In “Who’s Afraid of Huawei?” you point out the need for the telecoms industry to adopt transparency guidelines to head off risks from kill switches, spyware, and back doors covertly installed in their equipment.
One minimum necessary condition of such transparency is that all software and firmware in these devices must be open source, with customers permitted to install their own software images from published source code and development toolchains that can be audited by third parties.
While open-source software cannot completely head off the possibility of Trojan horses embedded deep in telecoms hardware, it at least reduces the management of aggregate security risks to a tractable problem. No lesser measure is or can be even remotely as effective, even in principle.
Telecoms customers should insist on open source – and, as any competent counter-espionage agency would do, should consider vendors’ insistence on information asymmetry to be indicative of an unacceptable security risk.
The same principle, of course, applies to Intel’s true random number generator.
They should have provided low level access to the pre-whitened data. Why do on chip whitening. It is a suspicious waste of silicon.
Soo what’s the common enterprise grade open-source firewall?
I can think of a few products for reverse proxy and other securiy services, but all the hardware-ish stuff like switches, routers and firewalls?
Speaking of generated random numbers, I thought todays Schlock Mercenary strip was a nice coincidence.
Salamandro: We have used shorewall et al on hand-build Linux machines to front large financial-services clusters which have gained the highest level of PCI-DSS and ISO-27001 compliance.
So anyone who says this is not possible without special proprietary equipment or pixie dust is a brandwhore, lazy or susceptible to FUD.
tough to convince them : when software is viewed as a strategic advantage, putting it open(i.e. easy to imitate) will be considered as a blunder by most deciders.
I’m currently working for a bank, in the marketing area. The software I make for them is far from perfect(I’m just a human being, after all), & would be drastically be improved by outsiders review. Yet, what I do is considered “strategic”(as they think other banks are not that advenced in terms of marketing methods), therefore, deciders will choose subpar secret code over open “perfect” code.
I agree that telecom software code should be open, but I fail to see how to convince the important people(in that specific case the big boss of Huawei) that he has to give up a strategic advantage.
>I agree that telecom software code should be open, but I fail to see how to convince the important people(in that specific case the big boss of Huawei) that he has to give up a strategic advantage.
That’s what market pressure is for. Customers have to start demanding it, and stop buying equipment from vendors who refuse.
@esr
How was the World Boardgaming Championship?
>How was the World Boardgaming Championship?
Wrapup here: https://plus.google.com/u/0/108967323530519754654/posts/M8y5iVGRBg1
To be clear – do you consider the HTC Desire style stuff where you have to root your Android to do certain things with it breaching the second, “permitted to install” clause? Because I am afraid it is not going away anytime near. In other words, how important in % is the first clause and the second one, how good or how bad are such limited-but-rootable Androids like HTC in your view?
>In other words, how important in % is the first clause and the second one, how good or how bad are such limited-but-rootable Androids like HTC in your view?
Ultimately both clauses are important, but we can’t let the perfect be the enemy of the good. A device that has open-source firmware but an installation lock is preferable to any device with totally closed-source firmware.
“That’s what market pressure is for. Customers have to start demanding it, and stop buying equipment from vendors who refuse.”
I see. Though there might be limits.
First, secrecy is a weapon, and despite bad publicity, firms using it might still survive, and even thrive, because of hidden advantages others have no clue about. Marketing is a dirty job, that often yields impressive results. And not, unfortunately, by being a good boy/girl.
Second, we speak here of China. Not the most free country in the world. Boycotting a firm can be dangerous for your health(and I don’t speak about diseases), leading a boycott can be dangerous for your life. Fighting from our free countries might have some impact, but unless it is extremely well coordinated, it cannot have any impact.
In other words, you have to convince a huge proportion of brainwashed masses of westerners to boycott someone offering them a service they are in love with, for an acceptable price. Good luck. I don’t say it’s impossible, I just say I don’t know how it can be possible.
@el slapper
>In other words, you have to convince a huge proportion of brainwashed masses of westerners to boycott someone offering them a service they are in love with, for an acceptable price.
It shouldn’t be a matter of ‘boycotting’. If I buy a coke instead of a pepsi, I’m not ‘boycotting’ pepsi. I’m just making a choice as a consumer about what product will give me the most benefit, based on my needs and preferences. What you have to do is make it obvious that open software provides benefits to the consumer that outweigh whatever perceived advantages they are getting from using hardware that runs a closed system. (NB: I mean systems that happen to be closed and that provide perceived benefits, not systems that provide benefits that are a direct result of being closed).
