Hacker News Reader

Comment by infocollector | Hacker News Reader

How is security taken care of when contributions are being done by Huawei (backdoors in 41k lines of sourcode?)? But I am guessing there is no real fight between open source software and state actors - perhaps someone who knows more about the security of the kernel can comment.

View on HN

Normally the identity of contributors is not really checked when you want to contribute to an open source project. A valid email address and a name is sufficient to contribute to the Linux kernel.

All changes to The Linux kernel are getting publicly reviewed, so the hard thing is passing this technical review if you want to introduce a backdoor. If people know you, based on previous contributions, the review could be less hard, so it could make sense to build up a reputation before. In the Linux kernel not the company builds up the reputation, but the individual engineer who contributes. If this is a Huawei hardware it could be easier for an engineer with a Huawei mail address to get changes integrated, because people assume he known the driver and hardware well and people trust claims like, "this can not happen because the closed source firmware takes care of this".

If the Chinese intelligence agency wants to integrate a backdoor into mainline Linux it would be easier to just build up some own fake identities and use them. It probably would be easier to just analyze the Linux kernel and use bugs introduced by other people.

The NSA also contributed to the Linux kernel, look for contributes from a nsa.gov mail address.

I would expect that malicious code would itself not be a proper backdoor, but rather a framework or hook or API that makes it easier to bypass restrictions. Subtle behavioral changes in the kernel combined with user space code could empower a state actor to move unnoticed. I think of it like 20 parts of a munition. Each piece by itself may look mostly harmless. This is all theory of course, but that is how I would do something malicious in the kernel. A theoretical example would be a simple kernel API combined with something like systemd's binfmt mount and a benign looking PNG image file that when parsed by binfmt, instructs the kernel to do something interesting such as tickle an undocumented CPU instruction.

Not just contributed. SELinux is primarily authored by the NSA.

Now Huawei is fixing bugs in SELinux: https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e...

Or reports them, so the NSA can fix them: https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5...

Huawei has already made some 'careless mistakes': https://www.zdnet.com/article/huawei-denies-involvement-in-b...

And they follow the "deny, deny, lie" aspect of their government as well. Wish they would have some honesty. You can't call a project named after your company not involved with your company.

If a state actor really wants to do it and someone could get it past reviews, I am sure they could bribe any contributor from any country (including US). Why single out China? We never raised concerns with Russian contributors.

Maybe not single out China, but many people think China is particularly untrustworthy:

  they insist Chinese law is used outside China, and lecture people how they should refer to China in public;
  they operate concentration camps;
  the Chinese language has no word for *mutuality*, China benefits from free speech and access to institutions in the West but doesn't allow the same in China for journalists or businessmen;
  China treats Chinese-speaking minority in Western countries as Chinese citizens, and even blackmails them by threating their family;
  Winnie the Pooh is extremely thin-skinned and can have games like Devotion removed from Steam and GOG even after the reference is removed from the secret area in the game;
  there are many instances where businesses with Chinese shareholders were pressured not to publish anything mildly critical of China.
  BBC team visiting China investigating covid19 faced obstacles reminiscent of The Truman Show;
  WHO scientists investigating covid19 recently not permitted into China;
  China doesn't even formally frown at corruption;
  Journalists disappear or regularly get sentences in China;

Western liberal democracies have flaws, but I'll take Western values over Chinese values, thank you very much. Also, the West has less leverage over China than over Russia so it's important not to yield any ground.

> China doesn't even formally frown at corruption;

That is such a ridiculous claim considering that Xi Jinping strengthened his power through anti-corruption efforts:

https://en.m.wikipedia.org/wiki/Anti-corruption_campaign_und...

as someone entirely in the dark on this particular campaign, it seems pretty easy to me to label people corrupt and remove them when they disagree with me. They don't have to actually be corrupt, just not align with my goals. What's to say this isn't the case?

> they insist Chinese law is used outside China

They're touchy about people recognizing what they view as separatist movements, but that's relatively minor compared to, say, the United States forcing its sanctions policy on the rest of the world. Everyone around the world is afraid of doing business with Cuba, Iran, Huawei, and other targets of US sanctions, because the US aggressively applies secondary sanctions. The US is even sanctioning Germany, its own ally, in order to try to force Germany to back out of a pipeline deal with Russia.

> the Chinese language has no word for mutuality

There are many ways to say "win-win" in Chinese, and if you ever listen to Chinese diplomats, they say that phrase incessantly.

