Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#1

Post by gcmac » Fri, Dec 24, 2021, 7:15 AM UTC

Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay
twitter.com

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#2

Post by SOMA_BOFH » Fri, Dec 24, 2021, 9:06 AM UTC

I wonder if this was due to engineers releasing it on their own or if management had their back.

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#3

Post by ranguna » Fri, Dec 24, 2021, 9:19 AM UTC

To save you a click: https://www.scmp.com/tech/big-tech/article/3160670/apache-lo...

The HN link links to a twitter post that links to the above link.

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#4

Post by gregw2 » Fri, Dec 24, 2021, 9:25 AM UTC

I read recently Chinese law required them to disclose the bug to the government within two days of disclosing it to vendor and that's why Alibaba was punished.

Now I read they have to give it to the government first.

Big difference. Which is the truth and how do we know?

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#5

Post by yorwba » Fri, Dec 24, 2021, 9:26 AM UTC

gregw2 wrote: post #4

I read recently Chinese law required them to disclose the bug to the government within two days of disclosing it to vendor and that's why Alibaba was punished. Now I read they have to give it to the government first. Big difference. Which is the truth and how do we know?

All of this was already discussed yesterday: https://news.ycombinator.com/item?id=29658977

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#6

Post by oefrha » Fri, Dec 24, 2021, 9:26 AM UTC

A misleading and inflammatory dupe of https://news.ycombinator.com/item?id=29658342.

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#7

Post by kevcampb » Fri, Dec 24, 2021, 9:30 AM UTC

Submitted previously as https://news.ycombinator.com/item?id=29646949 but didn't get traction. Clearly it needed a punchier title.

There's no suggestion that China gets any first say on 0-days. The law in question re reporting is at http://www.gov.cn/gongbao/content/2021/content_5641351.htm and states that you must immediately notify vendors of security flaws, and then the MIIT within 2 days.

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#8

Post by gregw2 » Fri, Dec 24, 2021, 9:33 AM UTC

yorwba wrote: post #5

gregw2 wrote: post #4

I read recently Chinese law required them to disclose the bug to the government within two days of disclosing it to vendor and that's why Alibaba was punished. Now I read they have to give it to the government first. Big difference. Which is the truth and how do we know?

All of this was already discussed yesterday: https://news.ycombinator.com/item?id=29658977

Thanks

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#9

Post by thanatos519 » Fri, Dec 24, 2021, 9:39 AM UTC

Hey, at least they didn't hurt the feelings of the Chinese people!

Putting Alibaba in the corner for 6 months is an incredibly petty response, but no surprise at all.

Re: Alibaba researchers went rogue and disclosed Log4j now CCP is making Alibaba pay

#10

Post by hankchinaski » Fri, Dec 24, 2021, 10:01 AM UTC

oefrha wrote: post #6

A misleading and inflammatory dupe of https://news.ycombinator.com/item?id=29658342 .

> Notifying vendors first about security flaws is a cybersecurity industry norm, but a new law encourages Chinese companies to first notify the government

There is nothing misleading or inflammatory