Slashdot Mirror
Report Says China Will Demand Source Code
An anonymous reader alerts us to a two-week-old story that hasn't gotten much traction in the press to date. A Japanese newspaper and the AP report that China plans to demand source code from hardware manufacturers, and ban the sale of products from companies that don't comply. China is calling this an "obligatory accreditation system for IT security products." The plan is to go into effect next May, according to sources. "Products expected to be subject to the system are those equipped with secret coding, such as [a] contactless smart card system developed by Sony Corp., digital copiers, and computer servers. The Chinese government said it needs the source code to prevent computer viruses taking advantage of software vulnerabilities and to shut out hackers. However, this explanation is unlikely to satisfy concerns that disclosed information might be handed from the Chinese government to Chinese companies. There also are fears that Chinese intelligence services could exploit such confidential information by making it easier to break codes used in... digital devices."
Haha,
Yes, why would chinese business go to the effort of replicating the functionality of western devices when their government can just demand we give the source code to the devices.
Expect to see more Sorny goods if this goes ahead!
Just use open source. ;-)
My guess is that this is to check the hardware for backdoors. Probably figures that they have put out so many backdoors in products like Cisco, Dell, Acer, HP, Apple, etc and now wants to check to make sure that nobody is doing the same to them.
that disclosed information might be handed from the Chinese government to Chinese companies
It might. And then they have a massive re-engineering problem on their hands. It would usually be easier for them to reimplement the functionality than try to start with undocumented, unsupported source code.
Doing security audits on software is a legitimate request by a governmental agency. Of course, they should just request that vendors provide open source software.
Do companies think that the market in China is big enough to justify giving them the source code?
It doesn't really matter what foreign governments think of this. The can scream all they want. If a company thinks the Chinese market is big enough and they want a piece of it. Then they will cough up the code.
Privacy, security and IP rites are second tier considerations when it comes to product sales.
So again. Do companies think that the market in China is big enough to justify giving them the source code?
Don't do business with them if you don't like it. The Chinese concerns are valid, the hyperbole response is lame.
If someone thinks China is a big enough market, the Chinese-market goods can simply ship with their own damn set of code, API's, and even unique board revision if a company worries about it that much.
China is out of control. How can anyone compete if they have cheaper labor and can demand everyone hand over technologies. They can pirate the hardware but reverse engineering the rest is harder. What's next them demanding chip manufacturers hand over chip templates to "make sure they meet China's standards".
I thought source should be free?
I know American are scared, losing world leader status, economy going down the drain, hockey mom for vp and everything but seriously it's a great move on the Chinese government that you should be applauding. You should be hoping it will be replicated by ALL other governments and that distributing the source becomes an habit for HW manufacturer.
China has its issue (police state, freedom of the press...), but they seem sometime to have the balls to go where no other lobbyist sponsored government in the "free world" would go and when it's a good move at least have the intellectual honesty to recognize it.
I used to work in a CE firm that manufactured in China and sold across the world - reverse engineering was a particular problem and IP protection was the talk of the day.
And now they demand source code? Well I can assure you that it will *not* happen.
I hear Hungary and eastern Europe are offering particularly cheap factory sites - and this might persuade some firms to relocate.
Honestly you cannot make this stuff up. I suspect they will allow manufacturing in china of export goods with no access to source code (to protect their national growth and wealth), but only "approved" population control devices will be allowed to be sold inside China (to spy on their own citizens) - it's control freakery gone mad. This would allow them the best of both worlds, after all its no secret that China has various special economic zones (and they are huge) to allow export factorys to undercut everywhere else in the world - so they just make export rules different.
