Gitee a Chinese alternative to GitHub!

The use of software, platforms and services between the USA and China is becoming increasingly difficult. Reasons for these difficulties are among others political pressure but also guidelines and threatening actions. With Gitee, an alternative to the American GitHub is now being promoted by the Chinese Ministry of Industry and Information Technology.

Gitee and GitHub - The open source sources

Open source is a topic in IT security that is becoming increasingly popular. We also report a lot about open source projects, because they are very important for IT security.

By publishing their own source code, the manufacturer enables further development on this code base. Besides that, many IT security researchers can look at the code and find security holes. One of the last contributions we published regarding open source was about Troy Hunt, who runs one of the most popular IT security websites and now wants to go open source.

GitHub: the established portal

The portal on which most open source projects are located is called GitHub and belongs to Microsoft. According to Wikipedia, the portal had about 40 million members in August 2019. We as a company are also represented on GitHub and manage some of the projects we have made open source.

Gitee: the Chinese counterpart

Gitee offers basically similar features to GitHub, including an issue tracker that lets users report bugs in the source code and see who reported them. Two facts stand out:

• Gitee is funded by the Chinese Ministry of Industry and Information Technology.
• It currently contains about 10 million repositories.

Among those repositories is the code for HarmonyOS and OpenEuler. Both are components of the operating system that Huawei wants to develop as an Android alternative.

Conflict between the USA and China

The recent past has shown once again that it is not so easy for Chinese users to use all programs and services from the USA. One of the main reasons for this is the political pressure being exerted in China. We reported that the editor Notepad++ is no longer available in China, because this editor has worked for oppressed people in China and Hong Kong. In order for China to be able to do without American services even more, the country is promoting a GitHub alternative with Gitee.

Code hosting platforms are part of the software supply chain. Where dependencies and build pipelines live determines who can tamper with them - and under what legal or political conditions. The Gitee case shows how geopolitics reaches directly into developer tooling. Companies that rely on third-party code should know their full dependency chain. A penetration test that includes the build and dependency path makes visible where tampering would go unnoticed before it reaches production.