> China doesn't even formally frown at corruption;

One of Xi Jinping's most highly publicized policies (inside China) is his anti-corruption campaign. This is practically his signature policy. You can argue the policy isn't in effective or isn't sincere, but to say that corruption isn't formally frowned upon us just wrong.

> WHO scientists investigating covid19 recently not permitted into China;

China hasn't processed their visas quickly. I'd wait a bit before passing judgment.

Ever heard that Taiwan is doing a stellar job holding off coronavirus? No, because China presses WHO into not mentioning Taiwan. We could learn a lot from Taiwan. China doesn't just boycott Taiwan, it makes others act as if the country doesn't exist.

https://www.worldometers.info/coronavirus/country/taiwan

There's a frozen civil war in China. The government is obviously touchy about other countries recognizing what it views as a breakaway province. China views such recognition as meddling in its internal affairs.

In Western news coverage, though, I see precisely the opposite of what you see. Taiwan is often listed as an example to follow, while China's combating of the epidemic is largely ignored. A lot of people even seem to think that the epidemic is still raging in China, but that it's all just being covered up.

a) It's not Western news coverage but international.

b) No one believes anything China has to say because they have a history of coverups and suppression.

c) The lack of an independent press or judiciary means we don't have mechanisms to independently assess the truth.

It's not actually difficult to know what the basic situation is in China right now. Go on YouTube Twitter, or any other large social media platform and look at what people who are currently in China are saying. Even in this thread, I'm sure that some of the commenters are in China.

You can also look coverage by Western press in China. A German-French public broadcaster did a report from Wuhan not too long ago that shows how different the situation is there from Europe and the US: [1,2].

By the way, documents from Hubei province have leaked, and the number of people testing positive for SARS-CoV-2 in internal government records roughly matches the numbers that were published each day.

1. German: https://youtu.be/LmsI7lc2_Vg

2. French: https://youtu.be/OyHt7-KmK7Y

Since you mention YouTube, I quickly compile a list of Westerners who have lived some time in China, i.e. not tourists. To help people make decision if they are brainwashed. But usually "Brainwash" means brainwashed people can not find they are brainwashed.

List A: These 2 guys are thinkers then others. They should be working on different job. Expecially in Western intellegence to help westener better undrestading China)

1. Cyrus Janssen(American)

https://www.youtube.com/channel/UCxEQsjgRRfGWiJJu_PDygxw

2. Daniel Dumbrill(Canadian)

https://www.youtube.com/channel/UC6Bl8MTbW9M9MQoPhxbarpw

List B: (Positive)

3 Matt (American)

https://www.youtube.com/channel/UC8Ykci4MKSSdTJYuYp53G7A

4 Gweilo 60 (Canadian. Mainly positive. He also talked about negative side)

https://www.youtube.com/channel/UChXOhG9bRDb3vSTg-qkPAZg

5 Jason(British)

https://www.youtube.com/channel/UCzDE2LGSmJnw53WrZ7mM_Aw

6 Nathan Rish(American. Seem a little opinionted)

https://www.youtube.com/channel/UCaSlyjhR4WC7QhYuaivxb6g

List C: (Negative, but was positive)

7 serpentza (South African, the oldest vlogger about China)

https://www.youtube.com/user/serpentza

8 laowhy86 (American)

https://www.youtube.com/user/laowhy86

(edit) reformat

Taiwan is not a country in China's eyes. Technically Taiwan is really not a country but works like one since 1949. If you follow Winnie the Poh closely enough, he has claimed "Taiwan problem will not be passed onto next generation". My personal estimate is that Taiwan will be taken by force within 20 years.

Do you feel it'd be an amphibious invasion would be a bit of a pyrrhic victory within 20 years? I feel like the PRC would be unpopular with the citizens of Taiwan and not look good internationally.

My impression is that the PRC was sabre-rattling to rally the public.

PRC appears to be unpopular with significant numbers of Hong Kong residents and it most definitely didn't look good internationally. That doesn't necessarily stop them from taking power.

If Taiwan is not a country but a Chinese province, why is China ashamed of it? A province famous for electronic industry and very successful against global pandemic.

My personal estimate is that Taiwan will become a forgotten remnant after Pooh Jinping goes into the void in 20 years.

I'm not the GP, but:

Yes, I heard about it plenty of times.

