Airbus hit by series of cyber attacks on suppliers | Hacker News Reader

Airbus hit by series of cyber attacks on suppliers

france24.com

289 pointskeydutch188 comments

Other comments here incorrectly pointing out that Boeing and Airbus don't manufacture in China - they do. And why wouldn't they, it's obviously much cheaper to manufacture there given material and labor costs. Obviously they don't manufacture highly sensitive military aircraft in China, but commercial aircraft, sure why not.

What they don't do is the design, testing, and certification in China. This is the real IP - not the materials or the assembly techniques, but how to navigate the regulatory landscape of the FAA and the EASA in extremely complex hardware/software integrated systems. The article mentions certification documents/evidence as a primary target.

The funny thing in all this is that passengers inherently trust the FAA and EASA operated system and inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft. When really this breach was all about the money - Chinese companies want to get in on Boeing and Airbus' market.

I don't have a dog in this fight, but I will say that Boeing isn't doing itself any favors with it's cost cutting efforts on the 737 MAX, and that if it wants to keep consumers trust in its planes over the perception of "inferior" foreign competition, it needs to work much more closely with the FAA to ensure safety is the primary motivating factor on new designs and does not get overriden by fuel efficiency.

On the Boeing facility:

"Work at the facility was limited to the plane’s interior, including installing seats and other cabin equipment. More responsibilities will be added over time, such as painting the exterior, but the center is primarily meant for completion and delivery, with the main manufacturing remaining in the US."

They manufacture in China not mainly because it's cheaper (lots of places are cheaper than their home countries), but because it's the only way to get a significant part of the large Chinese market.

> inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft

This is true, but it was also true for European airliners in the US at a time. And it took time and effort, but it changed.

> it needs to work much more closely with the FAA

Some would argue that working too closely with the FAA is the problem.

> The funny thing in all this is that passengers inherently trust the FAA

Not anymore.

Anecdata: Not true. Most people aren't even aware of recent events.

My circle of friends is a pretty wide net and only one coworker knows about the Boeing nonsense, and he admitted it was because of Hacker News.

Surely people have noticed the thousands of cancelled flights?

If you've already missed it in the news, you're certainly only going to notice your own cancelled flight.

How many people do you know who frequently took flights right at the time when this was all happening? If I were not an avid reader of the news, I'd have no clue. Before this, I also would not have cared to check what airplane my flight was when I did fly.

> How many people do you know who frequently took flights right at the time when this was all happening?

They’re still being cancelled daily now! I know AA alone is cancelling over 100 flights a day. It’s not something in the past.

Are they canceling those flights, or are they not offering them? It's a big difference. People notice when a flight they've already booked is canceled. They don't notice flights that were never shown to them in the first place. I fly regularly between Boston and Seattle. I've noticed that my choice of flights is less than it was, but if I were a less regular flier on that route I'd have no idea that the selection was even reduced let alone of the reasons.

Not if you are not affected by them.

The thousands of canceled flights are over millions, and the average person doesn't fly that much. Around one round trip a year in the US.

In fact, while I am very aware of the B737-MAX fiasco because I am interested in the technical side of things, I didn't even realize there were thousands of canceled flights. Sure, it is something I should know, but it is not like canceled flights are a remarkable event, and because I wasn't affected by it, I didn't really think about it.

Russia has expertise building airliners. Wonder why manufacturers never took to producing there for cheap labor? My guess is China leveraged their market potential to entice cos to take some of their mfg to China.

Russian industry was taken over by the mafia. That is much less tenable than the situation with China.

http://www.softpanorama.org/Skeptics/Pseudoscience/harvard_m...

Somehow I sense you did not intend irony.

[main stream version: https://www.thenation.com/article/harvard-boys-do-russia/]

This video from Wendover Productions discusses specifically that they setup "finishing" centers in China for the planes they are selling into China: https://www.youtube.com/watch?v=XjbYloKJX7c

Article about Chinese government stealing Airbus property and here we go derailing it towards Boeing.

> "Globally recognized standards, such as ISO 27001, 27701 and 9001, can definitely ensure a baseline of security, privacy and quality assurance amid suppliers. One should, however, bear in mind that they are no silver bullet and some additional monitoring of suppliers handling critical business data is a requisite.”

This is misleading.

ISO standards dictate that a company should have certain processes in place. Like quality assurance, customer satisfaction, continuous improvement, ect. They do not specify individual processes or procedures to the company. They just lay out which structures should exist in an ISO compliant company. It is up to the company to develop processes and procedures that fulfill those structures.

The specific standards that are a "silver bullet" (as the author puts it) are NIST 800-171 "DFARS", ITAR, AS9100, NADCAP, and other smaller (yet equally significant) manufacturer-specific specifications that get flowed down the supply-chain on an as-needed basis.

