Server buyers ask Lenovo for made-in-Mexico models instead of Chinese kit Some server-buyers are asking Lenovo to supply equipment made in Mexico rather than gear made in China. So says Nutanix senior veep and head of Asia-Pacific-and-Japan Matt Young, who in conversation with The Register today said he’s aware of buyers in India who’ve made the request. Security suspicions are one reason some …
"...that has seen some organisations divest made-in-China products "
You know I have been trying to do the same, on a personal basis and it's bloody hard.
Chinese sourced goods seem to be everywhere even with reputable sellers. For example, having been let down with some truly awful drill bits that were Chinese made I decided to go for a set of Bosch ones. I have use their Forstner bits in the past and they are excellent. I can't remember why I didn't get some when I needed some twist bits. However, the bits came and look good and work well. Then I saw a tiny label on the bottom of the box "Made in China". My perceptions of both the bits and Bosch have plummeted. I thought I was getting stuff made in Austria and now it turns out I might have been palmed off with the product of some back-street workshop.
Knowing Bosch's reputation I hope not, but getting stuff made In China is not what I want both for quality and political reasons.
I too am finding it almost impossible to buy products across the board that aren't made in China. Bosch are getting bad at this, and anything that involves moving, non-electronic parts seems doomed to fail sooner rather than later. And personally I'm getting fed up with seeing products stating Designed in [Not China], made in China.
I'm finding that it takes more research to avoid made in China but it can be done. Most of my new servers have motherboards, power supplies and drives that aren't made in China but the Ryzen CPUs are. My home solar system has some of the roof mounts that are made in China but the rest is made in Australia, Canada, Malaysia or Finland. The new floor I had installed was made in Germany. New kitchen tap was made in New Zealand but used Chinese made cartridges which failed and were replaced by Spanish ones. New tyres were made in the UK. I haven't bought an electronic device over $120 that was made in China in more than a year. China is involved in a trade war and I'm not going to play that game and I don't have to if I read labels.
To be honest, given that China killed twenty Indian soldiers a month or so ago while trying to move a disputed border in their favour it's hardly surprising that Indians are trying to avoid buying from China. Can you imagine what people would be saying or doing if a country killed twenty of our troops in a border skirmish?
If you are worried the devices are compromised, Security 101 would tell you that you should assume the alteration is deep enough that having the integration take place in Mexico isn't going to help. You should change vendors. Having said that, you should also insist none of the components were made in China including seemingly innocuous things like connectors. There's no reason to believe the Chinese are not the equals (or even superior) to the NSA in this area:
"The NSA has also developed a set of tiny surveillance electronics dubbed HOWLERMONKEY that hides within computer hardware, such as an ordinary Ethernet port, Appelbaum said. The one pictured above, dubbed FIREWALK, looks no different to a standard RJ45 socket, but can inject data into and slurp any bytes from packets coming through the physical connection automatically, and relay the information back to base via a radio link." from
https://www.theregister.com/2013/12/31/nsa_weapons_catalogue_promises_pwnage_at_the_speed_of_light/?page=2
Also see
https://www.theregister.com/2013/07/29/lenovo_accused_backdoors_intel_ban/
And for the truly worried, once you've received your hopefully "safe" kit, have multiple independent security outfits have a go at it looking for compromises since there are other governments out there that do this kind of stuff.
Perhaps, but I'd be skeptical about those two. Not all of the NSA hardware has to actually -work- in order to achieve the desired effect. In fact, I'd hazard to say that the ones that they leak to the press are probably the ones that never actually worked, e.g. the radio link is too unreliable - but they still serve as a useful deterrent against those who might otherwise try to hide stuff from the NSA.
But your point stands, and I'd expect that the Chinese secret service has a hell of a lot more resources than the poor old NSA. The Chinese are well known for inserting chips into your laptops as you enter the country (perhaps a simple keylogger, perhaps something else) and then removing them when you leave.
It's scary that they are departing from western-made technologies even faster than we are trying to boycott theirs. That just feels like a precursor to War, if I have ever felt one.
It may be meaningless from a security standpoint, but that's not what most of the importing companies actually care about (probably). That may be what the Indian government claims to care about, but the companies importing the kit almost certainly care more about the delays with kit sitting on in a customs warehouse when they need it than they do about the minimal security risks.
Security is likely just the buzzword they use to pressure the vendor to bring in kit from a country that's not likely to get it held up in customs.
Legend said they had a factory in Israel. Neighbouring sandy lands would not touch the kit with “made in Israel” for... reasons.
Sales improved when their Israeli factory streamlined their build process to add a reel of labels at the end of the product line, one saying made in Israel for the rest of the world, and made in England for Sandy lands.
Yeah of course our kit was made by a Chinese company in Mexico. Look, it even says hecho en Mexico on the box! Trust us!
Ac because some sandy lands don’t have a sense of humour...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
