Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

China is investing in Linux for one simple reason - they can have someone read the source code.

A (low-level?) war is going on right now between US and China - and the battlefield are the hardware and software that runs the world.

Can't read the code - then we don't trust that you aren't spying on us.

Unfortunately I doubt they will extend the same rights to their citizens.

On the Nvidia side, this is either the dumbest commercial move ever,(#) or they really do have quite a lot to hide in that code.

(#) Really I cannot imagine anyone turning down an order on 10 M PCs. Whats in that code base?

Edit: @virdah - thank you for pointing out the should-have-been obvious.

View on HN

Well, there's that, and the fact that China is notorious for reverse engineering, and basically just stealing the technology and making their own knock-offs. I don't blame Nvidia for not giving them the source code.

Many experts have shown that hardware specs which are sufficient for writing drivers are entirely useless for making hardware, to someone already versed in the field.

So where is my WinModem driver?

You must have misread.

If one has enough info about nvidia hardware in order to make a driver for nvidia hardware, the same info is not enough to make your own nvidia hardware clones.

Sounds like plenty to make drivers for your knockoff hardware, though.

Why would you want to make hardware which is compatible with open source Nvidia drivers?

You sure about that? Read up about ghost-shifts in semiconductor fabs. Bunnie tells a bit of the tale in his story about counterfeit SD cards:

"Very low serial numbers, like very low MAC ID addresses, are a hallmark of the “ghost shift”, i.e. the shift that happens very late at night when a rouge worker enters the factory and runs the production machine off the books"

http://www.bunniestudios.com/blog/?p=918

If you can run the hardware manufacturing off the books, I don't see how access to the driver source code would help. You would just ship the official binaries.

The point was that you don't need to know anything about the driver or hardware to make clones. There are other ways.

Which continues to moot the relevant point: Nvidia are withholding necessary software specs which not only aren't useful in reengineering their hardware, but which fail to protect against fully independent attacks (ghost shift manufacture) which at least allow duplication of current physical product if not producing a superior hardware product.

I read/heard/imagined(?) that the reason GPU vendors weren't willing to hand over their source was due to a proportion of their performance being software based. Which then a competitor could also implement.

They claim that their shader compilers/schedulers are part of their performance benefit, yes.

But they don't need to provide that source, just hardware specs. Gallium3d already has shader compilers and schedulers.

The other big problem is lawsuit exposure. Given the current state of the patent system it's certain that nVidia drivers infringe on someone's patents.

Closed source drivers make it more difficult for patent owners to check, and launching a lawsuit without evidence of infringement is very expensive.

But these code bases aren't nearly large enough for it to be a problem for a reasonably sized team armed with decent tools to disassemble and analyze them if the goal is to figure out the techniques used. It might be their reason, but if so it's a damn stupid reason.

If reverse engineering is a crime, then you can probably say the same thing about the whole Linux community, and how they are "stealing" Microsoft and Apple's innovations.

Who said it was a crime? Just that a company might not want to give away it's source code because they don't want to make it easier for another company to make knock offs.

This has been a big issue for companies dealing with China, you sell your product their for awhile, until they can reverse it (or even hack your servers for info) and make their own.

In this case, the legality wasn't brought up, just the motivations for one company not sharing with another.

Governments and Universities can already get access to Windows source. I think the difference is that China can write the source for Linux.

Some governments have access to that source code, but it gives them no guarantees that what they run is faithful to it, and it doesn't let them replace the usual products with something audited. Even if they can compile something out of that source, I suspect they can't boot or run the whole thing, and they certainly can't distribute it.

Universities are given access to Windows source? I'd never heard of this before. Do they give access to all accredited universities, or is there some other kind of restriction?

See http://www.microsoft.com/education/facultyconnection/article...

> Use of the Windows Research Kernel requires academic affiliation with an accredited institution of higher education and direct involvement in teaching and/or research, such as being academic faculty members, system or lab administrators or instructors, students enrolled in relevant undergraduate or graduate programs, or academic researchers working on faculty sponsored projects.

As I thought.

When I was in University (some 16 years ago), that was already the case. However, you could only browse the source - some essential pieces were missing that made it impossible to build a working system from that code.

Thus, you still have to trust that code you view is the code you run -- which is almost as bad as trusting documentation.

> I think the difference is that China can write the source for Linux.

I think the key here is that they are able to verify that the code they review is the code the run, by building the system.

And, I'm aware of "reflections on trusting trust", but I'm sure that they have a clean-room bootstrapped C compiler capable enough of bootstrapping tcc or gcc and thus the linux kernel.

Microsoft provides Windows and Office source code for Chinese government since 2003 as part of Microsoft Government Security Program.

Can you compile a working system from that source?

Does the Chinese government compiles and builds their own version or they trust Microsoft will use the exact same source they have shown?

In Brazil we had some interesting questioning regarding the security of electronic voting systems - in 2002, I was on the team that developed the WinCE version of the electronic ballot - we had the source for the application and some of the device drivers, but we didn't have the sources for the compilers, libraries and operating system. Any of those layers could harbor a known (or unknown) backdoor that could allow tampering with the voting data.

I'm pretty sure my compiler was clean (I installed my development machine from my MSDN subscription CDs before the corporate IT folks could get their hands on it, so I imagine nobody could have sneaked into my house to place the CDs in my backpack)

Reply on news.ycombinator.com