Hacker News Reader

Comment by pmontra | Hacker News Reader

> The companies say they only allow Russia to review their source code in secure facilities that prevent code from being copied or altered.

So how do the Russians know that the code they see is the one generating the binaries sold in Russia? This is where reproducible builds would help, but without source code it's hopeless. They should at least build the product inthe lab, make sha1 of every file and check if they match with the ones on sale. But then there would be an inspection before every release and patch.

View on HN

So how do the Russians know that the code they see is the one generating the binaries sold in Russia?

Maybe this is more about training and retaining Russian tech talent, creating friction for foreign vendors, and spreading a proto-fascist FUD and distrust of governments all over the world.

Because yes, I would think inspecting binaries (probably secretly) would be more productive in pursuit of the stated goal.

You build binaries and make sure SHA1 matches. Obviously malicious vendor can have custom compiler that inserts backdoor code during compilation and obfuscated stuff like that but it dramatically increases complexity and number of engineers who have to know about backdoor. Realistically most companies are not CIA and are not set up for this kind of ops. Essentially it makes it much more risky for company to insert backdoor and gives more incentives for pushing against NSA/etc.

The stated goal of these inspections may not be the actual goal - from the article's third paragraph:

"But those inspections also provide the Russians an opportunity to find vulnerabilities in the products' source code - instructions that control the basic operations of computer equipment - current and former U.S. officials and security experts said."

At least half the point is checking whether the source code is total crap. Detecting intentional, malicious backdoors is a lot more difficult, but the threat of a static analysis tool finding something is probably enough to keep vendors in line.

Reply on news.ycombinator.com