It's great that they're doing well, but that doesn't diminish the Chinese, Korean, Vietnamese, Newzealandese accomplishments in tackling covid19

> The US is even sanctioning Germany

The US has not sanctioned Germany. E.g. a US company subject to the EU Global Human Rights sanctions regime does not mean the EU is sanctioning the US.

This is a major project that the German government is heavily involved in. Major German companies are under threat of sanctions. The US is using sanctions in order to try to force the German government to change its strategic and economic policy. This is a bit more than the US sanctioning some random German company.

> They're touchy about people recognizing what they view as separatist movements

I love how you refer to mass kidnapping of protestors from Hong Kong "touchy".

I didn't say anything remotely like that.

Some of your points feel off to me:

    "they insist Chinese law is used outside China, and lecture people how they should refer to China in public;"

Not really sure what examples you had in mind, but I would imagine most communities would have a preferred way for other people to address them; I don't think it's wrong for them to demand that. If you don't like China's demand then you can refer to it however you want; but they also have the freedom to dislike those who do that.

    "they operate concentration camps;"

In my unpopular opinion: I would call them brainwashing camps, or re-education camps if there is no need to appeal to Western audiences. I don't think I have seen evidences that people have been systematically terminated in those camps, which I believe is a key characteristic for concentration camps.

    "the Chinese language has no word for *mutuality*"

Did you mean what you said seriously/literally? Or is it a phishing question to see which commenter speaks Chinese? ;)

    "China benefits from free speech"

I would argue that they didn't benefit much from "free speech", otherwise China would probably be mentioned in a more positive light nowadays. IMHO, China's state machinery is pretty good at internal censorship and propaganda due to their long authoritarian history, but their methods for manipulating/spinning narratives is rather unsophisticated compared to societies with more democratic traditions.

    "Winnie the Pooh is extremely thin-skinned and can have games like Devotion removed from Steam and GOG even after the reference is removed from the secret area in the game;"
    "there are many instances where businesses with Chinese shareholders were pressured not to publish anything mildly critical of China."

Capitalism has no backbone, I guess?

    "BBC team visiting China investigating covid19 faced obstacles reminiscent of The Truman Show;"

Your neighbour doesn't like you, and he thinks you are guilty of theft. You told him you have not done that and turned down his demand to enter your home to investigate. Your neighbour informed the police, and they come to your door with a warrant; this time you have to let them in. Is BBC the world police? If so then I guess China is at fault here.

    "WHO scientists investigating covid19 recently not permitted into China;"

I think WHO is much better qualified than BBC for investigating this, so not a great move from China. They should let them investigate.

    "China doesn't even formally frown at corruption;"

I can see you don't know China at all. China does formally frown at corruption. The problem is China informally doesn't frown at corruption.

Everything you wrote is pathetically false. Why not be honest because shitty propaganda harms your cause more than it helps.

Here's me being European and thinking, how many of these could be applied to USA as well. At least Xi Jinping is a properly ruthless politician, his thinner-skinned equivalent in the USA is just a fucking idiot running around screaming.

Yeah, yeah, "whataboutism". BTW, Chinese values, or Chinese government values? I'm sure the average Chinese would speak up if they knew they wouldn't end up in reeducation camp. Yeah I'll give you one thing, at least in the West it's still possible to speak up.

Meanwhile, in Washington DC at the moment, there are violence-ready Americans openly demanding democracy be ignored and to install their preferred fuckwit as ruler. Seems like they're just as brainwashed as a Chinese who's been fed CCP propaganda.

> I'm sure the average Chinese would speak up if they knew they wouldn't end up in reeducation camp

What is the average standard of living in China 50 years ago vs today? There has been remarkable growth for millions of people. If your standard of living was 10x your parents, you might not view life as that bad?

This is exactly the point a lot of people miss: as long as the quality of life keeps growing, nobody will do anything about it. However, once it starts slowing down or even going down, then the government will start having really hard time. This repeats throughout the history again and again.

I'll give you another example. A man was removed from a Polish reality TV show because he had been accused of rape outside Poland. The TV station was TVN, owned by US. The participant had received a sexual favor from a 16 year old. The age of consent in Poland is 15.

I'm not impressed by ruthless politicians. Ruthlessness is good for action movie thrills. It takes much more skill and leadership to forge compromises and unite people using respect. By the way Spartans sucked even at combat, they just had really good PR. No matter how you slice it, they were completely average, even if you exclude naval battles or battles which included their allies.

