Slashdot Mirror
China Renews Calls For Tighter Cyberspace Security (reuters.com)
China's top cybersecurity body reaffirmed its commitment to heightened cybersecurity surveillance on Tuesday, calling for increased scrutiny of local and foreign technology used in industries deemed critical to the national interest. From a report on Reuters: A strategy document, released by the Cybersecurity Administration of China (CAC), laid out the framework for a controversial cybersecurity law released in November, which foreign business groups say could bar overseas firms from competing in the market. The CAC has previously countered these claims, saying the measures are not designed to target foreign enterprises, but to counter rising threats of terrorism and cyber-theft. The paper said key Chinese industries must "carry out a security review" of technology to prevent providers and other groups from "implementing unfair competition" and "harming the interests" of users.
Headline says security. Article says surveillance. Please fix.
China has better cybersecurity than the rest of the internet by sheer virtue of being able to shut off attacks at the interconnection points. That they now are concerned about internal security reveals that once behind the firewall things must be wide open. (Which shouldn't be surprising if one considers how prevalent OS piracy is over there -- and they're mostly still using unpatched, laughingly easy to exploit Windows XP.)
Build a firewall and make the Chinese pay for it!
While on the topic of cyber security, has anyone or any organization performed a full, independent security audit of systemd?
As anyone using pretty much any modern Linux distro knows, systemd is very likely present, and it has a huge surface area. It isn't just an init system, like it is often portrayed as. It is much more than that. It now also includes login and network related functionality, for example.
Much of systemd's code is new, and therefore not as proven as mature code. Much of it is written in C, a language that has historically been challenging to write truly secure software in.
All of these factors should cause concern for any person or organization that takes security seriously.
I would feel much more comfortable using Linux these days if systemd had undergone the sort of thorough, no-holds-barred review that, say, the OpenBSD code goes through. While an audit can't give new code the proven maturity of OpenBSD's code, it may at least detect serious flaws before they can be exploited.
Has anyone performed a proper audit of all of systemd's code?
despite it can legalize industrial espionage, even when they get owned by good old fashioned bribing of insiders. nothing new here, SOP.
You must be new here...
The last two headlines by msmash are too tight for me to read, and are only getting tighter!
As a group of thousands of elderly white men who rule you, we must perpetuate the mystic aura of this newfangled wave of the future "internets" tech nology by prefixing everything with CYBER.
Does this mean that the Chinese security related regulation is concerned with functional markets as well? Or is this a piece of the general telecommunication regulation coming from an organization with a confusing name?
" A strategy document, released by the Cybersecurity Administration of China (CAC), laid out the framework for a controversial cybersecurity law released in November, which foreign business groups say could bar overseas firms from competing in the market. "
It's really very simple.
If they outright bar foreign business ( or demand companies comply with unreasonable restrictions ) from their markets due to " security concerns ", then it's rather simple to deny them entry and / or access to non-Chinese markets as well. Let's see how well the Chinese Economy does when they can't sell anything overseas due to " security concerns ".
In GOVERNMENT, cybersecurity means security from the potential of citizens using the internet to commit thoughtcrime. Only constant vigilance will prevent this.
Nobody wants to pay for it. In that respect it's a lot like national defense. People admit the value of it in principle and want to be protected when they need it, but by and large they dislike paying for it. I think that I can count on one hand the number of times that management has allowed me to spend more time tightening down the security of a piece of software. When software is secure nobody notices. It's hard to sell a "feature" that's invisible to the end user. The quality may be great and the security high, but the customer doesn't know or care. We know that because the customers refuse to pay extra for software that is secure which suggests that despite their statements to the contrary, they don't value it much. Again, people say they want it but change their minds when handed the bill.