Hacker News Reader

Comment by zhte415 | Hacker News Reader

I'm surprised HN is full of knee jerk assumption without first checking what the government required disclosure policy is.

Here it is: Verify. Report to 'vendor'. Immediately. Report to government including an analysis within 2 days.

Link to policy: http://www.gov.cn/gongbao/content/2021/content_5641351.htm

Link to past HN comment on this on another story on this topic: https://news.ycombinator.com/item?id=29653352

View on HN

I don't think there are any knee jerk assumptions happening; TFA details the differences, including the policy you're referencing.

(archived version of the article: https://archive.md/Yvsca)

From your linked policy (translated by Apple):

>Article 7 Network product providers shall fulfill the following security vulnerability management obligations

>(2) Relevant vulnerability information shall be submitted [...] within 2 days

In this case, an Alibaba researcher found a bug in an Apache product, so this policy wouldn't seem to apply as Alibaba is not the vendor of the product.

Plainly the linked policy does not ask Alibaba to do what the article says it should do, ie, notify the government first, as per machine translation.

It seems to say that they should notify the vendor (ie, Apache) as soon as possible, and notify the government within 2 days (according to rfoo they are not at all required to disclose it to the government since it's not their product, but they are encouraged to do so), not that they should notify the government first and then wait for approval to notify Apache.

According to google translate:

(1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately.

(2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products.

So according to machine translation, the article is incorrect, and they do not have to notify the CCP first, instead they should have notified Apache first, and then the government within 2 days.

I think the central point of the article is that the Chinese government is deviating from their stated policy by punishing Alibaba with the 6 month freeze, thus making it newsworthy.

Does the article say that? The article says that the law encourages them to notify the government first, which it doesn't seem to.

At the same time, the article doesn't say that China is going to stop supporting Alibaba Cloud, just that that the MIIT is freezing cybersecurity cooperation, as far as I understand the article there is no legal punishment or serious financial punishment, and it's not even clear that the cooperation with the MIIT didn't have other terms. It's not clear either that they followed the 2-day period.

From my understanding, Chinese government didn't punish Alibaba according to the regulation discussed above.

Given that the punishment is rather obscure and really weak (okay, your country's CERT felt pissed off and won't talk to you for 6 months, but for megacorps like Alibaba, would they really care?), I don't think they are willing to break the rule, at least for now.

> and then the government within 2 days.

That's wrong. According to the text Alibaba is not required to report the bug to government at all. The 2 days term apply to "domestic network product provider" which would be ASF/log4j maintainers in this case. But they are not domestic so this does not apply.

Thanks for the correction. I am not convinced however, if Alibaba ships a single product with Log4J it would be their own product too.

See my sibling comment, if "the product" != log4j, Alibaba is then not required to report that log4j had a vulnerability.

Do you mean by redistributing log4j they became a "network product provider" of log4j?

Either that, or that one of their own products is vulnerable because of the Log4J vulnerability.

Alibaba Cloud, like the other big clouds, has many Java-based products. They’re certainly the vendor of their own vulnerable Java-based products. Whether some other party wrote the code in question doesn’t change that.

Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products.

AFAIK when the bug became popular on Dec 9, there are still many Java-based services running by Alibaba Cloud remain unfixed, and it caused chaos and panic among their "SRE"s.

However reading the regulation text again, now I'm not sure in this case what Alibaba should report:

> （二）应当在2日内向工业和信息化部网络安全威胁和漏洞信息共享平台报送相关漏洞信息。报送内容应当包括存在网络产品安全漏洞的产品名称、型号、版本以及漏洞的技术特点、危害和影响范围等。

It said they should report "the name, type and version of the product with the vulnerability, the 'technical characteristics' of the vulnerability and the impact". Does this mean, Alibaba should report, for example:

"Alibaba Cloud hosted Apache Flink stream computing service (whatever brand name they use) contains a pre-auth critical RCE vulnerability due to insecure processing of user input in version a.b.c till x.y.z"?

I'm not seeing how could the government know what the bug really is if "the product" means Alibaba Cloud's own product.

Sure, Alibaba broke the law. But there is no rule of law in China. If laws were truly enforced the entire system would collapse.

This was using the law as a weapon to keep companies in check. If this had been another company firmly in the pocket of the CCP, this would have been overlooked and never made public.

> But there is no rule of law in China.

Shit HN says. Can we avoid making such blanket statements, please and thank you.

Define rule of laws? Most people don't consider a system where judge, jury and executioner are a single political party that cannot be criticised. If this is rule of law then it's the lowest bar possible

Well...

https://amp.scmp.com/tech/article/2138114/china-discourages-...

de-amped link, I think: https://www.scmp.com/tech/article/2138114/china-discourages-...

randomly hating 20% of the worlds population for being born in the WRONG country? seems reasonable!

What's this comment made in reference to?

You can dislike the actions of a government without hating the people governed by that government.

I think one has to be really careful about the language one uses. To step above this, I urge everyone to not criticize "China" (which, while often intended to address the administration, can easily be interpreted as the country as such and its population) but instead be more precise with "the CCP", "the PRC administration", or similar. Similarly, just talking about "China" as opposed to "The PRC" opens it up to inclusion of Taiwan and other territories not de-facto part of the nation.

So many people attach their identity to their country of origin or citizenship. You can think of that what you want, but by avoiding "attacking the country" verbally, you shield your argument from that flavor of wumao vitriol.

The OP does this right: "CCP pulls support", not "China pulls support".

I see a similar thing with Israel - don't want to be portrayed as antisemitic? Address the administration, not the country.

man synecdoche

Learned a new word..

From hereon, I will start referring to my PC as "the hard drive". It's a common synecdoche, after all.

TIL Chinese government consists of 20% of world’s population. I thought my country’s administration was overblown and inefficient

Typical communist inefficiency

what are you referring to?

Why does the Chinese Government need to be told _at all_? You're saying that doesn't seem strange to you? The government busy silently exterminating a people and who employ mass surveillance and other obvious human rights violations, that they ask for cyber vulnerabilities to be specifically delivered to them doesn't register a reaction with you at all?

To be fair... CERT has affiliations with the US government.

https://en.wikipedia.org/wiki/CERT_Coordination_Center

> The CERT Coordination Center (CERT/CC) is the coordination center of the computer emergency response team (CERT) for the Software Engineering Institute (SEI), a non-profit United States federally funded research and development center.

Reply on news.ycombinator.com