So there is no ambiguity. If a supplier does business with a diverse enough client base in aerospace they will almost certainly have overlapping systems in place to protect against these things. Without pretty much all of the specifications I listed above, a supplier would not legally limited in what they are allowed to possess and produce.

Do companies with ISO certifications ever get reviewed after-the-fact? Or do you just have to check the right checkboxes during an initial review process?

I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense.

Basically an auditor comes and quizzes you on your own processes. You must show that you have processes which meet ISO criteria, and that you religiously follow those processes.

Basically you have a lot of freedom to develop your business, just be sure you adhere to whatever you put into writing.

Back in the day of Total Quality Management and ISO9002 the software company I worked for decided to get itself certified. Problem was, nobody had a clue how to quickly describe the business of creating software as a set of processes, let alone apply them in measurable ways under the beady gaze of an auditor. So with evil inspiration it was decreed that the software division had no processes at all. The customers could rest assured that the Accounts and Marketing departments were fully ISO9002 compliant - as for the actual product they were buying? spun out of desperate sweat and divine revelations so far as they could tell.

But this didn't entirely get the software division off the hook. We still had to be able to show an auditor that we knew our processes were excluded. So there was a special folder containing just one functional page besides the meta-bumf to support it, and it read (in effect) "THE ACTIVITIES OF THE SOFTWARE DEPT ARE EXCLUDED FROM ISO9002 PROCESSES". And we were all trained to be able to produce it upon demand.

We passed the audit. Our letterhead paper gained the magical ISO9002 seal of approval. The administrator who had championed the long and expensive business sprung from its success to a much larger company. In her absence the process documentation for the rest of the company quietly withered and when the follow-up audit came due we quietly neglected to apply for it. The letterhead paper was reprinted with a snazzier logo and no seal of approval. We got back to work, quietly apprehending the next big thing.

That is a great story!

I've seen companies pack trunks of cars with unclaimed scrap. Buy a 55' trailer with cash, fill it with stuff, then claim it belongs to the neighbors. Load material onto 30' racks and send the forklift operators home.

It's almost better that your company committed to ISO to kinda get organized and then let it slide afterwards. I'd almost say it's worth it in a medium sized company every 10 years just to stay accountable and organized.

It was all worth it for the line on her resume.

> I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense

Eh, kind of? I currently work for one and they haven't been audited in over a decade. The history goes: once upon a time, they were seeking certification because $potential_buyer asked about it. They failed the first audit quite miserably, and the next. By the third time, they squeezed by and were certified. The auditors came back 2 times in the next 2 years to make sure they were still compliant, and by the third year the auditors just asked if their processes had changed (without bothering to scrutinize everything again). They had not, and the auditors have not reached out ever since. The company is still certified. I think in theory they've "checked" since then but no one at the company can recall them actually showing up/auditing.

Almost every certification is a recurring income generator for the certificating parties. Some are annual, others bi-annual or even longer periods between certifications but none that I am aware of are 'forever'.

That makes sense. My goal in life is to never work for a company where that type of thing would be considered seriously.

So, the following are out: aerospace, fintech, medtech, insurance, anything requiring a login through a local account (not through some identity provider) and so on. You'd be surprised how many companies are now operating in territory where certification is either a hard requirement or where it will help them to ensure that they are good stewards of the data they hold.

ISO27001 (the main security one) has annual reviews which are more lightweight. After two years, the three-year cycle restarts.

How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?

Same people who attribute attacks to North Korea and the Russian federation, etc.

You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy.

Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive.

> Exactly what does it mean to be "state-sponsored"?

It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf.

> And who provides this analysis?

Government agencies and private companies provide these types of analysis services.

Without talking about the controversial technical indicators of a state sponsored attack, you can figure it out based on the motive, complexity of the attack, and who is being targeted.

Criminal attacks have a profit related motive, which can be distilled down into "if we spend $X dollars trying to hack Y, we can probably get a payoff of $Z"

If an attack is extremely expensive and has very little potential payoff, you can be pretty sure it's not being done by a criminal organization.

You may wonder "how do you prove it's not being done by not-profit motivated hacktivists?". Hacktivist groups usually have limited resources (that doesn't mean they're not dangerous!). If scale of the attack/payload suggests a team of 10-30 skilled professionals working full time for a year or so, it's probably not a hacktivist group. Hacktivist groups also tend to proudly announce responsibility whenever they pull off successful attacks.

A question I've always wondered, and relevant here. If this is inter-company (and probably intra-company) communication, why don't these companies manually exchange one-time pads and use them? It's surely not hard for a courier to carry literally terabytes of OTP, and report if it was taken off them at any point.

I was thinking of tape or HD, but now you an have the courier carry a terabyte of OTP in a few USB sticks.

