4 ms·

Is there any part of the "Internet of Things" that is well thought out? The idea of our lives becoming surrounded by hojillions of things that are constantly co

Is there any part of the "Internet of Things" that is well thought out? The idea of our lives becoming surrounded by hojillions of things that are constantly connected to the internet running software written by whomever with no standards, no testing, no regulation or certification, that doesn't seem so great to me. Even the best software written by the most capable engineers who continue to be dedicated to the projects they support is still a horribly bug-ridden mess with occasional enormous security holes. Even if all IoT software was written by, say, a division of Google, it would still be a nightmare. But it will be far, far worse because IoT software will be, and is being, written by anyone and everyone. When you buy a networked device today, how can you tell what level of security it has? What level of testing it's been subjected to? Who has signed off on the design and the code? No such thing of course, it's all at the same level as the kids down the street building stuff out of their garage for kicks. And while there's some merit to that when it comes to innovation, for production, in the modern era, it's not just naive, it's either insane or idiotic. We need more rigor, more standards, and less vulnerability surface-area when it comes to internet-connected devices. IoT is precisely the opposite of that. It's already bad enough that there are millions of zombie PCs in botnets around the globe, we don't need zombie to add toasters, garage doors, light bulbs, and what-have-you to that mess. Anyone who thinks that we can get security and quality in the IoT for free without making a concerted effort is, again, either monstrously naive, insane, or idiotic. It's 2015, that naivete is no longer defensible.

simoncion 11y ago
> Even the best software written by the most capable engineers who continue to be dedicated to the projects they support is still a horribly bug-ridden mess... This is far from universally true. While I agree that the actual security of a system is currently nearly impossible for most purchasers to evaluate, and I agree that in far, far, far, too many cases proper system design and implementation appear to be the least important priority of commercial projects, there do exist well designed, secure, complex systems. > Is there any part of the "Internet of Things" that is well thought out? The part where we use this largely ubiquitous, globally accessible network to give folks the power to control and/or monitor the devices that they own from any place of their choosing? I 110% agree with you that -for an enormous slice of the consumer electronics market- security is -at best- an afterthought. However, just for a moment(!), assume that all IoT devices are secure and only exist to serve your interests, rather than the interests of a national intelligence agency or corporate overlord. In this hypothetical scenario (that's really far from what we have today) doesn't the statement in my previous paragraph highlight a thing that -at worst- provides no benefit to society and -at best- provides a large benefit?
- pjc50 11y ago
  If we had such a great pony as described in your final paragraph, then yes it would be great. But that's not what we're anywhere near getting at the moment. And it's always worth questioning what value the "things" are providing. Home automation has been around for decades and remains a niche. Even business computerisation (other than communications and ecommerce) seems to result in surprisingly marginal productivity improvements.
  - simoncion 11y ago
    > Even business computerisation (other than communications and ecommerce) seems to result in surprisingly marginal productivity improvements. You must be joking. :) The spreadsheet is an enormous force multiplier. Email -when used for useful communication- often substantially reduces the time to close a decision making loop. You can point to telephones as a replacement for email, but telephone switches -themselves- have been computerized for many, many, many decades. > If we had such a great pony as described in your final paragraph, then yes it would be great. But that's not what we're anywhere near getting at the moment. You appear to be talking as if I don't understand that the state of system security in the consumer electronics space is dire. I... kinda covered that in the comment to which you replied. There was no need to qualify your "Yes.". :) (And yes, I do notice that you're not my original conversation partner.)
    - pjc50 11y ago
      I was referring to the Solow productivity paradox: computerised technology certainly feels much more efficient, but in terms of the economic variable "productivity per person-hour" the difference is not as striking as expected. The qualified yes was really a no: I believe that the market structure can't and won't deliver open, secure, interoperable devices in the forseeable future (say 10 years).
      - JoeAltmaier 11y ago
        But, but, I'm on a desktop running an open, secure, interoperable device right now. Just migrate this software into a device, right? The capability of devices right now is comparable to desktop computers in the 90s. And way beyond what it took to put a man on the moon. So it'll fit, soon if not now.
marcosdumay 11y ago
Before anything else, we need our main networked devices to survive being placed on the same network as some malign device. The current situation is a joke, and much before one even thinks about IoT. Having a compromised device at home should mean at most that it's tracking you with its sensors. Not that it can compromise anything you have around, and get any data you have, or that it can use your network to get anybody else.
- simoncion 11y ago
  My personal laptop, my servers, and my Linux-running home networking equipment are fairly resistant to attack. ;) It's true that the consumer electronics security situation is a sad joke, but PCs have generally been becoming harder targets for quite some time now. > ...or that it can use your network to get anybody else. I assume that by this you mean "Can't use your Internet link to launch attacks against other networks."? If you do, then it is my somewhat-informed opinion that maintaining a default-deny policy for outbound communication on a home LAN is far too much trouble than it's worth. I suspect that -on most home LANs- you could probably get away with denying all outbound TCP other than to port 80 and 443, and allowing all outbound UDP. [0] However, if your attacker is somewhat determined and even a little bit clever, he will use the Universal Firewall Bypass Protocol [1] to talk to his C&C system(s) or other malicious devices or whatever. In this situation, you will have spent more than 0 minutes on managing your firewall rules and gained nothing from the work. [0] So that most multiplayer video games, and Bittorrent-over-UDP work just fine. [1] That is, HTTP(S).

