4 ms·
Serious question: does anyone here work for a BigCo who uses Chinese software like this in production? Do your InfoSec teams sign off on it? What's the risk of
by solatic 2y ago
Serious question: does anyone here work for a BigCo who uses Chinese software like this in production? Do your InfoSec teams sign off on it?
What's the risk of downloading what's supposed to be a release binary of this off GitHub, where the release binary includes something nefarious not found in the open codebase, that steals your company's source code when you use it to compile?
In today's geopolitical climate, how does anyone trust non-Western projects?
- castalian 2y agoYou can't trust "western" open source projects as well. It wouldn't be hard to just not mention China anywhere on the website or the sources so that most people would never know.
- imp0cat 2y agoWell this one specifically is listed under a fake company name which raises further questions. Is this just another attempt to conceal chinese spyware? See the discussion at https://news.ycombinator.com/item?id=40756408 https://news.ycombinator.com/item?id=40756408
- kveykva 2y agoTheir code base is also weirdly convoluted, with many crates and files just proxying over to others. I've read and written a lot rust, and haven't seen this style really. Could be nothing but its odd.
- phero_cnstrcts 2y agoI would consider western and non western equally bad.
- k4rli 2y agoThat's what the Chinese would say. West doesn't need to insert vulnerabilities for the basic stuff since they can already front/backdoor with GCP/AWS/alike.