KASAN Spots Another Kernel Vulnerability From Early Linux 2.6 Through 4.20

[Wojcian]

They're much more trustworthy than US company which polluted entire world with CPU's insecure by design. China is communist country, but it doesn't attack innocent ones like USA does. Just because some small shit desert country tells them to do so.

[Murple]

The world is not binary, black and white, only one thing or the other. We are all human. Corporations are made of human beings who are complex in their actions and motivations. They are not monolithic.

Huawei can still be untrustworthy due to MSS infiltration or open collaboration (which they are legally required to do just like Google, Facebook, et al are legally required to do in the US) with the PRC government LEO while still having arms of its corporate structure issuing patches to benefit the world at large. It's foolish to trust any corporation entirely, and it's equally foolish to forget that they can also have beneficial actions either because of altruism or because of PR or self interest.

Yeah I wasn't saying we should trust Huawei, and I wasn't saying their motivations are purely economic. I was wondering, partly for humorous effect, if a so called communist country was driven by profit more than the so called capitalist ones. It doesn't stand up to scrutiny, because as you say its way more complicated than that.

[Murple]

Chinese State (PRC) has law that makes cooperation with Chinese intelligence organizations MANDATORY for any and all Chikese private companies. No "if's" or "but's" about it.

So come out of your naívè ideological thinking for fucking once. Yeah, Huawei engineer found something. Great.

It does not change the fact that if PRC's MSS asks Huawei for hardware backdoor in specific enterprise network device, it has no other path than to comply and implement it. Regardless of what Huawei or it's engineers itself may want or not.

Chill out dude you are taking this way too seriously. Of course Huawei are untrustworthy, as are most companies in all countries given the abundance of variables at play. I just thought it was funny (as in ha ha) that Huawei (in the loosest sense) were helping fix security holes given the current attention they are getting.

[aht0]

Chinese State (PRC) has law that makes cooperation with Chinese intelligence organizations MANDATORY for any and all Chikese private companies. No "if's" or "but's" about it.

So come out of your naívè ideological thinking for fucking once. Yeah, Huawei engineer found something. Great.

It does not change the fact that if PRC's MSS asks Huawei for hardware backdoor in specific enterprise network device, it has no other path than to comply and implement it. Regardless of what Huawei or it's engineers itself may want or not.

[stormcrow]

The same in the UK, "we can't trust them, they are an arm of the chinese state" etc etc. Our governments aren't pissed about the possibility of backdoors in their hardware, they are pissed because Huawei won't put backdoors in for western agencies. Ironically I think the Chinese state are really interested in the commercial success of their technology companies and this probably makes them think twice about jeopardising their efforts with security holes. They even do capitalism better than us jeez that's embarrassing

Of course on the other hand maybe Huawei are just getting rid of all their dirty laundry now and publicly outing their exploits before someone else does

The world is not binary, black and white, only one thing or the other. We are all human. Corporations are made of human beings who are complex in their actions and motivations. They are not monolithic.

Huawei can still be untrustworthy due to MSS infiltration or open collaboration (which they are legally required to do just like Google, Facebook, et al are legally required to do in the US) with the PRC government LEO while still having arms of its corporate structure issuing patches to benefit the world at large. It's foolish to trust any corporation entirely, and it's equally foolish to forget that they can also have beneficial actions either because of altruism or because of PR or self interest.

[coder]

Isn't the news or the American government pushing the story that "Huawei are evil!!!!" right now?

Meanwhile... Huawei have just found and reported a serious Linux vulnerability. Thanks guys

You're very trusting. I wonder if they might've previously known about it and are just now publicizing these exploits. Or, perhaps they launched an initiative to find such bugs in other products to help their own reputation.

We don't know what we don't know. No matter what Huawei says or does, I wouldn't entrust critical infrastructure to state-owned tech companies. In fact, no matter who builds it, I think the hardware and software sources should be kept in escrow, if not entirely open source.

[Murple]

You're right it could be many things, but speculating wildly is kinda enjoyable so don't take that away from me!

The rest of your points are spot on tho

[SofS]

Speculating conspiracies will lead us nowhere, it could be a decoy, it could be actual good faith, it could be one branch doing something the other does no know, it could even be counter espionage by revealing a vulnerability they were exploring when they noticed someone else else using it.

What this kind of discussion does prove is that we should really be more concerned about two things, open and verifiable systems on one hand, and actually verifying them on the other.

Even regarding normal performance benchmarks we are lacking, case in point all the regressions Michael here has been spotting as we see often on his benchmarks.

[Murple]

Isn't the news or the American government pushing the story that "Huawei are evil!!!!" right now?

Meanwhile... Huawei have just found and reported a serious Linux vulnerability. Thanks guys

The same in the UK, "we can't trust them, they are an arm of the chinese state" etc etc. Our governments aren't pissed about the possibility of backdoors in their hardware, they are pissed because Huawei won't put backdoors in for western agencies. Ironically I think the Chinese state are really interested in the commercial success of their technology companies and this probably makes them think twice about jeopardising their efforts with security holes. They even do capitalism better than us jeez that's embarrassing

Of course on the other hand maybe Huawei are just getting rid of all their dirty laundry now and publicly outing their exploits before someone else does

[cybertraveler]

Isn't the news or the American government pushing the story that "Huawei are evil!!!!" right now?

Meanwhile... Huawei have just found and reported a serious Linux vulnerability. Thanks guys