simoncion 11y ago

> Even the best software written by the most capable engineers who continue to be dedicated to the projects they support is still a horribly bug-ridden mess... This is far from universally true. While I agree that the actual security of a system is currently nearly impossible for most purchasers to evaluate, and I agree that in far, far, far, too many cases proper system design and implementation appear to be the least important priority of commercial projects, there do exist well designed, secure, complex systems. > Is there any part of the "Internet of Things" that is well thought out? The part where we use this largely ubiquitous, globally accessible network to give folks the power to control and/or monitor the devices that they own from any place of their choosing? I 110% agree with you that -for an enormous slice of the consumer electronics market- security is -at best- an afterthought. However, just for a moment(!), assume that all IoT devices are secure and only exist to serve your interests, rather than the interests of a national intelligence agency or corporate overlord. In this hypothetical scenario (that's really far from what we have today) doesn't the statement in my previous paragraph highlight a thing that -at worst- provides no benefit to society and -at best- provides a large benefit?

pjc50 11y ago
If we had such a great pony as described in your final paragraph, then yes it would be great. But that's not what we're anywhere near getting at the moment. And it's always worth questioning what value the "things" are providing. Home automation has been around for decades and remains a niche. Even business computerisation (other than communications and ecommerce) seems to result in surprisingly marginal productivity improvements.
- simoncion 11y ago
  > Even business computerisation (other than communications and ecommerce) seems to result in surprisingly marginal productivity improvements. You must be joking. :) The spreadsheet is an enormous force multiplier. Email -when used for useful communication- often substantially reduces the time to close a decision making loop. You can point to telephones as a replacement for email, but telephone switches -themselves- have been computerized for many, many, many decades. > If we had such a great pony as described in your final paragraph, then yes it would be great. But that's not what we're anywhere near getting at the moment. You appear to be talking as if I don't understand that the state of system security in the consumer electronics space is dire. I... kinda covered that in the comment to which you replied. There was no need to qualify your "Yes.". :) (And yes, I do notice that you're not my original conversation partner.)
  - pjc50 11y ago
    I was referring to the Solow productivity paradox: computerised technology certainly feels much more efficient, but in terms of the economic variable "productivity per person-hour" the difference is not as striking as expected. The qualified yes was really a no: I believe that the market structure can't and won't deliver open, secure, interoperable devices in the forseeable future (say 10 years).
    - JoeAltmaier 11y ago
      But, but, I'm on a desktop running an open, secure, interoperable device right now. Just migrate this software into a device, right? The capability of devices right now is comparable to desktop computers in the 90s. And way beyond what it took to put a man on the moon. So it'll fit, soon if not now.

marcosdumay 11y ago

Before anything else, we need our main networked devices to survive being placed on the same network as some malign device. The current situation is a joke, and much before one even thinks about IoT. Having a compromised device at home should mean at most that it's tracking you with its sensors. Not that it can compromise anything you have around, and get any data you have, or that it can use your network to get anybody else.

simoncion 11y ago
My personal laptop, my servers, and my Linux-running home networking equipment are fairly resistant to attack. ;) It's true that the consumer electronics security situation is a sad joke, but PCs have generally been becoming harder targets for quite some time now. > ...or that it can use your network to get anybody else. I assume that by this you mean "Can't use your Internet link to launch attacks against other networks."? If you do, then it is my somewhat-informed opinion that maintaining a default-deny policy for outbound communication on a home LAN is far too much trouble than it's worth. I suspect that -on most home LANs- you could probably get away with denying all outbound TCP other than to port 80 and 443, and allowing all outbound UDP. [0] However, if your attacker is somewhat determined and even a little bit clever, he will use the Universal Firewall Bypass Protocol [1] to talk to his C&C system(s) or other malicious devices or whatever. In this situation, you will have spent more than 0 minutes on managing your firewall rules and gained nothing from the work. [0] So that most multiplayer video games, and Bittorrent-over-UDP work just fine. [1] That is, HTTP(S).