5 ms·

"Currently there is no economical or timely way of ascertaining if a manufacturer's specifications have been altered during the manufacturing process (99% of ch

"Currently there is no economical or timely way of ascertaining if a manufacturer's specifications have been altered during the manufacturing process (99% of chips are manufactured in China)," That claim about 99% of chips being manufactured in China is very easy to verify as being utterly false. I have to wonder about the trustworthiness of the rest. - kryptiskt, http://news.ycombinator.com/item?id=4030818 http://news.ycombinator.com/item?id=4030818 It has actually not been "very easy" for me to verify this, but I did find something saying that in 2009, China had 9% of the world's production capacity, which makes me strongly doubt that they are now 99% of the actual manufacturing amount: http://www.manufacturingnews.com/news/10/0212/semiconductors.html http://www.manufacturingnews.com/news/10/0212/semiconductors... @tptacek: Care to provide references for why Cambridge Security Lab is as big a deal as you're making them out to be, and why we should overlook this blatantly exaggerated fact they cited?

coopdog 14y ago
Does Taiwan count as part of China? A brief look at the Taiwan-China relationship shows it's a more difficult question than it initially seems
- mng2 14y ago
  According to China (the People's Republic of China), Taiwan (the Republic Of China) is a "renegade province." Both the PRC and the ROC claim that they are the legitimate government of China. In the US, ever since Nixon instituted the "two China" policy, China is always taken to mean the PRC. Perhaps the security researchers are not aware of this distinction, but I am also not familiar with how the issue is treated in the British press. Taiwan is a major US ally, so if this backdoor is real, then there will be trouble. It would be best for all parties involved for this to turn out to be a false alarm.
  - nekojima 14y ago
    Nixon acknowledged the "One China" policy, not two, when the US shifted diplomatic support from Taiwan (Republic of China) to mainland China (PRC). Taiwan is not a "major" US ally, rather the US is Taiwan's major ally. The US has several other regional countries it has a significantly greater alliances with, such as Japan, South Korea and Philippines. Though through an act of Congress, the US may (depending on the situation) have some obligations to aid Taiwan in its defense if attacked by mainland China.
    - mng2 14y ago
      My mistake; I knew that didn't sound right when I typed it.
  - nl 14y ago
    The parent's point is that PRC<->Taiwanese relations are more complex than they appear. Words like "renegade province" make it sound like they are sworn enemies, but the parent is right: it is much more complex than that. As a random but relevant example, Foxconn is a Taiwanese company but much of its manufacturing capacity is on the Chinese mainland. Taiwan is politically an ally of the US, but economically it is much more closely aligned with China.
    - mng2 14y ago
      OK, perhaps the parent presented a rhetorical question. I do think that this discussion needs to keep the two governments distinct, so I was trying to give some background. But it seems I may have just muddied the waters by not mentioning how relations are in practice. "Renegade province" is the official stance, but you're right, it is much more complex. In practice Taiwan is autonomous, and the degree of interaction with the mainland is a big political issue -- there were no direct flights between Taiwan and the PRC until just a few years ago. And yet, as you say, Taiwan is economically interlocked with China. It is interesting to see the discussion here and elsewhere focus on China as a bogeyman. I suppose the news fits into the narrative that has been constructed about Chinese espionage and such.
tptacek 14y ago
A hardware security researcher's inability to perform Gartner-correct market research is not relevant to his/her ability to decap, image, and analyze silicon, and thus not at all relevant to me. Wow do I ever not care about this particular gotcha.
- laughinghan 14y ago
  Is that a "no, I cannot provide any reason to take this seriously besides my (arrogant) word and this vague, exaggerated, ugly, poorly coded web page"? This security lab's tendency to exaggerate the seriousness of the security problem they've identified is exactly what is in question here.
  - tptacek 14y ago
    You just evaluated a hardware reversing project in part by the design of its web page. Do you have any background in this field at all?
    - laughinghan 14y ago
      I never evaluated any project by the design of its web page, I evaluated a web page by its design. I never evaluated any project at all, just asked why anyone should take you or this web page seriously, and you have been nothing but dismissive in response.
      - chc 14y ago
        Hacker News Protip: If you click tptacek's name, you can see his profile, which will inform you that he's a computer security professional. That's why anyone should take him seriously. On top of that, he also has a history here of useful and insightful commentary on security issues. That's also why anyone should take him seriously. The reason he's responding dismissively to you is probably that you keep attacking the OP for irrelevant niggles. The sort of reasoning you're employing here would lead someone who saw a speech by Albert Einstein to dismiss it by saying, "Bah, he can't even be bothered to do his hair well. Why should I think he does his research any better?" Attacking Einstein's hair does not make his ideas any less valid. If you had material objections to the OP, you'd probably get a more congenial response.
alecmuffett 14y ago
@laughinghan if you have to ask my suspicion is that no word of mouth will be enough for you, so instead may I recommend: http://en.wikipedia.org/wiki/Ross_J._Anderson http://en.wikipedia.org/wiki/Ross_J._Anderson http://en.wikipedia.org/wiki/Markus_Kuhn http://en.wikipedia.org/wiki/Markus_Kuhn http://en.wikipedia.org/wiki/Steven_Murdoch http://en.wikipedia.org/wiki/Steven_Murdoch ...and http://www.lightbluetouchpaper.org/ http://www.lightbluetouchpaper.org/ ; I am unaffiliated with Cambridge other than knowing a few of the people there.

