3 ms·
I think it's a nice political move, but I will be surprised if it makes much difference in the end. It is impossible to demonstrate trustworthiness to someone
by xyzzy123 14y ago
I think it's a nice political move, but I will be surprised if it makes much difference in the end.
It is impossible to demonstrate trustworthiness to someone who isn't willing to believe it.
Some issues which would get raised by your friends if they didn't want you to buy Huawei:
Firstly, you have the problem of underhanded code (e.g http://underhanded.xcott.com/ http://underhanded.xcott.com/) e.g. deniable backdoors. Auditing a large C codebase to the point where you have confidence in it is Expensive and Time Consuming.
Secondly, version control gets to be a huge problem. If you are going to rely on the results of your audit, now you have to build the firmware yourself with a trusted toolchain. This is going to be a lot of work. Especially since you now have to do this for every firmware release for every product you use. Most organisations aren't getting patching and release management right even as things stand right now.
Thirdly: do we need to look at the FPGAs, ASICs and "auxiliary" firmware? Are all the parts standard? Where were they fabbed? Can we trust those guys? Is the router we get next month going to be the same board revision, with parts from the same vendors?
Fourthly: how comfortable are the players in various countries going to be with a Chinese state-owned company having their detailed network designs for telcos and core networks? (I mean, pretending they don't already ;)
Paranoid hat mode: I do wonder whether the huge mistrust of Huawei is standard anti-competitiveness... or because everyone's agencies have been using {backdoors, bugs, info} provided by various companies and "friendly employees" for years - and buying Huawei kit just seems like it's making things too easy for certain parties.
If you are interested in these kinds of shenigans: http://spectrum.ieee.org/telecom/security/the-athens-affair/0 http://spectrum.ieee.org/telecom/security/the-athens-affair/... is a fascinating read.
- danielweber 14y agoThank you. "Ability to read the source code" is amazingly low for knowing if the code is trustworthy. And don't forget we have to trust the compiler that compiled the compiler. EDIT: I see you mention "trusted toolchain" in your second point.