Let's say you do that:

1. Send giant HD of OTP bits to other office.

2. Everyone at that office who needs to communicate, so you make those bits accessible on the internal network so various machines can get to it.

3. Now a hacker that accesses the network can get to your OTP bits.

At that point, you're no better than using some other security mechanism.

Oh FFS. I was expecting some silly answer involving couriers being intercepted but this is just as bad.

> 3. Now a hacker that accesses the network can get to your OTP bits.

Which is on an internal network so is not exposed (unlike the contents of a VPN which necessarily goes external) so can be more secure. While nothing's unhackable it adds an extra layer to break through.

That the article says "It was very sophisticated and targeted the VPN which connected the company to Airbus" shows the VPN was the weak link, and not the internal networks. So harden the weakest link.

The way I figure, if a sophisticated attack is so sophisticated that it can only be state-sponsored, then it is sophisticated enough to appear to be sponsored by another country.

Your problem here is ability and motive. What other countries are capable of executing this attack and would want to steal this information? As far as I know Comac is the only company that is attempting to build planes that rival Boeing and Airbus for commercial flight so you have your motive. The Chinese have a history of corporate espionage (lookup Huawei and Nortel) and given that Comac is a state owned company you can clearly understand why they would try to steal information.

If you're trying to frame someone, there has to be a plausible explanation for why you would do it.

>Comac is the only company that is attempting to build planes that rival Boeing and Airbus

Boeing also competes with Airbus, as in actively competes in real dollar terms compared to Comac which is more or less aspirational. Given their current situation they have as much incentive to hack Airbus, plus they've been accused recently:

Airbus to sue NSA, German spies accused of swiping tech secrets

>European aerospace giant Airbus is promising legal action over claims its top blueprints were stolen by German spies and given to America's intelligence agencies.

https://www.theregister.co.uk/2015/04/30/airbus_us_german_in...

My view is that both Boeing and Comac is actively stealing from airbus because why wouldn't they?

Yes, US/NSA/Boeing must at least be under suspicion in these circumstances.

As the Comac C919 approaches certification and full production, airlines, especially Chinese ones, will delay orders, to wait and see, or actively prefer the C919 over the 737 series. Even if the C919 is delayed with the usual teething troubles, many customers will decide to wait, or buy Airbus if they have to.

At this point, Boeing is the weakest of the three competitors in the mid-size market, and must be desperate to do anything to survive.

The US also has a long history of state-sponsored industrial espionage. https://en.wikipedia.org/wiki/ECHELON

Out of curiosity: why is China not mentioned in the article's title, when the first sentence states a "Chinese state-sponsored hacking operation"?

It took my vouch to un-dead your comment, useful because I couldn't reply to it otherwise. I'm morbidly fascinated as to how the top two comments on this submission were marked dead in the first place, but considering it took a vouch to automatically bring it back to life, there's a hint of a Flag brigade on this thread.

To answer your comment: because the title of the submission "Airbus Suppliers Hit in State-Sponsored Attack" and the title of the article "Airbus Suppliers Hit in State-Sponsored Attack" are identical, and that's totally fine. Changing the title of the submission to include a detail from the article actually editorializes the submission, which is not ideal for HN or the audience here.

I took the comment to mean, why does the original article's title not have 'Chinese' in the title.

In these days of click-bait "news", it's a valid question.

The user you're replying to has been leaving a trail of dead comments since https://news.ycombinator.com/item?id=14150381

If it's marked as [dead] but not [flagged], the comment was killed automatically. No reason to suspect brigading.

Please don't post insinuations of astroturfing or similar manipulation ("Flag brigade") without evidence. If you're concerned about abuse, please follow the site guidelines and email hn@ycombinator.com so we can look into it.

https://news.ycombinator.com/newsguidelines.html

Hm, I didn't bucket flag-brigading into the astroturfing bucket (specifically because they're quite different - one suppresses speech whereas the other purports to be grassroots speech). Your point is well taken, but going forward dang, there's value in adding the "or similar manipulation" qualifier to the current iteration of guidelines:

> Please don't make insinuations about astroturfing. It degrades discussion and is usually mistaken. If you're worried, email us and we'll look at the data.

Hopefully this comment is viewed as both the acknowledgement as well as the constructive feedback it's intended to be.

For sure it's constructive. I'll see about expanding the wording.

Edit: ok, done. https://news.ycombinator.com/newsguidelines.html

These days state-sponsored has become a euphemism for Chinese.

Nah. For example Sony was hacked by North Korea. CIA was repeatedly hacked by Russia (Vault 7, director emails). And yes, every high-tech US corporation is sucked dry of secrets by China (Micron, Intel, Supermicro, Waymo, Boeing, etc.)

China wins by a huge margin.

It depends on who the boogeyman de jour is.

