Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Symantec CEO says source code reviews by foreign states pose unacceptable risk

reuters.com

Post reply on HN
Print view View original

21–30 of 124 posts

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#21

Post by nwatson »

micaksica wrote: post #16
rdslw wrote: post #7

Yeah, sure. Thats the company which according to Google (March) has a huge mess in own nest of Certification Authority resulting in google chrome removing their certs: https://arstechnica.com/information-technology/2017/03/googl...

This. I would trust most non-security tech CEOs to give better security advice than the executives at Symantec.

The Symantec CEO has been in that position only since Symantec acquired Blue Coat last year, where they were CEO previously. The Symantec CA happened well before their current term.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#22

Post by macspoofing »

nobodyorother wrote: post #18

So they're basically admitting that their antivirus tools aren't secure enough to handle a basic code review? Yup, totally makes me want to buy copies. "No, guys, security by obscurity totally works in this one case! Because it's us! Come on, you trust us right?"

To play devil's advocate, they may not be worried about vulnerabilities in their code but rather vulnerabilities in their method of virus detection, the same way Google doesn't share details about their search algorithm partly so it isn't gamed by spammers. Actually this is common in software that is meant to protect against sophisticated attackers. Blizzard and Valve used to have periodic mass bans but they would never say what exact action triggered a ban. In fact you would get no information and the ban itself may have come months after some hack was used so that crackers wouldn't know what specifically triggered it.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#23

Post by pgeorgi »

nwatson wrote: post #21
micaksica wrote: post #16

Earlier quoted context omitted.

This. I would trust most non-security tech CEOs to give better security advice than the executives at Symantec.

The Symantec CEO has been in that position only since Symantec acquired Blue Coat last year, where they were CEO previously. The Symantec CA happened well before their current term.

Blue Coat. Has problems with foreign governments being unfriendly?

I guess what goes around comes around: http://surveillance.rsf.org/en/blue-coat-2/

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#24

Post by nwatson »

lightbyte wrote: post #12
AnimalMuppet wrote: post #4

They're not so arrogant about their code being bulletproof that they're willing to hand it to an adversary and say, "Sure, knock yourself out - see if you can find any holes"? Yeah, I'm not sure that I see a problem here.

Would you expect an adversary to actually tell you the holes they find? If they don't, what do you gain from sharing source code with them?

You gain the chance to sell the product to the adversary that also is your customer.

You gain the tacit approval of the product from an adversarial government customer, which signals other enterprises in the country they should feel comfortable buying the product.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#25

Post by arachnids »

nwatson wrote: post #24
lightbyte wrote: post #12

Earlier quoted context omitted.

Would you expect an adversary to actually tell you the holes they find? If they don't, what do you gain from sharing source code with them?

You gain the chance to sell the product to the adversary that also is your customer. You gain the tacit approval of the product from an adversarial government customer, which signals other enterprises in the country they should feel comfortable buying the product.

You lose the chance to sell to everyone else that considers the adversary a threat, because you have made it easier for the adversary to attack or evade your product than those of your competitors.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#26

Post by tr1ck5t3r »

macspoofing wrote: post #22
nobodyorother wrote: post #18

So they're basically admitting that their antivirus tools aren't secure enough to handle a basic code review? Yup, totally makes me want to buy copies. "No, guys, security by obscurity totally works in this one case! Because it's us! Come on, you trust us right?"

To play devil's advocate, they may not be worried about vulnerabilities in their code but rather vulnerabilities in their method of virus detection, the same way Google doesn't share details about their search algorithm partly so it isn't gamed by spammers. Actually this is common in software that is meant to protect against sophisticated attackers. Blizzard and Valve used to have periodic mass bans but they would ne…

For a simple test using time, write a program which lists all files and folders, and then md5 hash each file. See how long the processes takes to do all your files and then ask how can your AV scan all files faster unless its an inferior process. Lets face it, scanning each file loaded into memory looking for hundreds and thousands of virus signatures is a slower process than MD5 hashing so why the time difference, unless the AV process is fundamentally flawed?

No AV system can detect 100% of all viruses on a system, because the process is flawed. Dont take my word for it, take it from those who test different AV products on files infected with known viruses. https://www.shadowserver.org/wiki/pmwiki.php/AV/VirusDailySt...

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#27

Post by thg »

> “As a vendor here in the United States,” Clark said, “we are headquartered in a country where it is OK to say no.”

Until the government comes knocking and can demand pretty much everything with your only option being a secret court that always sides with the government anyway.

Is it too much tinfoil to think that this isn't so much about "putting security over sales" than it is about "making sure that NSA backdoor remains hidden"?

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#29

Post by radicaldreamer »

thg wrote: post #27

> “As a vendor here in the United States,” Clark said, “we are headquartered in a country where it is OK to say no.” Until the government comes knocking and can demand pretty much everything with your only option being a secret court that always sides with the government anyway. Is it too much tinfoil to think that this isn't so much about "putting security over sales" than it is about "making sure that NSA backdoor…

Just ask the former Qwest CEO about saying “no”.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#30

Post by louithethrid »

AnimalMuppet wrote: post #4

They're not so arrogant about their code being bulletproof that they're willing to hand it to an adversary and say, "Sure, knock yourself out - see if you can find any holes"? Yeah, I'm not sure that I see a problem here.

Not seeing the problem doesent prevent it from beeing there. Security by obscurity has a track record of not working.
Post reply on HN