3 ms·

The worst part about this is that it's not even shocking. Even using something like https://Userify.com https://Userify.com (SSH key management) (disclaimer: C

The worst part about this is that it's not even shocking. Even using something like https://Userify.com https://Userify.com (SSH key management) (disclaimer: CTO) can't help if you don't practice basic key management or publish your private key (client or host). It's easy to say "well, throw up a pfSense fw and done" but I can't tell my Dad to do that. Instead his router will probably get pwned and become part of some botnet. This is just the tip of the iceberg. What about obsolete devices? Do we really have to tell people to replace their devices (routers, phones, automobiles, drones?!) every few years? I'm against regulation in this space, but people need to get educated that security updates are required (forever?), or bad things will eventually happen. What's the answer here.. does it simply come down to a liability/lawsuit risk?

dsr_ 11y ago
No, go ahead and regulate it. Consumers should have the right to fitness for purpose and reasonable and foreseeable care. In this case, I would suggest that a manufacturer of a device with internet connectivity must prominently disclose an expected lifetime at the point of sale; and support the device for that lifetime, and notify all registered customers when a flaw is found, again when it is fixed, and finally when the device lifetime is ending. Your car shouldn't have internet access in the first place; it should have an access port that can talk to an internet connectivity device. Gigabit ethernet with PoE is a pretty good choice there, by the way. You'd think that people would demand clear interfaces for things like that, after going through the generations of aftermarket radios, cassette tape players, CD players, MP3-CD players, DVD players... and now we expect an AUX-in and, maybe, a Bluetooth receiver. Standardized interfaces are great.

dsr_ 11y ago

No, go ahead and regulate it. Consumers should have the right to fitness for purpose and reasonable and foreseeable care. In this case, I would suggest that a manufacturer of a device with internet connectivity must prominently disclose an expected lifetime at the point of sale; and support the device for that lifetime, and notify all registered customers when a flaw is found, again when it is fixed, and finally when the device lifetime is ending. Your car shouldn't have internet access in the first place; it should have an access port that can talk to an internet connectivity device. Gigabit ethernet with PoE is a pretty good choice there, by the way. You'd think that people would demand clear interfaces for things like that, after going through the generations of aftermarket radios, cassette tape players, CD players, MP3-CD players, DVD players... and now we expect an AUX-in and, maybe, a Bluetooth receiver. Standardized interfaces are great.