It was North Korea for a while, with every major hack blamed on them, then it was Russia, and now it's China - lo and behold, they get the blame for every major hack.

Now, I'm not saying it wasn't China - what I'm saying is that Western governments make it like "the body who cried wolf".

Don't forget about Iran.

As a data point, China's "hacker army" has 50k-100k people.

https://en.wikipedia.org/wiki/Chinese_cyberwarfare

The supporting link for that figure describes China's hackers army as a myth (in the header), and as a loose coalition of civilians in the body:

>"That revelation, along with a separate story in the Financial Times that a freelancer wrote the Aurora code, is focusing attention on China’s loose web of cowboy hackers. And SharpWinner — the leader of a coalition including anywhere from 50,000 to 100,000 civilian members …" //

The rest of the Wikipedia page, amongst other things, describes a structured make up (military, PLA, civilian).

Assuming the numbers were true, how does that compare to USA's, or other countries?

"Airbus Suppliers Hit in State-Sponsored Attack" would imply China is 100% known to be the hacking operation, and that China was convicted of doing such a thing in a court. This is not true, and would be grounds for libel.

"Airbus Suppliers Possibly Hit in Chinese State-Sponsored Attack" is less attractive as a headline.

Is there any way you can "libel" a country outside of sedition? Worrying about publishing something that might be seditious in China seems like splitting hairs, since the body of the article directly points the finger at Chinese hackers.

Libel against a country?

That's like slandering the ground.

Reminds me of Xerxes, king of Persia had the ocean whipped after a storm destroyed his bridge.

Leaving essential information out of the headline is a common clickbaiting tactic.

Out of curiosity, why did you omit the word 'possible' from the sentence you quoted.

Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products.

Goes to show that without easy access to product blueprints/IP at the factories, China is very slow to actually innovate on their own. Hence why I feel the "China will outpace everyone in tech and take over the world" is super overblown.

Even their university culture practically encourages cheating in classes to pass, so you have generations of students graduating with weak understanding of the fundamentals. The US is obviously not a perfect meritocracy, but China is super far from that.

An economic model where American/European/Japanese/Korean tech is stolen and then friends of politicians are gifted CEO positions of companies that clone that stolen tech...not sustainable at all. If you want a painful example of what I'm talking about, watch the AI debate between Jack Ma and Elon Musk. It's so clear that Ma has an absolutely minuscule understanding of the AI landscape.

When robotic manufacturing eventually becomes cheaper and faster than manufacturing in China, meaning they'll no longer have IP to steal, they are in huge trouble.

Airbus has been manufacturing in China for a while now and Boeing opened a plant more recently.

China doesn't make internationally competitive aircraft because making internationally competitive aircraft is very hard.

"Asked about the possibility of technology transfer agreements between Boeing and COMAC, Bruns stressed that the purpose of the plant was for installing seats, painting vehicles, and completing the planes’ final delivery.

“That’s only a part of what we do in the production of airplanes,” he said."

They're way behind schedule, but they are working on it. A recent Wendover video looked at the current state of affairs: https://www.youtube.com/watch?v=XjbYloKJX7c

Confirmation biais at its finest.

Airbus does have final assembly lines in china. I guess they have no access to blueprint of components

Wow, these are some seriously racist comments.

Welcome to HN where any China-related topic is treated with the same hostility.

If this level of "hostility" offends you, please don't read the US-related topics.

China is a country, with a different education system, which produces different outcomes and culture.

Nobody is making any claim whatsoever about the behavior of Chinese-Americans or Chinese-Europeans. That would be racist.

What does race have to do with any of this? I'm discussing their government's economic and academic model. That's like saying criticism of America's healthcare system is racist against whites, because that's their majority ethnic group.

If anything, it says a lot about you that you associated everything I said with their ethnicity rather than the government itself.

The term "racism" includes both race-based as well as ethnicity-based stereotyping. See, for example, Wikipedia:

https://en.wikipedia.org/wiki/Racism

The idea of Chinese companies/universities/etc. being uncreative and over-reliant on imitation and industrial espionage is quite obviously a somewhat tired cliché. I'm certain it makes an appearance in almost every single front page comment threat on the Chinese economy of the last five years or so.

There might even be a kernel of truth. But, as others have pointed out, the same was said of Japan and Taiwan before. In such a situation, you should be wary of repeating such stereotypes if you don't have first-hand experience, which I doubt many of those regurgitating that trope have.

I'm not sure how race comes into it. We are talking about a single country, not a race. The original commenter even mentioned Japan and Korea as examples of countries that are different from China in this regard.

It is not an attack on a race of people. There is an SCMP article on the problematic atmosphere of cheating in Chinese schools [1], and dozens by Chinese contributors to large, mainstream publications.

[1]:https://www.scmp.com/comment/insight-opinion/article/1974986...

You do realize that 'Chinese' is not a race, right?