We really are a joke to them, I remember the hilarious conversations we used to have about IP in Shenzhen with the local engineers, they have no concept of it at all. Its all fair game if they can work out how we did it. Of course, that never stopped them abusing our own system by buying as many patents as they could and hitting us over the head with them on one side, whilst copying everything we did on the other. And now they will try and demand the source code as well? No matter what safeguards they pretend to employ corruption is a business tactic out there and the information will be just another market to exploit. I remember sitting at a conference table with out local contact (who we found out was also employed by the client) taking both sides of the argument as well as two pay checks, literally forwarding out confidential information to competitors because they paid him to do so. NDAs, contracts and so are meaningless.
Yes I am rather bitter and annoyed about it years later, and I accept that they are probably not all like that and things *might* of improved.
What makes you think the source code will be publically available outside the government (and perhaps select "partners" who will help them "understand" the source code?)
If you live in a world where you believe everyone has the same motives, well then I hope when you get burned by that view it is in a way that doesn't hurt you too much. People are perfectly justified in calling in to question the motives of various entities. For example if your family doctor tells you to remove your clothes because he needs to perform a complete medical check, I think it is reasonable to trust him. His motives are most likely pure. However if a random guy in an alley with unkempt hair and a crazy expression asks you to do the same thing, I'd say you should probably question his motives, lest you end up getting hurt.
You are also mistaken that various governments haven't seen the source to commercial products. Microsoft, would be an example. The Windows source code isn't secret. It isn't public, but it isn't secret. Many organizations, including universities, have it.
The reason people find China's proposition scary is because of their track record. For example if you search around on the web you'll find that counterfeit Cisco gear form China is fairly common (often called 'Chisco'). It looks similar to real Cisco gear, but it of inferior production quality, and is of course unsupported. China has a very poor track record with regards to ownership laws and thus it is reasonable to call their motives in to question.
There's also a big difference between believing in open source, and believing in ripping people off. Let's not pretend that it doesn't take a lot of work to write good code. If you want people to be able to do that work as a job, they need to get paid. However if what you support is for company A to spend lots of money writing it, and then company B to just rip it off and give nothing back, well you'll find that doesn't work. Open source works only when everyone contributes. If you have a bunch of people/companies that spend a lot of time and money to make something, only to have it ripped off, well they can't afford to keep doing it.
So the problem isn't with a government wanting to see source code. I think you'll find that the US government verifies the code for anything used in critical systems. The problem is that the Chinese government does not have a good track record on this kind of thing. Thus I (and others) question their motives. I don't believe it is really about openness. I do not question RMS's motives. I believe he really just wanted openness.
They are doing by legal fiat what the open source community has failed to do through voluntary cooperation, namely, boycotting products that don't provide their source code. Ironically, this autocratic move could be a boon to open source.
Wha wha whaat? The open source community says:
... that looks almost exactly like the one from Germany, bases on the very same technology. That's your altruistic Open Source project right there.
"Hey we're writing tools, everyone should be able to participate so we release the code for free"
Companies say: "We build specialized applications and machines that would ruin us if everybody knew how we do it, under no circumstances will we give away the implementation of X that we've spent millions of R&D on."
So you say the second one will be happy to give it's source code to the Chinese? You must be bleeding from both eyes right now.
The reason why China does this is clear: Cheap technology, you cut out the research and development costs and go straight to production. That's what they mainly do anyway, all the stuff we send there to have produced cheaply now backfires. You got the manpower and the facilities all you need is something to build. They did the same thing with the Maglev train from Germany. They send engineers to work with the ICE speed train team, the team went to China to do material research and quality checks etc. and once the Chinese had enough the contact was interrupted and a couple of months later they introduced their own Maglev train
*shakes head*
Bunch of idiots. Boycott chinese products and don't export anything to China.
Uhhhm, good luck shopping for clothes then. Or furniture, or kitchen appliances, or electronics.
A hacker worth his salt should be able to exploit any kind of technology. All the rest of us demand is openness on the part of technology makers that are already protected by patents. Typically the path of least resistance is the easiest to exploit. China, as an outsider in to the rest of the world, is suspicious of the rest of the world so why shouldn't they demand transparency. As a positive side effect it benefits the rest of us and the FOSS movement.
