3 ms·

I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be

I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be showing officials 'cleaned' code, and then ship different code with spyware/malware baked in. The only way to really trust the code is if an end user can download the source, review it, build it, and install it on their device.

eru 14y ago
There's another way, but it's highly technical: Proof carrying code.
- xyzzy123 14y ago
  Right except PCC for ARM SoC are pretty thin on the ground. So they would have to build a PCC compiler and runtime, and then you'd have to audit those...
ari_elle 14y ago
I see a flaw in your flaw. 1st) small chance that spying features are implemented that a paranoid analyzing by US officials wouldn't have revealed* (or that the US would have said the products are good, while still having reasonable concerns about potential spying) 2nd) i don't know how they would give their source code to government officials but i guess it's fair to assume that it can be done in private and trusting nature (also they probably are able to test if a piece of hardware runs the code given or not) 3rd) risk of secretive spying features being found is high * * (even if you want to argue it might be lower than described by myself above -> see 1st), therefore generally would lead to one of the biggest company scandals in the 21st history and completely destroy all of Huawei's business in all of the Western World (not worth it) * somebody shall correct me if i might be wrong, but wouldn't it be pretty hard to hide spyware in software being used worldwide by millions of users and that is center of attention by governments for a long time * * think of the amount of Huawei contractors, the sheer quantity of their sales
- xyzzy123 14y ago
  It doesn't have to be "spyware" per se. It just has to be a bug or problem that you (and your friends) know about that your customer doesn't.
- lolwutreddit 14y ago
  Nice try, Huawei PR

eru 14y ago

There's another way, but it's highly technical: Proof carrying code.

xyzzy123 14y ago
Right except PCC for ARM SoC are pretty thin on the ground. So they would have to build a PCC compiler and runtime, and then you'd have to audit those...

ari_elle 14y ago

I see a flaw in your flaw. 1st) small chance that spying features are implemented that a paranoid analyzing by US officials wouldn't have revealed* (or that the US would have said the products are good, while still having reasonable concerns about potential spying) 2nd) i don't know how they would give their source code to government officials but i guess it's fair to assume that it can be done in private and trusting nature (also they probably are able to test if a piece of hardware runs the code given or not) 3rd) risk of secretive spying features being found is high * * (even if you want to argue it might be lower than described by myself above -> see 1st), therefore generally would lead to one of the biggest company scandals in the 21st history and completely destroy all of Huawei's business in all of the Western World (not worth it) * somebody shall correct me if i might be wrong, but wouldn't it be pretty hard to hide spyware in software being used worldwide by millions of users and that is center of attention by governments for a long time * * think of the amount of Huawei contractors, the sheer quantity of their sales

xyzzy123 14y ago
It doesn't have to be "spyware" per se. It just has to be a bug or problem that you (and your friends) know about that your customer doesn't.
lolwutreddit 14y ago
Nice try, Huawei PR