China, the country != Chinese (Asian?), the race

Not only the comment is about a particular nation of people, "race" is essentially an Americanism at this point, and it's tiring to see attempts at coerce everything into a "race" problem.

Nationalist comments, not racist.

That comment was bad for taking the thread into nationalistic flamewar, but this comment is also bad for taking the thread further into flamewar.

Please don't do that. The site guidelines specifically ask you not to:

https://news.ycombinator.com/newsguidelines.html

> It's so clear that Ma has an absolutely minuscule understanding of the AI landscape.

I have no idea if Jack Ma knows about the ML landscape or not. But it's clear just by taking an anti-alarmist stance he's correct.

> Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products.

Actually, they have a narrowbody competitor set to enter production: https://airlinegeeks.com/2018/03/17/20567/

Also:

> Boeing has built a B737 finishing factory and Airbus has a final A320 final assembly plant in China, with Airbus planning on building a wide-body jet plant in the country as well.

Airbus manufactures in China. They have a large factory in Tianjin [1].

China is on course to have its own commercial airliner soon [2]

[1] https://www.airbus.com/newsroom/news/en/2018/09/airbus--chin...

[2] https://en.wikipedia.org/wiki/Comac_C919

Perhaps, but the article itself says that Comac is having problems certifying its (first) commercial airliner. And part of what was targeted was Airbus data relating to certification.

I add (first) because I've read about the C919 elsewhere.

Boeing is having problems with its new planes... Designing and building airliners from scratch is not easy but China will get there because it's of strategic importance, and then the current duopoly will be broken.

But Boeing's problem isn't an innovation problem. Boeing's problem is ceding engineering decisions to marketing wanks and MBA bros.

And I did my first job programming some groce frontends for them to use the inhouse-pipeline of a major Airbus subcontractor, which they rebuil(t/d).

The subcontractor did this entirely willingly and I don't blame them, given that Airbus treated them like sh*. Sure they were not the absolute cutting edge business, but they do a solid job and have a strong engineering background (from the times of MBB, DASA & Co. - their IT in the eng department was horrible). And yet when negotiating a contract for a new test (volume of the contract similar to price of the very specialized equipment necessary), Airbus haggled and put taking it inhouse on the table (they could certainly do that, but as the history of german industry shows, this is just an intimidation tactic for mooore profit).

So the management started to sell to COMAC (basically acting as an intermediary for another not as well-connected german supplier, which also likes to sell to China but can't get around export regulations...), which is basically a sell out, but apparently we want it that way given the protection politics give those predatory bit companies around here (never hear anyone calling Airbus for fair treatment of their supply chain)

Seems like China would have an incentive to get the other IP from Airbus's suppliers to make their own competitor.

Sure. Anyone who is in business has an incentive to get the other guy's secrets...

Unless you are truly innovating, then you don't care what the other guy is doing. Spying is only good for keeping up.

What if the other guy is also innovating? What about what they plan to do next?

Let's be honest here. Everyone has an incentive to gain insight into what everyone else is doing.

Everyone is spying on everyone else.

So do you think DEC was spying on Intel during the Alpha days? Whatever they could’ve learned wouldn’t be worth the effort.

I would hope that Ken Olson was more honest than that, although I guess you never know.

Everyone tries to get the other guy's secrets.

I don't know a company that doesn't. How far would they go? That depends. Sometimes governments help...

your assumptions and blanket statements about everyone doing things is just wrong. Its like someone who promises anything @ 100%... you know they aren't truthful, because nothing is 100%. How would you know what info the other guy gave you isn't a fools errand rather then useful info? Counterintelligence is a thing.

Lots of companies don't pay attention to their competitors aside from just passing glances. Sometimes your competitions action is not in any way visible to you, for instance when trying to win top secret gov design contracts. When you are on the bleeding edge or the only one working on something, there is just no need. I could come up with a lot of reasons why spying is useless(not saying it doesn't have a use, just not useful in every case as you propose)... but i guess i am confident in things, rather than paranoid. Worrying about what someone else is doing is just wasting time, unless they are coming for you.

My comment is not an assumption or a blanket statement, it's the simple reality.

There is never a single company working on the bleeding edge. Those who are take a lot of precautions to keep their secrets and are keen to learn their competitors' secrets.

If you work on the cutting edge in tech just send your CV to your company's main competitor. They'll be quick to invite you for interview... To buy your competitor's product to take it apart and study it is also a time-honoured classic. These are just basic examples.

Also AFAIK: (1) There is a mandatory pilot Airbus training facility in Zhongshan, I believe for China Southern. (2) There is a Rolls Royce engine repair facility in Zhuhai. (3) Cirrus was bought by China and are establishing production in Zhuhai.

... and that's just airline related tech stuff I have passively become aware of within 50km of my office in the last 12 months.

