5 ms·

Changing from SK to CN is a trade from intentional vulnerability to unintentional vulnerability. I’ve yet to see a secure piece of software come out of China in

Changing from SK to CN is a trade from intentional vulnerability to unintentional vulnerability. I’ve yet to see a secure piece of software come out of China in my 30+ years of coding.

dragonelite 1y ago
Better to swallow the poison that doesn't kill you(for now) than to swallow the one that is intended to kill you.
Dah00n 1y ago
Yet in telco it is much easier and faster to get a bug fixed in Chinese equipment. IMO it is more likely you don't work with critical infrastructure than the problem being Chinese equipment.
ReptileMan 1y ago
Supermicro IPMI comes to mind. If it was compromised we would have known by now.
- toast0 1y ago
  There's a lot of vulnerabilities, of course. Supermicro isn't great at releasing updates for old boards either. https://www.cve.org/CVERecord/SearchResults?query=supermicro https://www.cve.org/CVERecord/SearchResults?query=supermicro
- nullc 1y ago
  Many vendor IPMI is so fiendishly hard to isolate from untrusted networks (or even networks in general) that it almost has to be an intentional backdoor.
- iamtedd 1y ago
  Not only is Supermicro headquartered in USA, but it's operations are in Taiwan, which they would very much like you to acknowledge is not the same as mainland China.
  - riffic 1y ago
    *its
  - cluckindan 1y ago
    Memory sure is short around here. https://www.bloomberg.com/features/2021-supermicro/ https://www.bloomberg.com/features/2021-supermicro/
FirmwareBurner 1y ago
>I’ve yet to see a secure piece of software come out of China in my 30+ years of coding. SW coming out of Korea's domestic industry giants isn't any better. Because they used to treat SW like a cost center or another item on the BoM. IIRC, the only way to do online banking in Korea years ago, was you needed Internet explorer and some active-X plugin that supported encryption. Some Korean giants do have good SW, but a lot of it is developed internationally by offices outside of Korea.
jeroenhd 1y ago
When a security analysis was done of Chinese parts of the Dutch mobile network, that was pretty much the conclusion: Chinese vendors deliver software and components full of vulnerabilities, but none of them seem to be intentional. Since then there has been a movement to reduce Chinese vendors in general our if security concerns, as well as to improve the security posture of the mobile networks by doing things like "encrypting connections" and "switching away from telnet". On the other hand, the Chinese managed to break into the US wiretapping system, so it's not like other networks aren't vulnerable either.
- vardump 1y ago
  > Chinese vendors deliver software and components full of vulnerabilities, but none of them seem to be intentional. Plausible deniability.
  - GTP 1y ago
    If we're talking about cheap products, then it's more likely due to cost savings rather than malice. But yeah, no one can give you defitive proof of this.
monster_truck 1y ago
Brother you cannot be serious with this racist take
- heraldgeezer 1y ago
  Zoomers need to leave this site.
- b112 1y ago
  Saying that a culture is poor at security dev, such as Chinese business culture, is not even remotely rasist. There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race. For example, there are many ethnically Chinese people who grew up in the West, working in businesses, in countries where there is a culture of security. Now, you could label it 'culturalist', and maybe it is, but there are definitely inferior and superior cultures. Especially, there are parts of cultures which are quite comparable this way.
  - gruez 1y ago
    >>Brother you cannot be serious with this racist take >There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race. This just seems like nitpicking to me. Colloquially most people would classify discrimination based on country of origin, or "culture" (whatever that means) as racism, even if it doesn't meet the technical definition. For instance Trump's travel bans have been called by many as "racist", even though it covers a bunch of countries, and even though the countries are majority muslim, it also excludes major muslim countries like Pakistan and Indonesia.
    - const_cast 1y ago
      It's entirely fair game to criticism or even discriminate based on culture, because culture is composed of actions. If people act in such a way that you do not like, that's a valid reason not to like them. Now, we do still need to respect cultural differences where it makes sense and consider the historical context behind cultural differences, such as colonialism.

