4 ms·

I think it makes sense to require that any automated firmware updates be signed by the device manufacturer and this this key is never released. This is to prote

I think it makes sense to require that any automated firmware updates be signed by the device manufacturer and this this key is never released. This is to protect consumers from malicious third parties who may attempt to install malicious firmware. Then there can either be an option to disable this check or a large warning that is produced when you try to install unsigned code. There's really no point in code signing if everyone has access to the private keys.

AnthonyMouse 11y ago
> Then there can either be an option to disable this check or a large warning that is produced when you try to install unsigned code. If the device allows unsigned or self-signed code to be installed then there would be no need to release the signing keys because they are not necessary to make modifications. Releasing signing keys should only be required when it doesn't.
- michaelmior 11y ago
  Exactly my point.
marssaxman 11y ago
I think it makes more sense to simply forbid automated firmware updates. Put a physical switch on the box; I'll press it when I want to update the firmware. No crypto signature needed.
- michaelmior 11y ago
  What about non-technical users who require firmware updates for bug fixes or new features? You can have a physical button, but if the network has been owned in some way, pressing the button could still lead to malicious firmware being installed. I could see this easily coupled with some social engineering. Control the network and then email users saying that an important update is needed.
  - marssaxman 11y ago
    Sure, it's no panacea, but it would at least be an improvement over the mess we have now.
    - michaelmior 11y ago
      How? For the average user (which are who companies really care about), code signing offers an important level of protection. Sure this would be an improvement for technical users who want something hackable, but that's a small fraction of the market.
      - marssaxman 11y ago
        Code signing is a fix for problems introduced by automatic firmware updates. Intead of going further down the chain by trying to fix the problems with code signing, I'd rather take a step back and find a better fix for the original problem. Besides, I don't believe that firmware updates need to happen so frequently that there needs to be a convenient way to install them. It's okay if they are a nuisance, because a majority of devices will be updated zero times in their usable lifetimes, and a majority of the rest will be updated one time.
        michaelmior 11y ago
        It's not about convenience, it's about security. Regardless of how many menus you have to go through or buttons you have to press if your device will just execute any code that it gets with no way to authenticate the code, you're asking for trouble. At the very least, the device should use a secured connection to download updates from the manufacturer.
        marssaxman 11y ago
        How about the device does nothing, and I can download updates from the manufacturer if I choose to? It's my device, not theirs, and I will decide when and if I want to update it.

AnthonyMouse 11y ago

> Then there can either be an option to disable this check or a large warning that is produced when you try to install unsigned code. If the device allows unsigned or self-signed code to be installed then there would be no need to release the signing keys because they are not necessary to make modifications. Releasing signing keys should only be required when it doesn't.

michaelmior 11y ago
Exactly my point.

marssaxman 11y ago

I think it makes more sense to simply forbid automated firmware updates. Put a physical switch on the box; I'll press it when I want to update the firmware. No crypto signature needed.

michaelmior 11y ago
What about non-technical users who require firmware updates for bug fixes or new features? You can have a physical button, but if the network has been owned in some way, pressing the button could still lead to malicious firmware being installed. I could see this easily coupled with some social engineering. Control the network and then email users saying that an important update is needed.
- marssaxman 11y ago
  Sure, it's no panacea, but it would at least be an improvement over the mess we have now.
  - michaelmior 11y ago
    How? For the average user (which are who companies really care about), code signing offers an important level of protection. Sure this would be an improvement for technical users who want something hackable, but that's a small fraction of the market.
    - marssaxman 11y ago
      Code signing is a fix for problems introduced by automatic firmware updates. Intead of going further down the chain by trying to fix the problems with code signing, I'd rather take a step back and find a better fix for the original problem. Besides, I don't believe that firmware updates need to happen so frequently that there needs to be a convenient way to install them. It's okay if they are a nuisance, because a majority of devices will be updated zero times in their usable lifetimes, and a majority of the rest will be updated one time.
      - michaelmior 11y ago
        It's not about convenience, it's about security. Regardless of how many menus you have to go through or buttons you have to press if your device will just execute any code that it gets with no way to authenticate the code, you're asking for trouble. At the very least, the device should use a secured connection to download updates from the manufacturer.
        marssaxman 11y ago
        How about the device does nothing, and I can download updates from the manufacturer if I choose to? It's my device, not theirs, and I will decide when and if I want to update it.