I would still pick a good leader who isn't necessarily a technical expert over Elon Musk's "AI will become self aware and take over the world" schtick.

I would think Pascal's Wager can be applied to that. If Musk is wrong, being extra careful with AI will just mean slightly slower development. If he's right and we don't take it seriously, humanity is wiped out. Why take the chance?

AI won’t have to do much— humanity already on course to destroy itself.

If you go outside, you might get struck by a car. Why take the chance?

Awareness of a risk isn't very helpful if it doesn't come with an understanding of the odds and the costs and benefits involved.

Pascal's Wager is something you either make or don't make based on your own understanding of the odds of each outcome and the costs of each outcome.

Clearly you have a different understanding than Elon.

Pascal's Wager is considered a joke for good reason. It's not any less a terrible argument here than in philosophy.

I thought that pascal's Wager only works with infinite reward/ punishment.

End of humanity is in the grand scheme of things something trivial. It's just happens and then nobody suffers. so there must be a probability low enough to balance it out.

I've conducted technical interviews for approximately 200 students and recent graduates - around 100 each from American and elite Chinese universities.

I've seen absolutely zero evidence for your view that "a generation" of Chinese students has graduated with "weak understanding of the fundamentals" compared to Americans.

I'm happy to discuss further (surely my interviews are imperfect tests and the samples are biased in some ways), but let's ground the discussion in evidence. Where did you get this idea?

> ... technical interviews ...

Technical interviews are manufactured tests that can be easily gamed. The idea that any valuable insight can be drawn from them is naïve at best. Further, the post was specifically about innovation -- given this constraint, technical interviews are notoriously bad at separating the wheat from the chaff (e.g. product questions are non-existent in technical interviews).

"Fundamentals" can mean different things to different people, but let's not pretend technical interviews are a reliable signal.

You don't know anything about the parent's process so your assumptions are pretty wild

The parent's anecdotal experience is still a valuable datapoint in the face of two baseless stereotypes:

1. Chinese educated people lack fundamentals and are ill equipped for innovation

2. Technical interviews are at best a naive mechanism for evaluating candidates

Which of my points do you think are in contention? That technical interviews can be gamed? That product questions aren't asked? Or that technical interviews produce bad signals?

Because I have plenty of evidence for all of the above, and the fact that technical hiring is profoundly broken is discussed ad nauseam on HN.

You didn't actually offer a refutation of anything the parent comment said.

A few questions: do you repeat any interview questions across candidates? Do you work for a company that sponsors H1Bs? Does your company have some "prestige" (either a highly visible startup or one of Facebook/Google/Microsoft/Apple/etc)? If so, then your questions are almost certainly available online and talked about in detail within the Chinese community.

I would like to point you to (and encourage a search of your questions or your company): https://www.1point3acres.com/bbs/ . This is probably the largest board out there that shares interview questions (and answers!), techniques, approaches, etc... including leaks of questions, "help" from insiders at large companies, and more. If you seem to suspect that there is some sort of nation-based component to your Chinese interviewees doing quite well, I suspect you may find your study is poisoned and I recommend a redo. As an American, I have not found something similar to 1p3a in terms of the wealth of information available for getting recruited at large companies.

1p3a isn't the only one out there either. There are many more. This is just the one I've been able to hear coworkers and students when I was in undergrad talk about a lot.

Thanks for the the heads-up :)

I hadn't heard about that specific board, but I'm certainly aware that students frequently collaborate in various public and private ways. It's definitely true that my company would be a prominent target, so we take various measures to try to defend against preparation like this.

For clarity, I didn't mean to imply that I had done a formal study. I'm just reporting my personal experience.

Editing to add: I'm really interested in other people's experience, too! I'm honestly curious how this person got the idea that the college grads do not know the fundamentals well. Maybe they're testing fundamentals in a way I'm not and I can learn.

Google coding interviews are meant to test if a candidate would be good at coding for Google, not for building innovative companies.

Of course the elite students from Chinese universities are going to be brilliant, as elite students from any country generally will be. It would be ridiculous for me to claim that every single student in China doesn't understand the fundamentals of their field.

However, an academic culture that doesn't see anything wrong with cheating will mean their average cohort of students have a much weaker understanding of fundamentals compared to average students from a country that doesn't tolerate that.

Sampling bias. The small percentage that put in the effort would be the ones applying for jobs at top US companies.

> Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products.

Already debunked in this thread.

> Even their university culture practically encourages cheating

It is not like we'd not have this in western culture. They use the same metres we do: titles and names of educational institutions attended. As with every metric. those who understand it exploit it to cheat those who apply it.

> An economic model where American/European/Japanese/Korean tech is stolen and then friends of politicians are gifted CEO positions of companies that clone that stolen tech...not sustainable at all.