coopdog 14y ago

Does Taiwan count as part of China? A brief look at the Taiwan-China relationship shows it's a more difficult question than it initially seems

mng2 14y ago
According to China (the People's Republic of China), Taiwan (the Republic Of China) is a "renegade province." Both the PRC and the ROC claim that they are the legitimate government of China. In the US, ever since Nixon instituted the "two China" policy, China is always taken to mean the PRC. Perhaps the security researchers are not aware of this distinction, but I am also not familiar with how the issue is treated in the British press. Taiwan is a major US ally, so if this backdoor is real, then there will be trouble. It would be best for all parties involved for this to turn out to be a false alarm.
- nekojima 14y ago
  Nixon acknowledged the "One China" policy, not two, when the US shifted diplomatic support from Taiwan (Republic of China) to mainland China (PRC). Taiwan is not a "major" US ally, rather the US is Taiwan's major ally. The US has several other regional countries it has a significantly greater alliances with, such as Japan, South Korea and Philippines. Though through an act of Congress, the US may (depending on the situation) have some obligations to aid Taiwan in its defense if attacked by mainland China.
  - mng2 14y ago
    My mistake; I knew that didn't sound right when I typed it.
- nl 14y ago
  The parent's point is that PRC<->Taiwanese relations are more complex than they appear. Words like "renegade province" make it sound like they are sworn enemies, but the parent is right: it is much more complex than that. As a random but relevant example, Foxconn is a Taiwanese company but much of its manufacturing capacity is on the Chinese mainland. Taiwan is politically an ally of the US, but economically it is much more closely aligned with China.
  - mng2 14y ago
    OK, perhaps the parent presented a rhetorical question. I do think that this discussion needs to keep the two governments distinct, so I was trying to give some background. But it seems I may have just muddied the waters by not mentioning how relations are in practice. "Renegade province" is the official stance, but you're right, it is much more complex. In practice Taiwan is autonomous, and the degree of interaction with the mainland is a big political issue -- there were no direct flights between Taiwan and the PRC until just a few years ago. And yet, as you say, Taiwan is economically interlocked with China. It is interesting to see the discussion here and elsewhere focus on China as a bogeyman. I suppose the news fits into the narrative that has been constructed about Chinese espionage and such.

tptacek 14y ago

A hardware security researcher's inability to perform Gartner-correct market research is not relevant to his/her ability to decap, image, and analyze silicon, and thus not at all relevant to me. Wow do I ever not care about this particular gotcha.

laughinghan 14y ago
Is that a "no, I cannot provide any reason to take this seriously besides my (arrogant) word and this vague, exaggerated, ugly, poorly coded web page"? This security lab's tendency to exaggerate the seriousness of the security problem they've identified is exactly what is in question here.
- tptacek 14y ago
  You just evaluated a hardware reversing project in part by the design of its web page. Do you have any background in this field at all?
  - laughinghan 14y ago
    I never evaluated any project by the design of its web page, I evaluated a web page by its design. I never evaluated any project at all, just asked why anyone should take you or this web page seriously, and you have been nothing but dismissive in response.
    - chc 14y ago
      Hacker News Protip: If you click tptacek's name, you can see his profile, which will inform you that he's a computer security professional. That's why anyone should take him seriously. On top of that, he also has a history here of useful and insightful commentary on security issues. That's also why anyone should take him seriously. The reason he's responding dismissively to you is probably that you keep attacking the OP for irrelevant niggles. The sort of reasoning you're employing here would lead someone who saw a speech by Albert Einstein to dismiss it by saying, "Bah, he can't even be bothered to do his hair well. Why should I think he does his research any better?" Attacking Einstein's hair does not make his ideas any less valid. If you had material objections to the OP, you'd probably get a more congenial response.

alecmuffett 14y ago

@laughinghan if you have to ask my suspicion is that no word of mouth will be enough for you, so instead may I recommend: http://en.wikipedia.org/wiki/Ross_J._Anderson http://en.wikipedia.org/wiki/Ross_J._Anderson http://en.wikipedia.org/wiki/Markus_Kuhn http://en.wikipedia.org/wiki/Markus_Kuhn http://en.wikipedia.org/wiki/Steven_Murdoch http://en.wikipedia.org/wiki/Steven_Murdoch ...and http://www.lightbluetouchpaper.org/ http://www.lightbluetouchpaper.org/ ; I am unaffiliated with Cambridge other than knowing a few of the people there.