The chinese government opens it's borders to foreign companies if they are willing to share the blueprints of key components of that industry. They have demanded construction blueprints, machinery schematics, manufacture process information and even end product components. They, meanwhile, have used that information to develop their tech grasp and have incorporated those designs on native industrial enterprises. That's the secret behind China's ultra-fast development and the main reason behind the plague of chinese knock-off products.
This is nothing different. It's simply another step in the ladder. They developed (stole is more appropriate word) enough to have gained the capability to produce advanced electronic components like processors and now they are refining that knowledge and taking the next step. Get ready for a capable dragon chip.
It is only a matter of time (probably not even 5 years) before China becomes not only self-sufficient but also competing for the lead in the world's high tech industry, all thanks to capitalism and the good folks who brought you the globalization and outsourcing experience. Were all those cheap goods worth the loss of western values like democracy and freedom of expression?
Wow, just like the west is very serious in cracking down on copyright infringement. An outsider would see the US govt's complete lack of dealing with mass scale copyright infringement as collusion. Leaving it to the copyright holders when theres such widespread infringement? I would say they aren't even pretending to be interested.
I'm in China right now. The majority of the "fakes" are misapplied trademarks. They work nothing like the real item, and often look nothing like a real item from the Brand.
You'd have to be a complete moron to be suckered in.
The other end of the scale is when the factory owner lets the Gruntmaster production line run for an extra hour or so and slaps "Oinkmaster" on the side. I've picked up a few "grey-market" items this way - identical to the branded product.
3laws: No freebies, no backsies, GTFO.
Now that's finally someone who gets it. Apparently, Chinese want to take security seriously and finally say out loud that having black boxes managing your network is not the way it should be done.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
Firms will move to supply the increased demand for those things once the source is cut off. We have unemployment issues over here anyway.
Help me real quick, how can you keep building a TV that is sold for 600 bucks including margin when your employees cost dozens of times more than what you are currently paying? Don't you think that before someone says "Great I'll just sell my stuff for ten times the price, people will know it's the right thing" someone else simply co-operates with the Chinese or other country to get cheap-labor done? This has no impact whatsoever on your local employment market. Well, unless you live in India, Pakistan or the Ukraine.
It's not like we don't know how to make that stuff. We just built the factories elsewhere.
Uhm yeah? Because the companies didn't want to pay for all that health insurance stuff. In my country, companies threaten the government to move production out of the country and the laws are made accordingly. Tax cuts on revenue tax and corporate taxes are forced on us that way. It's not like we don't know how to make that stuff ... it's just too fucking expensive to make the kind of profits that we're used to and have promised to the investors.
Sounds like the world is richer by a few trains then...
Why is that so bad?
He said, boy, never trust anything without the source. I think he was ahead of his time. He was chinese, before the communism came, in the long, long time before.
You know...we did just that...just a few decades ago. There weren't that many imports in the 70's and even into the early 80's. Not like there is today.
We did it fine 20-30+ years ago with mostly US made products, we just need to move back to it. I for one would pay more $$ for completely US produced and made products. I think it would make for a great marketing campaign...especially with all the toxic products coming out of China (toys, milk...etc).
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
geekmux said: "I sure as hell don't see people boycotting Coca Cola products because they haven't revealed their secret formula to EVERYONE"..
I haven't seen one instance of someone cracking Coke's secret formula and using it to break into a system -- nor have I once seen a buffer overflow or backdoor or just stupid program error in Coke's formula cause billion dollar threats to the internet.
It's real different -- code that goes into computers doesn't go through testing like food or drug products -- as corrupt as drug testing is, it's orders of magnitude more testing than every line of code in a product goes through before being released in a closed source product.
If food and drugs were sold like code, they'd cause fatal lingering diseases that required you to buy a lifetime supply of "patch" drugs from the manufacturer...