happy playing margin games to satisfy stick markets and then Huawei dropped the bomb in form of end to end solution to update ones network. Turns out telcos did have appetite to upgrade in quite a lot of places..
  - tw04 3y ago
    >This argument would be more convincing if the others had a competing product first, but it seems like they don't. They literally stole all of Nortel's IP, and then hired away their engineers once they had employee data and knew who was working on 5G. But other than that, I guess nobody "had a competing product first". https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s-greatest-tech-company-1.1459269 https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s...
    - blitzar 3y ago
      Its how the USA was built, seems a bit unfair to hold China to a different standard.

kyrra 3y ago

The UK did a good job writing this up in a security report. It's not just a baseless attack, Huawei has poor software engineering practices. https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2020 https://www.gov.uk/government/publications/huawei-cyber-secu...

londons_explore 3y ago
Sure - but security isn't the major focus for many buyers. As long as it routes data from A to B and can keep the population connected, many governments and companies are happy to take the increased spy-risk in return for lower costs. Lets be honest, the future is end-2-end encryption and a dumb network, and then the security of the network becomes far less important.
- sodality2 3y ago
  Never overlook the ex NSA chief Hayden’s timeless remark: “We kill people based on metadata”. Owning or controlling these dumb pipes still means wielding enormous amounts of power, political or military.
- kube-system 3y ago
  There's not a network out there that won't work smoothly without support. Hardware breaks, software breaks, vulnerabilities are found. When sanctions ratchet up or bombs start falling, which support contract is still honored?
  - blitzar 3y ago
    > When sanctions ratchet up or bombs start falling, which support contract is still honored? The contract with the company owned by the right honourable member of the house of lords of course. Not only will they fulfill the contract at the highest possible price, but they will fulfill it with the cheapest, least compliant product possible and worry about being sued later ...
vlovich123 3y ago
As someone who’s seen the code for Qualcomm’s cellular modem (granted in 2009) and worked with their engineers, it would be impressive if it was tangible worse. I think we should be clear about the strategic threat of having a foreign company own telecommunication infrastructure, but that’s technically true for US allies as well. The main distinction is that China is not an ally. Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well (& doesn’t touch the question of who owns the infrastructure).
- girvo 3y ago
  As someone who works with cell modems from basically all major and a couple minor manufacturers (mostly NB-IoT and 2G but not just) — they’re all bug ridden crap lol
- thaumasiotes 3y ago
  > Canada actually has rules about telecom companies needing to be owned by Canadians but I don’t think that’s served them all that well It can't even theoretically accomplish much given easy naturalization.
- mderazon 3y ago
  Honest question, if all communication is E2E encrypted (it's not, but let's assume), what's the risk of foreign countries controlling the infra ?
  - kredd 3y ago
    At the very least, the ability to bring down the public comm channels is pretty risky.
  - myself248 3y ago
    1: Simply bringing it down. If tensions escalate and someone has the ability to cripple their adversary's communications, obviously it's a string they can only pull once, but knowing they can pull it when the time is right, is a big deal. 2: E2EE doesn't insulate you from baseband vulnerabilities. You can think of a modern phone as having two processors, though in practice it's many more, think of the Application Processor (AP) and the Baseband (BB). The AP is basically the CPU that user code runs on. The baseband (so called because it deals with the radio signals once they've been downconverted from their broadband modulations) is sort of like a NIC, it provides connectivity to the main CPU. Now, if you're familiar with server NICs, imagine a server BMC that has god-level access to the hardware on which the application runs. That's roughly how the baseband is situated in the phone. Obviously you'd only connect such a BMC to an internal management network that's only accessible to trusted parties, right? Not to one that your adversary controls? YEahhhhh. If the adversary controls the cellular network and talks directly to the BB/BMC, it doesn't matter how secure the AP/CPU is, it's game over.
croes 3y ago
> It's not just a baseless attack, Huawei has poor software engineering practices. Incompetence is not malice or do you accuse Cisco of the same thing?

bastawhiz 3y ago

> Modern mobile networks work far better if you buy all the gear from one company The web is a lot easier to build for if you only support one browser! /s

BHSPitMonkey 3y ago
I don't understand the /s tag here. Both statements are categorically true; These facts just have consequences we don't like, and somehow must go out of our way to counteract if we care about our ideals.
- kortilla 3y ago
  No, they aren’t “categorically true”. Anyone who has worked with big vendors know they manage to fuck up fully vertically integrated protocols. Vendors skipping standards and using proprietary stuff allows them to get way to sloppy and stuff has a habit of becoming unstable or hard to debug.
- bastawhiz 3y ago
  My statement, at least, is categorically untrue. I had the displeasure of building for the web in the time before Firefox became mainstream. IE6 was essentially the only option. And it sucked! No competition meant bugs didn't get fixed. The web was IE and Microsoft couldn't give a flying fuck whether it followed the standard let alone behaved consistently even between page loads of the same site.
  - BHSPitMonkey 3y ago
    But no matter how good or bad a particular browser is, you still have less work to do if you only care about users on a single browser (compared to that browser _and_ other browsers). Even if the other N-1 browsers have no quirks relative to the first one, that's still more testing to do and support to give. It's objectively easier to target fewer platforms, which is why you see the laziest web developers put up warnings (or even block requests) for clients with the "wrong" User-Agent strings.
- 3y ago

