Hacker News Reader

Comment by AnimalMuppet | Hacker News Reader

They're not so arrogant about their code being bulletproof that they're willing to hand it to an adversary and say, "Sure, knock yourself out - see if you can find any holes"? Yeah, I'm not sure that I see a problem here.

View on HN

If Symantec considers the government to be an adversary, then why are they trying to court them as a customer?

From the article:

Tech companies have been under increasing pressure to allow the Russian government to examine source code, the closely guarded inner workings of software, in exchange for approvals to sell products in Russia.

Customers are often your adversaries. In fact, it's almost entirely the case - They're looking to extract concessions, get cheaper goods and services, etc. The customer has incentive to bleed as much as they can from the seller, and the seller also has incentive to bleed as much as they can from the customer. Cooperation despite adversarial relationship is the great benefit of capitalism, but doesn't mean you can ignore the adversity.

There's also a very different mode to their relationships. Symantec is selling to the Russian government - bureaucracies, and it's selling black boxes. Russia is trying to leverage it, to give it advantage in a different mode - Intelligence. Both Symantec and the Russian intelligence agencies are in the infosec business. It's not that uncommon for businesses to do business despite competing in some areas - Samsung was a core iPhone supplier despite also making phones.

"They're not so arrogant about their code being bulletproof that"

The source-code reviews by foreign states are not about checking to see 'if it works' - it's about checking that it doesn't include inserts from NSA etc..

This has nothing to do with 'security review' in the general sense of robustness, it's a 'state actor' thing.

I don't see how there is a way around this.

It's doubtful that Russia will allow them to sell this stuff without reviewing it - and the reverse is true as well - Russian state actors will surely use this 'review' as an opportunity to embellish their own hacking tactics etc..

I don't see any real way around this in the world in which we live.

Russians are going to have to make their own anti-virus. Which I would imagine they are capable of doing.

Well, Kaspersky Lab is a russian company.

Interesting enough, the CEO of Kaspersky already offers the source code for review in the US: https://www.engadget.com/2017/07/02/kaspersky-lab-offers-sou...

Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure. With the option for source code review, I'm still with a good impression on their tools when compared to Symantec and no option for review.

> Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure.

That is a terrible idea, as anyone who knows anything about Russia would tell you.

Ya.

Using American software, you might be getting NSA's eyes on you.

Using Russian software, you'll probably have FSB's eyes on you.

So take your pick :)

Even in that sense, choosing is quite simple, since for all kinds of gov't usage (e.g. in military as a NATO country) NSA is an ally of Germany but FSB is actively hostile to it.

Would you rather be East Germany or West Germany?

Germany shares closer and deeper ties with both countries than most would imagine in modern days.

Propaganda aside and looking at facts, one company is providing access to review their source code and the other one is not.

Which one of them is a terrible idea to purchase?

Would you expect an adversary to actually tell you the holes they find? If they don't, what do you gain from sharing source code with them?

You gain the chance to sell the product to the adversary that also is your customer.

You gain the tacit approval of the product from an adversarial government customer, which signals other enterprises in the country they should feel comfortable buying the product.

You lose the chance to sell to everyone else that considers the adversary a threat, because you have made it easier for the adversary to attack or evade your product than those of your competitors.

Not seeing the problem doesent prevent it from beeing there. Security by obscurity has a track record of not working.

Of course it doesn't work. But handing your source code to your attacker works even less well than that.

Yes. Handing out code to everyone (open source) can provide many benefits, but there's no benefit to handing it over only to agents you do not expect to cooperate (foreign governments, or governments in general).

Plus the chance for competitors to completely understand and replicate your brand new techniques for malware exposure.

Can understand the worry for malware products from startups and innovative companies that are demonstrating an impressive work and surely need that secrecy to thrive against the market gorillas. Symantec can't really be called innovative since 2009 or so, doesn't make much sense the security by obscurity mantra unless there are other reasons.

Reply on news.ycombinator.com