With a billion people behind it, it is actually pretty easy - you just outlive competitors while you pay for the losses out of pocket. And that is what western companies have been championing: If compliance says "we accept the risk", we take the risk.

> When robotic manufacturing eventually becomes cheaper and faster than manufacturing in China, meaning they'll no longer have IP to steal, they are in huge trouble.

So are we. Who is going to be able to afford the products if we all are replaced by robots in the workplace?

> > Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products.

>Already debunked in this thread.

Seems to be true, although they're only manufacturing interior parts. Certainly nothing high tech.

> Who is going to be able to afford the products if we all are replaced by robots in the workplace?

> When robotic manufacturing eventually becomes cheaper and faster than manufacturing in China

That is a straw man argument. Manufacturing is one of the leading frontiers in automation. It's going to be cheaper to manufacture things outside of China due to automation long before a significant enough portion of the workforce is out of work due to automation and unable to afford the manufactured goods.

All very plausible, but maybe aerospace is just something they're weak at while getting strong on others (computer vision recently, but maybe that was also stealing I can't say).

Anecdotally, the strongest student grade wise I've seen in college was a Chinese one. I don't think she managed to cheat there.

Virtually every industrialized economy since the Industrial revolution has developed in part by 'borrowing' or stealing existing technology. Not making a moral judgment here, but economically it makes no sense to reinvent the wheel.

You might be right that predictions of China's rise is overblown, but we forget how crappy Korean technology was just a couple of decades ago, and there's no reason it can't happen again.

Regarding the Ma/Musk debate, that seems like a strawman argument. Ma studied English in college and his strengths are his business and political accumen, not technical ability. There's plenty of people in China with a better understanding of the AI landscape.

See the book “Wonderland: How Play Made the Modern World” by Steven Johnson for interesting examples of agricultural theft (the history of vanilla was fascinating). Here’s a video lecture from Steve that may include some, but I only just found it while double checking the book title. http://longnow.org/seminars/02017/jan/04/wonderland-how-play...

> Interesting how Boeing and Airbus don't manufacture in China

Airbus has been building aircrafts at a Final Assembly Line in Tianjin since 2009. And many Airbus/Boeing suppliers have formed joint-ventures with Chinese companies to bid on contracts for the C919.

> Even their university culture practically encourages cheating in classes to pass, so you have generations of students graduating with weak understanding of the fundamentals.

There is some truth in that, but it's quite exaggerated and sounds like a conclusion someone without deeper understanding of China AND US would make.

If someone only learned about US education system via news sources, the picture being drawn is gonna be quite bleak, sex, drugs, anti-intellectual, bribery for admission, racism, classism, etc. ...while in reality, it's mostly working pretty well, but nobody is getting views by writing about smart and hard working students doing well in school.

I think the opposite is the case here. There seems to be a deep sense of pride from Chinese in particular who are able to "game the system" so to speak. There is indeed a majority of the populace who may just be normal folk working hard, but a non-negligible amount do indeed cheat their way through school at a rate that is not even comparable to anywhere in the west.

That’s quite an extrapolation from China’s supposedly lack of a Boeing/Airbus competitor. Does the Comac C919 not count?

Jack Ma was an English teacher and does not even know how to use keyboards. You expect him to know what Machine Learning algorithms do?

> Interesting how Boeing and Airbus don't manufacture in China

https://qz.com/1497137/boeings-china-plant-delivers-first-je...

Please don't take HN threads into nationalistic flamewar. Those discussions are all the same, i.e. predictable, i.e. lacking in curiosity and therefore off topic here.

https://news.ycombinator.com/newsguidelines.html

My apologies, definitely not my intention. Was more-so a personal rant on the importance of meritocracy. Noted.

Original report: https://www.france24.com/en/20190926-airbus-hit-by-series-of...

Link to the actual source, please. This is a rehash (abhorrent blog spam) of a proper news report.

Thanks! Url changed from https://www.infosecurity-magazine.com/news/airbus-suppliers-....

Seems like Boeing is getting pretty desperate to fix their MCAS issues.

Without wanting to dive into the politics cesspool, In general I'd favour sharing IPR on RAND terms, rather than locking it up as special secret sauce. I think if Comac is struggling to learn how to make safe aircraft, then helping them is "build a better world" more than fighting them at the firewall.

I used to complain so bitterly that the computers I had for AI research work, despite being a flavor of Linux, had no access to any sort of networking, making the installation of basic packages a pain.

It turns out the safest way, barring spies who willingly steal, is provide no entry/exit points for data. For smaller organizations or small divisions that's feasible, but super hard to maintain at larger divisions.

That's one way to get security... not a very practical one though.

Having seen what a competent Red team can do that is not much of a barrier if information its valuable enough

So, it used to be that saying anything remotely skeptical about Bitcoin was the way to get downvoted on HN. Nowadays, it seems that saying anything negative about China is how.

