Hacker News Reader

Comment by anonymousDan | Hacker News Reader

It strikes me all this wailing about code quality is simply a cover story to allow UK public sector/companies to exclude Huawei without outright accusing them of being a spying/intellectual property risk.

View on HN

If Huawei is incompetent at managing OpenSSL in their codebase to the point that there are nearly 100 copies sprinkled through, most of which are vulnerable to exploitation, that seems like a perfectly reasonable basis to bar their products for a number of years, regardless their nationality or other actions.

F5 Networks should have been branded a black sheep for its various TLS implementation screw ups (they are the prime reason TLSv1 is considered insecure), yet they came out mostly unscathed. We need to stop giving a free pass to horrid development practices that create massively vulnerable software.

Frankly I agree. There's a lot of ridiculous hand-wringing in every thread about Huawei on HN, but unless what's reported here is factually wrong I'm not going to lose sleep over them facing consequences for a shoddy product.

>If Huawei is incompetent at managing OpenSSL in their codebase to the point that there are nearly 100 copies sprinkled through, most of which are vulnerable to exploitation, that seems like a perfectly reasonable basis to bar their products for a number of years, regardless their nationality or other actions.

Yes, and it also highlights that we need independent review of any code going into critical public infrastructure, no matter where it comes from.

> F5 Networks should have been branded a black sheep for its various TLS implementation screw ups (they are the prime reason TLSv1 is considered insecure), yet they came out mostly unscathed.

I'm failing to find more information (googling for ssl issues on ssl termination equipment doesn't work well,) though it sounds like it'd be a good read - if you have any more details to share, please...

Not really - some of the code coming out of their dev centres is pretty awful.

That said, most of the code coming out of telco vendors is complete crap, it is just endemic in the industry.

This is why I laugh when I see the CNCF talking about getting OpenNFV / MANO code into containers - they can barely deal with moving to VMs currently.

I don't disagree with you but ultimately is that a bad thing? My data and private actions are already being monitored by too many people, why introduce another potential spy in the form of the Chinese government?

Reply on news.ycombinator.com