Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Symantec CEO says source code reviews by foreign states pose unacceptable risk

reuters.com

Post reply on HN
Print view View original

111–120 of 124 posts

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#111

Post by PeterisP »

alexasmyths wrote: post #72
Nimitz14 wrote: post #65

Earlier quoted context omitted.

> Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure. That is a terrible idea, as anyone who knows anything about Russia would tell you.

Ya. Using American software, you might be getting NSA's eyes on you. Using Russian software, you'll probably have FSB's eyes on you. So take your pick :)

Even in that sense, choosing is quite simple, since for all kinds of gov't usage (e.g. in military as a NATO country) NSA is an ally of Germany but FSB is actively hostile to it.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#112

Post by megous »

pgeorgi wrote: post #23
nwatson wrote: post #21

Earlier quoted context omitted.

The Symantec CEO has been in that position only since Symantec acquired Blue Coat last year, where they were CEO previously. The Symantec CA happened well before their current term.

Blue Coat. Has problems with foreign governments being unfriendly? I guess what goes around comes around: http://surveillance.rsf.org/en/blue-coat-2/

In case of Syria, this must have been used to help the regime identify people to be disappeared, for sure.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#114

Post by detaro »

JumpCrisscross wrote: post #92
detaro wrote: post #89

Earlier quoted context omitted.

I wonder how many commercial code bases/products can do that. Certainly an interesting proposal for verification purposes like this, but e.g. the recent Debian efforts show that it is not trivial.

> the recent Debian efforts show that it is not trivial Is there a link on this you recommend?

https://reproducible-builds.org/docs/ (it's linked from the Debian site already posted by leni536, but wanted to explicitly point it out since it explains the issues and solutions very well)

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#115

Post by rdtsc »

pmiller2 wrote: post #85
matart wrote: post #61

Earlier quoted context omitted.

Insurance company made us all install anti virus software

They didn't make you do anything. They either refused to insure you or would raise your rate if you didn't.

No they didn't hold a gun to their heads, pretty sure. I think it's pretty clear they made it a condition of not dropping them or not raising their premiums.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#116

Post by paulddraper »

rdtsc wrote: post #115
pmiller2 wrote: post #85

Earlier quoted context omitted.

They didn't make you do anything. They either refused to insure you or would raise your rate if you didn't.

No they didn't hold a gun to their heads, pretty sure. I think it's pretty clear they made it a condition of not dropping them or not raising their premiums.

Eh. Holding a gun to your head doesn't _make_ you do anything.

You either do what they want or die. Your choice.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#117

Post by ksk »

colordrops wrote: post #88
mrighele wrote: post #68

Earlier quoted context omitted.

I don't think the parent is talking about vulnerabilities, but the fact that if you know how the antivirus engine works it may be easier to write a virus able to avoid detection.

Sounds like a vulnerability. Isn't that how the argument went about source code? "If you know how the program works it may be easier to write an exploit." But then experience taught people that exposing source code to the bright sunlight by opening its source could actually make software more secure through many eyes finding holes. Why is this not applicable to virus detection algorithms?

>If you know how the program works it may be easier to write an exploit."

BTW, this is true. Seeing the source code versus having to go through assembly listings - I know which one I'd pick if I had to find logic bugs.

>Why is this not applicable to virus detection algorithms?

Its not an algorithm, but a heuristic. If you want to look for a suspect, you don't announce "I'm looking for someone 5 feet 5 inches tall with a buzz cut who drives a ford and wears size 12 nike sneakers". In much the same way, security via heuristics doesn't mean creating a perfect detection system, because it doesn't exist. They want to make the game harder to play by hiding the rules of the game, not because they're sure that they're going to win. This is a real, tangible benefit for the customers. There is nothing really special about it, we've been using such ideas for centuries.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#118

Post by raesene9 »

PeterisP wrote: post #109
raesene9 wrote: post #46

Earlier quoted context omitted.

Usually companies allow source code review beccause they're trying to sell their solutions in the countries in question. Look at it from the perspective of those countries Symantec "hey buy all our security software it's super-great" Foreign Gov. Customer: "sure can we check the source code first to see if there are any heinous security bugs or NSA backdoors" Symantec "Oh gee no, allowing to you see the source code o…

They're completely okay with that response. What they're worried about is that customers in U.S. government would consider their product more secure if they can ensure that the potential attackers in e.g. Russian government don't have access to that source code. You can't please all customers if customer wants you to protect them from another potential customer of yours, you have to pick a side and stick to it.

Well in this case it's not a big problem, as stated in the article Symantec didn't do much business in Russia.

However lets extrapolate and say what if the same thing were applied to Apple or Microsoft, who sell a very large amount of software to countries like China.

Should they forbid China access to their source code due to concerns from US customers.....

Would their shareholders be happy if they did? China is a large market, loss of access to that would be bad for a companies finacial health.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#119

Post by nunobrito »

Nimitz14 wrote: post #65
nunobrito wrote: post #47

Earlier quoted context omitted.

Interesting enough, the CEO of Kaspersky already offers the source code for review in the US: https://www.engadget.com/2017/07/02/kaspersky-lab-offers-sou... Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure. With the option for source code review, I'm still with a good impression on their tools when compared to Symantec and no option for r…

> Can't speak for the US, here in Germany the Kaspersky tools are used on large companies responsible for critical infrastructure. That is a terrible idea, as anyone who knows anything about Russia would tell you.

Germany shares closer and deeper ties with both countries than most would imagine in modern days.

Propaganda aside and looking at facts, one company is providing access to review their source code and the other one is not.

Which one of them is a terrible idea to purchase?

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#120

Post by arkona »

jononor wrote: post #73
arkona wrote: post #63

Earlier quoted context omitted.

And how would you enforce that? What would prevent anyone with access to the code from building it and using it? I don't see any way except maybe stripping the code of significant parts

You could keep the virus fingerprint database outside the codebase. Customers would then pay for access (and updates) to the fingerprints. The fingerprints have to be some sorts of data, like regular expressions or other limited instruction set which can only parse the incoming file and not communicate with outside world. The company could automatically release fingerprints into the open after a time, say 6 months.

So... stripping the code of significant parts

This seems like a pretty good business model idea though!

Post reply on HN