[AnthonyMouse]

> As such if the default stance is not to trust or do business with Chinese-related parties this will exclude the entire country eventually, since they aren't given any realistic alternatives to being completely blacklisted they'll likely retaliate (understandably).

If a company is making ball bearings or bathroom fixtures, you don't have to worry much about their ties as long as they're not your sole supplier. How do you backdoor a manual mechanical valve?

Whereas for anything that has computer code in it, open source down to the microcode or GTFO. Countries will (and should) want to stick to suppliers in the local and allied countries if a foreign one isn't willing to provide that, and have no objections if a country they're doing that to wants to do the same to them.

[paganel]

> If a company is making ball bearings

I know it was an anecdotal example, but a Western company purchasing Chinese-produced ball bearings will most probably mean that Western company doing business with and empowering the Chinese military-industrial complex, seeing how ball bearings are such an integral part of military armoured materiel.

Which goes to show that splitting economic things up into civilian vs. non-civilian is an exercise in futility at the end of it all, and this goes for the West, too.

[AnthonyMouse]

> a Western company purchasing Chinese-produced ball bearings will most probably mean that Western company doing business with and empowering the Chinese military-industrial complex, seeing how ball bearings are such an integral part of military armoured materiel.

It's not about that. You could say that about doing business with them on anything whatsoever. If you buy their plastic toys they could use the profits to build tanks.

The problem here is that they're giving you a device you're putting in a sensitive place containing opaque binary computer code that could be doing anything, which customers can't feasibly replace with their own or audit because they don't have the source code.

[chrischen]

Open source does nothing if you can't verify the shipped code is actually running that. Plus after the whole Supermicro controversy we'd have to check what appear to be ball bearings for embedded spying circuitry.