5 ms·

Fantastic development, but I can't help but think about the years of pain we're going to be in security wise when people inevitably start using these for all so

by aorth 11y ago

Fantastic development, but I can't help but think about the years of pain we're going to be in security wise when people inevitably start using these for all sorts of "Internet of Things" purposes. Software stacks on these type of devices inevitably have lackluster cipher suites, sub-par protocol support, unpatched kernel/userland, etc—even if they run all the latest things out right now, they WILL get out of date and WILL NOT receive patches!

rdancer 11y ago
Not sure what you mean by "these type of devices", but you will be overjoyed that on Raspbian, updating the system is as easy as `apt-get udate && apt-get -y upgrade`, the kernel is currently v4.1.13 [1], and the rest of your comment is also FUD. [1] https://github.com/raspberrypi/firmware/blob/master/boot/kernel.img https://github.com/raspberrypi/firmware/blob/master/boot/ker...
- Tepix 11y ago
  I wouldn't call it FUD. Embedded devices tend to get updated less frequently than PCs. Connecting them all to the internet is not helping.
  - rorykoehler 11y ago
    If security is an issue set it up to run a system cron job to update.
- aorth 11y ago
  Updating Raspbian is easy, sure, and I have faith you'll update your media center or the one powering lights in your house, but for $5 I could connect one to all the cows on my farm, or to every car in the fleet of my delivery service, to the soda machine in the office, etc—people are going to use them EVERYWHERE. Then what do we do when we find out that there is a new, practical attack on SHA1, TLSv1.2? Or some exploit in OpenSSL, bash, etc? This is not FUD, this will happen.
TeMPOraL 11y ago
And thank God for that. I'm totally fine with securing critical infrastructure, bank/e-mail accounts and such, but infosec has a magical tendency of sucking joy out of everything. That insecure DIY light controller at my neighbours', you know what it is? Fun. :).

by aorth 11y ago

rdancer 11y ago

Not sure what you mean by "these type of devices", but you will be overjoyed that on Raspbian, updating the system is as easy as `apt-get udate && apt-get -y upgrade`, the kernel is currently v4.1.13 [1], and the rest of your comment is also FUD. [1] https://github.com/raspberrypi/firmware/blob/master/boot/kernel.img https://github.com/raspberrypi/firmware/blob/master/boot/ker...

Tepix 11y ago
I wouldn't call it FUD. Embedded devices tend to get updated less frequently than PCs. Connecting them all to the internet is not helping.
- rorykoehler 11y ago
  If security is an issue set it up to run a system cron job to update.
aorth 11y ago
Updating Raspbian is easy, sure, and I have faith you'll update your media center or the one powering lights in your house, but for $5 I could connect one to all the cows on my farm, or to every car in the fleet of my delivery service, to the soda machine in the office, etc—people are going to use them EVERYWHERE. Then what do we do when we find out that there is a new, practical attack on SHA1, TLSv1.2? Or some exploit in OpenSSL, bash, etc? This is not FUD, this will happen.

TeMPOraL 11y ago

And thank God for that. I'm totally fine with securing critical infrastructure, bank/e-mail accounts and such, but infosec has a magical tendency of sucking joy out of everything. That insecure DIY light controller at my neighbours', you know what it is? Fun. :).