Comment by eqvinox | Hacker News Reader

Comment by eqvinox | Hacker News Reader

Parent Full thread

P.S.: Another angle to view this from is to consider this a startup.

In US & EU, dumb ideas occasionally turn into startups, then they show up on crowdfunding (or, worst case, find a dumb VC), and then they die in a fire of varying gloriousness.

In China, the startup happens inside of Huawei instead. The ideas are equally dumb, but they don't die as easily, and when they make it out of Huawei they suddenly have the Huawei name attached and the Chinese government behind it. And it falls to the ITU, IETF, IEEE, or whomever else to shut it down.

Don't get confused by the "Ministry of Industry and Information Technology (MIIT)" there either. This isn't "state driven." They're just different faces of the same large blob.

And it's not about subversion either. They can't do that, yet. If you buy Cisco, Juniper, Ericsson, or Alcatel, and you find a backdoor... you just add it to the list of backdoors. But if you find a backdoor in Huawei, can you imagine the shitstorm that's gonna break loose? They seriously can't afford that. They'd lose not only US & EU sales and influence, but Middle East, African and South American too. They can start doing that in 10 years maybe, but not yet.

> If you buy Cisco, Juniper, Ericsson, or Alcatel, and you find a backdoor... you just add it to the list of backdoors. But if you find a backdoor in Huawei, can you imagine the shitstorm that's gonna break loose?

There is a saying I ran across at some point:

* The newspapers lie. The government lies. But in a democracy they are not the same lies.

The "problem" with any Chinese company is that this distinction is often hard to make, whereas in Western countries there is much more independence (though not perfect, e.g., RSA and Dual_EC_DRBG).

So when there is a backdoor-like situation in a product from a Western company it is not unreasonable to assume that it is not for nefarious purposes.

> So when there is a backdoor-like situation in a product from a Western company it is not unreasonable to assume that it is not for nefarious purposes.

This perception is exactly why you will get backdoors from Western intelligence services in Western gear, but the Chinese can't pull it off.

It's straight up cognitive dissonance. Western companies are the good guys. Western intelligence services are the good guys. They wouldn't harm "us" Westerners, it's gonna be OK... and the manufacturer will keep the intelligence services in check! We know since Snowden that they broke all the rules, but still, c'mon, it's not that bad, aight?

But if you find a single thing in a Huawei device that looks remotely like a backdoor, hell breaks loose. Of course the Chinese state is behind it! You can't trust them.

And:

> it is not for nefarious purposes.

Please tell me what on earth that purpose would be, for a company to backdoor their own commercial product. Why the f.ck would Cisco or Juniper want to backdoor their customer's networks for their own purposes? Their intent is to sell shit and "create value"! Backdooring your products does nothing to get either of these, but it can very much trash a whole product line.

It's sad, but social signaling and valuation causes its exact opposite in this case. Edward Snowden's achievement wasn't revealing that NSA backdoors exist - people knew that before, but it was "tinfoil hat" country. Now it's common accepted knowledge. Unfortunately, that knowledge hasn't led to change just yet...

> This perception is exactly why you will get backdoors from Western intelligence services in Western gear, but the Chinese can't pull it off.

Western people go after Western companies for backdoors just as harshly as they go after Chinese companies. See the paranoia about the "NSA_KEY" variable. See people going after RSA for their RNG.

> It's straight up cognitive dissonance. Western companies are the good guys. Western intelligence services are the good guys.

No, it's because Western companies are, generally speaking, more independent of Western intelligence. Heck, Western companies actively work against Western intelligence: how much effort did Google expend in encrypting intra-DC links after the NSA's glass-tapping program went public? How much effort is Apple putting into crypto on their various devices?

Reply on news.ycombinator.com