Technology

34780 readers

242 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.

Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.

Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago

MODERATORS

MinutePhrase@lemmy.ml

-1

Apache Log4j bug: China’s industry ministry pulls support from Alibaba Cloud for not reporting flaw to government first | South China Morning Post (www.scmp.com)

submitted 2 years ago by miguel@lemmy.ml to c/technology@lemmy.ml

2 comments fedilink hide all child comments

all 4 comments

sorted by: hot top controversial new old

[–] Kusimulkku@lemm.ee 2 points 10 months ago

Notifying vendors first about security flaws is a cybersecurity industry norm, but a new law encourages Chinese companies to first notify the government

That's a bit... worrying

[+] TheAnonymouseJoker@lemmy.ml -5 points 2 years ago* (last edited 4 months ago) (1 children)

[removed by mod]

[–] miguel@lemmy.ml 0 points 2 years ago (1 children)

It is a double-edged sword: Where is the Apache Foundation registered and operating? In the United States. The company that found the exploit, Alibaba, is Chinese. Even the department that found it (security team) is located in the offices of Alibaba Cloud, in Singapore. In short, the Chinese government was very close to having a tool to seriously damage the Western technology infrastructure, without the other side ever knowing where exactly they were being hit from. And if it had been the other way around? if that information had reached the Singaporean authorities earlier? we must not forget that it is a very servile government to the United States. Or in the worst case scenario the report was intercepted at the Apache Foundation, remember PRISM? one of their goals is to find potential vulnerabilities and exploit them against "hostile forces" even forcing companies registered on US soil and several beyond their borders to leave "backdoors" in their products/systems without public knowledge.

Fortunately or unfortunately it was reported and announced publicly, without prior knowledge of the respective governments, so neither side gained a considerable advantage in this new field of warfare that is the cyberspace.