COGlory 3y ago

>Modern mobile networks work far better if you buy all the gear from one company Do they really? How resilient/robust is such a network? What does "better" mean in this context?

londons_explore 3y ago
It's akin to everyone in a company using outlook and an exchange server, vs everyone using a variety of mail clients and a mixture of server software. A bunch of features only work well if everyone uses outlook (integration with address books, calendars, free/busy info, auto video call invites, recalling messages). And you're gonna have far more headaches if you try to run a mis-mash of different servers and clients - although it is technically possible to get it all working.
- mbreese 3y ago
  But that’s the point of standardization. You are trying to ensure that the core functionality works for everyone regardless of who the vendor is. A mobile network much more akin to SMTP/IMAP than it is to intra office calendaring (but even then, CalDAV might have an opinion to offer). But this interoperability requires standards and vendors to adhere to those standards. But the only way you can get true interoperability is to test it, which is what this funding is about (IIUC).
  - g_p 3y ago
    Absolutely. Part of the challenge is that Open RAN opens up more (and new) interfaces that have to "play nice" and interoperate. Another part of the challenge is the commercial business models part - monolithic RAN vendors can integrate vertically and horizontally to offer a fully tested suite that goes beyond just what's in the standards. To get like-for-like performance in things that matter, you often need more than the base standards. For example there's all manner of proprietary data exchanged between radios to coordinate performance and interference, which is vendor proprietary. That's needed to win an edge over others and win contracts, in the eyes of big vendors. The issue right now is that even just getting 2 standardised boxes to work together needs exactly that testing you refer to - different versions of ASN.1 schemas for example, can break interop. There's often vendor tweaks to edge cases to fix interop. In the old world of a single vendor networks there was some "goods out" testing carried out on equipment to ensure it worked together as a solution. When you buy components and put them together, you need to do that testing (hence labs like this). One final interesting challenge will be around funding future R&D. Big telecoms vendors need to invest many billions per "G" to keep up and get patents into standards. Open RAN is likely to drive disaggregation and cost savings for operators, which will reduce margin and "fat" in contracts. That might make it harder for innovation in the "next big thing", if they can't make a profit from charging a margin on some COTS servers or software platform. Which isn't to say that more competition is a bad thing, but just that disaggregation might cause a slow-down in future innovation if reduced margins can't sustain it. Operators want Open RAN for cost savings, and that means someone's margin needs squeezed.

tick_tock_tick 3y ago

No one cares; in the end no one is going to use it. It's just not worth the risk.

SV_BubbleTime 3y ago

>Huawei sells better and cheaper network hardware than anyone else. “Better” well put aside for the moment. Why do you think it’s cheaper?

thaumasiotes 3y ago
Economies of scale, lower labor costs, and lower materials costs?
- SV_BubbleTime 3y ago
  State-funded, information dominance, exploitive labor?

tw04 3y ago

>* Huawei sells better and cheaper network hardware than anyone else. If you spend a decade spending 10s of millions of dollars (or more) on R&D into cellular networks, and then I just take all of your findings and build a competing product, do you think I can sell my product for less money? If we assume all network gear is backdoored (it isn't but let's just assume it is because I know that will be the retort) would you rather the backdoor be controlled by a friendly, democratic nation, or an openly hostile, expansionist, quasi-communist/quasi-dicatorship? If you answer both of those questions truthfully, on what planet and by what logic would you suggest the world standardize on Huawei networking gear?

lmz 3y ago
> If you spend a decade spending 10s of millions of dollars (or more) on R&D into cellular networks, and then I just take all of your findings and build a competing product, do you think I can sell my product for less money? This argument would be more convincing if the others had a competing product first, but it seems like they don't.
- p_l 3y ago
  US vendors were happy playing margin games to satisfy stick markets and then Huawei dropped the bomb in form of end to end solution to update ones network. Turns out telcos did have appetite to upgrade in quite a lot of places..
- tw04 3y ago
  >This argument would be more convincing if the others had a competing product first, but it seems like they don't. They literally stole all of Nortel's IP, and then hired away their engineers once they had employee data and knew who was working on 5G. But other than that, I guess nobody "had a competing product first". https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s-greatest-tech-company-1.1459269 https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s...
  - blitzar 3y ago
    Its how the USA was built, seems a bit unfair to hold China to a different standard.