Although, in the field of aeronautics, it is not like China is the only "state sponsor" to engage in espionage, or that this is anything new for any of the major powers.

You want to try writing something vaguely anti-USA, that's when they really come out to get you.

HN / Reddit votes are very easy to manipulate with State-backed funding. Best to ignore the "consensus" on online boards and make one's own decision based on available evidence.

Please don't post insinuations about astroturfing without evidence. It poisons the well, and the overwhelming majority of such comments are based on imagination only.

https://news.ycombinator.com/newsguidelines.html

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Honest guestion: I understand that unfounded allegations of astroturfing are not helpful. But does HN have systems in place to avoid malicious manipulation like this?

We have lots of anti-abuse measures, and they catch things. But of course we don't know what we don't know.

The issue with unfounded accusations is not that real abuse doesn't exist (it does); it's that internet users are overwhelmingly too quick to believe that they're seeing organized manipulation when really all they're seeing is something they dislike or find annoying. Such accusations need to clear some bar or they flood the forum and do more damage to it than the abuses they're imagining would do.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

It's not remotely close to true that negative comments about China are "the way to get downvoted on HN". On the contrary, HN's demographic, while quite international, is almost all Western, and for better or worse it follows geopolitical trends and the leads set by government and media.

When we have to ask commenters not to take HN threads into nationalistic flamewar, it's usually because of generic nationalistic rhetoric against China. This happens often enough that we routinely get accused of being pro-Chinese. We're not, of course. We're against nationalistic flamewar, regardless of who is flaming or being flamed, because it's against HN's rules and destructive of the spirit of this site.

https://news.ycombinator.com/newsguidelines.html

I appreciate HN doing their best to keep discussion in a productive zone and out of flamewar territory. I enjoy HN a lot, which is very different from most sites that allow comments.

However, comparing my parent comment here to the average for most comments I make, or comparing it to comments related to Russia, France, Germany, or any other major nation-state, I have to say that the empirical evidence does not support your statement. :)

But, again, I appreciate HN discussions and the efforts to keep it a productive discussion.

I hear good things about this MCAS thing Boeing is doing. Maybe it's worth copying.

Maybe you're being sarcastic, but this seems unrelated. The attacks are on internal networks with an attempt to gain unauthorised access to technical data; it seems to have nothing directly to do with attacks on the software that directly flies the plane.

No, but perhaps it is coming from the same organization that thought MCAS was a great idea. After all, such an organization obviously has severe deficiencies with basic systems engineering; what other deficiencies might it have?

The article clearly states China was believed to be responsible.

...what does Chinese gain from these attacks then? International infamy?

Valuable aviation intel to use for their young, but growing, airline industry.

Makes me wonder if it'd be simpler to gain this stuff the old-fashioned spy way: bribe or blackmail someone working in one of those supplier companies.

If Pierre in Toulouse is desperate to hide his affair with the Chinese girl he met a week ago in the bar...

Oh, that certainly happens as well. It's just harder to pull off, because physical security at these companies (even physical computer security) is well ahead of network security.

Or the other way: just buy it outright. Either buy from the supplier companies, or buy existing stuff used and reverse-engineer it.

This isn't denial of service attack, this is unauthorized access to steal technical data.

I wouldn't call it cyberattack then; rather it should be cyberespionage

Stealing blueprints and other technical data so they can make their own knockoffs of western aircraft, as they have with the J-20 (F-22 knockoff) and J-31 (F-35 knockoff).

That’s a cheap shot and a risible one at that. The hierarchy of decision-makers who designed and implemented MCAS and the hierarchy of decision-makers who handle the information security at Boeing is (as I’m sure you’re well aware) so far removed and unrelated to each-other as to be essentially distinct. Conway’s Law doesn’t really apply here.

Exactly. A rogue bunch of MCAS engineers hacking Airbus is not based on any kind of reality.

Both of you provide some sources or anything more than “I could imagine X...because Boeing has been in the news lately.”.

My first question would be if the Chinese hacker is American looking or if he is named Boejing Wang or something like that.

Jokes aside there are a huge number of mobile devices with saved credentials for exclusive business VPN access and a lot of businesses restrict access to resources based on the source of requests, which can be the corporate network of a supplier. This is often done to enable some forms of electronic data interchange. Putting these services in another network would probably have helped.

It would be my guess that the hacker gained access through a privileged network with stolen VPN credentials. There would be countless ways to achieve that.

Perhaps pickpockets should just sell the stolen phones to relevant companies.

I am not following your borderline racist comment about a name. Why do you assume stolen credentials? Low hanging fruit could be the entry point, but advanced attacks are common with state actors so this is highly assumptive and brings nothing to the discussion.

Reply on news.ycombinator.com