News for hackers. Stuff that matters.

A comment on ownCloud Infinite Scale: Go instead of PHP, microservices instead of LAMP. Parent comment

Re:ownCloud Infinite Scale: Go instead of PHP, microservices... by RL_Quine on Friday January 22, 2021 @05:52AM (#25870510)
In my experience I've not found software developed by engineers based in China to be developed with any particular care. It is very common to see trivial backdoors, massive amounts of data collection, and plaintext protocols. For situations where the developer is being security conscious, the language barrier often means that reports of concerns are either ignored or misinterpreted.

It is often the case that software developed outside of China, for devices produced in China is alright, but on the other hand many companies like Honeywell simply contract all of their software development there as well, and it painfully shows. I shouldn't be able to buy a product in 2020 that has a linux kernel from 2012 and multiple remote code execution vulnerabilities just from public CVEs, but the Honeywell Tuxido security system managed it with ease.

[ Parent | on HN ]
Re:ownCloud Infinite Scale: Go instead of PHP, microservices... by lilSebastian on Friday January 22, 2021 @06:35AM (#25870734)
I have experience of the similar software quality issues, however none of this is unique to China, north America, Europe, India, China. My question was specifically related to the hardware most people run, which is often fabd China, given most people take it for granted that this is "safe".
[ Parent | on HN ]
Re:ownCloud Infinite Scale: Go instead of PHP, microservices... by RL_Quine on Friday January 22, 2021 @07:43AM (#25871200)
The hardware is obviously suspect as well, but I can only speak for the number of actual backdoors I've been able to find in my own devices. Root shells on random sockets, "accidental" eval() in web UI elements, hardcoded passwords, actual processes just called `backdoor`. I especially liked being able to remove the IPMI password from a SuperMicro board I bought from eBay by making a HTTP request to a "buggy" endpoint that printed the root password back in plaintext.
[ Parent | on HN ]
Re:ownCloud Infinite Scale: Go instead of PHP, microservices... by kingosticks on Friday January 22, 2021 @08:35AM (#25871499)
Wouldn't the relevant part of most user's hardware far more likely be manufactured in Taiwan, USA, Singapore or South Korea?
[ Parent | on HN ]