Changing from SK to CN is a trade from intentional vulnerability to unintentional vulnerability. I’ve yet to see a secure piece of software come out of China in my 30+ years of coding.

dragonelite 1y ago

Better to swallow the poison that doesn't kill you(for now) than to swallow the one that is intended to kill you.

Dah00n 1y ago

Yet in telco it is much easier and faster to get a bug fixed in Chinese equipment. IMO it is more likely you don't work with critical infrastructure than the problem being Chinese equipment.

ReptileMan 1y ago

Supermicro IPMI comes to mind. If it was compromised we would have known by now.

toast0 1y ago
There's a lot of vulnerabilities, of course. Supermicro isn't great at releasing updates for old boards either. https://www.cve.org/CVERecord/SearchResults?query=supermicro https://www.cve.org/CVERecord/SearchResults?query=supermicro
nullc 1y ago
Many vendor IPMI is so fiendishly hard to isolate from untrusted networks (or even networks in general) that it almost has to be an intentional backdoor.
iamtedd 1y ago
Not only is Supermicro headquartered in USA, but it's operations are in Taiwan, which they would very much like you to acknowledge is not the same as mainland China.
- riffic 1y ago
  *its
- cluckindan 1y ago
  Memory sure is short around here. https://www.bloomberg.com/features/2021-supermicro/ https://www.bloomberg.com/features/2021-supermicro/

FirmwareBurner 1y ago

>I’ve yet to see a secure piece of software come out of China in my 30+ years of coding. SW coming out of Korea's domestic industry giants isn't any better. Because they used to treat SW like a cost center or another item on the BoM. IIRC, the only way to do online banking in Korea years ago, was you needed Internet explorer and some active-X plugin that supported encryption. Some Korean giants do have good SW, but a lot of it is developed internationally by offices outside of Korea.

jeroenhd 1y ago

When a security analysis was done of Chinese parts of the Dutch mobile network, that was pretty much the conclusion: Chinese vendors deliver software and components full of vulnerabilities, but none of them seem to be intentional. Since then there has been a movement to reduce Chinese vendors in general our if security concerns, as well as to improve the security posture of the mobile networks by doing things like "encrypting connections" and "switching away from telnet". On the other hand, the Chinese managed to break into the US wiretapping system, so it's not like other networks aren't vulnerable either.

vardump 1y ago
> Chinese vendors deliver software and components full of vulnerabilities, but none of them seem to be intentional. Plausible deniability.
- GTP 1y ago
  If we're talking about cheap products, then it's more likely due to cost savings rather than malice. But yeah, no one can give you defitive proof of this.

monster_truck 1y ago

Brother you cannot be serious with this racist take

heraldgeezer 1y ago
Zoomers need to leave this site.
b112 1y ago
Saying that a culture is poor at security dev, such as Chinese business culture, is not even remotely rasist. There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race. For example, there are many ethnically Chinese people who grew up in the West, working in businesses, in countries where there is a culture of security. Now, you could label it 'culturalist', and maybe it is, but there are definitely inferior and superior cultures. Especially, there are parts of cultures which are quite comparable this way.
- gruez 1y ago
  >>Brother you cannot be serious with this racist take >There are many ethnicities in China, people of all genetic backgrounds. It is the culture that is the problem, not the race. This just seems like nitpicking to me. Colloquially most people would classify discrimination based on country of origin, or "culture" (whatever that means) as racism, even if it doesn't meet the technical definition. For instance Trump's travel bans have been called by many as "racist", even though it covers a bunch of countries, and even though the countries are majority muslim, it also excludes major muslim countries like Pakistan and Indonesia.
  - const_cast 1y ago
    It's entirely fair game to criticism or even discriminate based on culture, because culture is composed of actions. If people act in such a way that you do not like, that's a valid reason not to like them. Now, we do still need to respect cultural differences where it makes sense and consider the historical context behind cultural differences, such as colonialism.