(extremely long reads for those interested in history)

https://acoup.blog/2019/08/16/collections-this-isnt-sparta-p...

https://acoup.blog/2020/01/17/collections-the-fremen-mirage-...

re: whataboutism. Whataboutism has no place here because it's not even on the same order of magnitude. You're comparing tons to kilograms. We don't even know the full extent of what China is doing because free press is not allowed to operate there, doctors and journalists get sentences.

Reality check: if a state actor wants to add a backdoor it's easier at the parts closest to the consumer: the integrators, not the fundamental technology

Of course you could be playing the long game as well like with Dual-EC-DRBG

It's not even necessary to mention China and Russia, the NSA is equally interested in placing a backdoor in the Linux kernel. People were paranoid about it already 20 years ago [0], but according to Linus' father, NSA actually tried to pull it off [1].

[0] https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-...

[1] https://www.omgubuntu.co.uk/2013/11/nsa-ask-linus-torvalds-i...

Eh you may want to read up about the NSA history of backdoors.

Honestly, people seem to forget that this happened. They lose their shit at the slightest mention of Huawei/China but don't even have an issue using software released by the NSA[0].

Unpopular opinion, but if I had to choose between China and the U.S. spying on me, I would pick the one who's less likely to have me extradited from whatever country I am in or ban me from flying.

0.https://en.m.wikipedia.org/wiki/Ghidra

> I would pick the one who's less likely to have me extradited from whatever country I am in or ban me from flying.

Frankly, I despise what the American government did to Assange and Manning. However, you can't even remotely compare their fate to what is happening every day to hundreds and thousands of people in different parts of China like Tibet. You have no chance of escaping, no chance of trial not to mention any appeal, your life can be destroyed in an instant. Several people in Tibet each year prefer to self-immolate than live under the terrible conditions imposed by the Chinese government.

For sure, China does awful things to many of its citizens.

But for an American, China doesn't have the ability to do any of that stuff. Nor are they likely to have any reason to care about my actions. While on the other hand, the USA has direct powers over me, and is likely to care more because I'm here.

So sure, China and the CCP are evil, probably much more evil than the US government. But even at that, the danger they pose to a typical US citizen is much less than that of their own government. So it's rational prefer, say, a Chinese-made phone to a US-made one.

About self-immolations for "Free Tibet": People in India, born in India, who have never visited Tibet are self immolating

https://qz.com/india/632077/quietly-a-tibetan-teenager-in-in...

To me, this does not speak about extreme suffering in Tibet, but rather:

1- A very strong sense of self-sacrifice and pride in their community

2- A very effective propaganda machine that persuades even people who haven't experienced suffering first-hand, to make the extreme sacrifice in support of the cause

Interesting opinion, given what Tibet looked like before Chinese invasion (tl;dr: it was a totalitarian hellhole, not comparable with the current situation).

If it's so improved, you have to explain why Tibetans regularly risk their lives escaping over the border to India, where - so long as they are not shot by border guards - they join the ruler of that former totalitarian hellhole, the Dalai Lama, in Dharamsala.

I'd like to read more, do you have any sources?

Speaking from personal experience (I met exiles in Northern India in the 90s). Here's a source, though I don't know how reliable it is: https://bylinetimes.com/2020/01/22/china-clamps-down-on-the-...

They might have been brainwashed - after all, religion plays a role here. Also, getting rid of slavery does hurt the situation of previous slave owners.

You can't just compare what US does to some individuals, and what China does to the entire minority populations of Uighurs (13M people) or Tibetans (7M), like harvesting their organs for example

https://www.businessinsider.com/china-harvesting-organs-of-u...

Yeah, the US just kills civilians around the world at will, invading whatever country they think they own.

So you choose the US?

I understood china.

china has extradition laws just like the US. But the major difference (other than the list of countries they have treaties with) is if you insult the US government, nothing would happen, if you insulted the ccp, they would make up some false accusations to extradite you and throw you in jail, like whats happening already with Hong Kong.

So you're definitely safer with the US than you are with china.

Saving people the google search, I believe secfirstmd is referring to:

https://www.youtube.com/watch?v=7gRsgkdfYJ8

For anyone not good with faces the guy responding is Linus Torvalds who created and still manages Linux.

I didn't read the above comment as dismissing the NSA's history with backdoors. It generalizes by referring to 'state actors'. The NSA is not mentioned at all.

Perhaps it was edited?

Reply on news.ycombinator.com