Hacker News Reader

Comment by dylan604 | Hacker News Reader

Is this purely careless programming, or genuinely diabolical to use in conjunction with something else to allow for more "interesting" things later?

Never attribute to malice...stupidity. However, I'm guessing since it is Huawei, it will always (deservedly?) be suspect as malice first?

View on HN

Didn't the UK last year rip into Huawei after reviewing the networking software, finding something like 18 different versions of OpenSSL inside of it with various vulnerabilities. At some point, continuing a trend of stupidity should be considered malice.

Huawei promised to fix these horrible security issues after a code review in 2012 and the establishment of the HCSEC oversight board in 2014, yet HCSEC found Huawei had not fixed the issues found in 2012 in their 2018 report, at which point Huawei promised to spend $2 billion to improve code security.

IIRC the 2019 report from HCSEC outlined the same bugs had yet to be fixed. I think Huawei doesn't want to fix bugs in products they aren't currently selling (in part based on Nortel code that has been patched over the last decade with new features), thus the lies and lack of investment.

More reading: https://www.fiercewireless.com/wireless/uk-says-huawei-equip... and https://aragonresearch.com/cyber-war-flashback-remembering-t...

A less generous interpretation would be that Huawei cannot fix the code since they were the not the ones who wrote it on the first place.

I would put money on careless/unskilled programming over diabolical. For diabolical code, you would want something that could withstand a few levels of code review.

Yeah sadly this just looks like typical work not uncommon in huge tech corporations with pretty broken development and management pipelines.

Why not both? Pepper the code with easy to find (and use) vulnerabilities and also a few harder to find. It's win win for those who are trying to inject the exploits, as if the obvious stuff can be chalked down to incompetence, then the subtle ones can surely be - so in a way its a smart method of shielding the nefarious act.

it just looks like awful code which isn't really out of the ordinary for a lot of stuff I've seen from Huawei.

Other than that, attributing malice to someone just because it's a Chinese company is probably inappropriate.

Huawei has a history of stealing from other companies, regardless of it being a Chinese company.

You are the first person in the thread to bring up the fact that they are Chinese.

because it's the obvious subtext. Every time Huawei or Tiktok come up it's the same amount of accusations.

Facebook and Google probably feel the same way every time privacy conversations come up. Too bad. Walks like a duck, sounds like a duck, must be a duck. Don't care what country a company is from, if you keep doing the same thing over and over again, I'm going to have this opinion.

Reply on news.ycombinator.com