You don’t stand a chance of success if you start using language like ‘boycotting’, because by doing so you have already conceded that closed-source doesn’t really harm the consumer. Instead you have made it into a moral crusade. It has to be about self-interest.
>I agree that telecom software code should be open, but I fail to see how to convince the important people(in that specific case the big boss of Huawei) that he has to give up a strategic advantage.
You show them that it is not as much an advantage as open-ness; it has happened in other areas of software, and especially cryptography, eventually it will spread to the point it is normal in all.
>First, secrecy is a weapon, and despite bad publicity, firms using it might still survive, and even thrive, because of hidden advantages others have no clue about. Marketing is a dirty job, that often yields impressive results.
Only temporarily; if there is not enough substance to back up the marketing, eventually it fails. Note that I think many people, including Eric on Apple, are over-optimistic on how quickly it fails, but eventually reality always wins, no matter how good the marketing.
@el slapper:
Huawei is a manufacturer of telecoms equipment. Their customers are telecoms companies (think AT&T or Deutsche Telekomm), not the “brainwashed masses.” These companies — and their government regulators — actually have a vested interest in ensuring the security of their networks. If there is any possibility that Huawei is building secret backdoors for members of the PLA or other parts of the Chinese state to eavesdrop, they can’t afford it. They can’t even afford a perception that this is the case. They have all of the reason in the world to heed esr’s words of advice.
@Morgan Greywolf
I think it’s important to point all this out to senior management. If the price differences are in the millions it will be difficult to resist going with the lowest bid. Senior management will have to be on board.
Eric, I suspect you’re just changing the rules for the dirty tricks. Something embedded in the hardware might be much more difficult to detect.
>Eric, I suspect you’re just changing the rules for the dirty tricks. Something embedded in the hardware might be much more difficult to detect.
Yeah, so what else is new? There’s no such thing as impossible; security engineering is and has always been a matter of raising the would-be intruder’s minimum budget to craft an effective attack. Denying him the ability to hide in software is a large and necessary step, but cannot be considered a final one.
> Soo what’s the common enterprise grade open-source firewall?
pfSense
@esr:
>A device that has open-source firmware but an installation lock is preferable to any device with totally closed-source firmware.
I’d actually say that closed-source firmware that is freely replaceable is better than open-source firmware with an installation lock, since closed source firmware that is freely replaceable can be replaced with open-source firmware that is freely replaceable, but I’m not sure how many devices actually have closed-source firmware that is not installation locked (and closed source + an installation lock is the least preferable option). Furthermore, “freely replaceable” here also includes hardware documentation extensive enough that third-party firmware can be written.
>closed source firmware that is freely replaceable can be replaced with open-source firmware that is freely replaceable
True, but irrelevant to the point of the open letter. The avaibility of source code only increases our security assurance for the binary it compiles to, not some unrelated binary we might want to replace it with.
@Jon Brase:
OK, but how did it get to be “freely replaceable?” If the company is intent on hiding stuff, they probably hide info about the hardware. Many companies that use GPLed software such that they have to release source still hide info about the hardware.
So don’t overlook that one reason to insist on open source is that the source code can provide at least minimal documentation on otherwise undocumented hardware.
@Patrick:
That’s pretty much the reasoning behind everything from “but I’m not sure” on in my previous post.
@Jon Brase:
Missed the last sentence. Focused on the one before that, and thought “something can be replaceable, but undocumented” and hit reply.
A proposal for an open source project:
Pick one manufacturer, like Huawei. When they release an important new piece of equipment, the ‘many eyes’ of the OS devote themselves to reverse-engineering it, and publishing the results. Keep doing this until they change their policies. Then you go for the next manufacturer…
Somewhat off-topic: it is scary how much can be compromised if you are not security-conscious and use any form of cloud computing, Google, etc. Apple appears to be the worst offender.
I strongly encourage everyone to read the link below. I immediately went over to Google and turned on 2-step verification.
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/
@Cathy
The google authenticator app is fantastic. It’s open as well, so other providers can use it. Lastpass recently added the option to use it as a second factor and I immediately jumped on board. Previously I had been using their somewhat-annoying grid system.
One of the best things Google ever did in my view.