4 ms·

What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic

What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic incentives. Having and supporting open protocols is more work than internal only. Often times the mothership is using other products to provide the service which are proprietary and paid for, so nothing is free (as in beer) or free (as in speech). "Do more work for no additional revenue" is a very hard sell! I desperately want LAN SSL for a product I work on. It isn't simple, but there is a known approach (Plex do it) and it would be great for letsencrypt to solve. You can see my last plea from just over a month ago in HN comments: https://news.ycombinator.com/item?id=11956088 https://news.ycombinator.com/item?id=11956088

kbenson 10y ago
> Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who can say that as of right now? Compare this to other industries. For cars, you have companies with varying levels of reputation (and that ebbs and flows over time). A big part of this is that car companies (and dealerships) aren't continually forcing you into using their related services. Oh, they'll encourage you and try to set up situations where it's strongly encouraged, but they know that many people will refuse to buy if they had no choice but to service their vehicle at the dealership they bought it from. What do you think would happen if Honda decided that for the next model year all fasteners were going to be non-standard sizes and with proprietary heads (think locking wheel nuts for for everything)? After the first few horror stories, Honda would deservedly start getting a reputation for being much harder to deal with, and lots of hidden costs. Right now we are moving towards a situation where all the IoT companies work like this, but they are all so new, and changing so often, that there's no benefit to a good reputation because there's no associated history to go with it. What we need are standards. Google and other major video platforms could help with part of this. Adopt a github type model for youtube or some service like it, where it works as it does now but if you want a private device-driven stream of video to be accepted, there's a standard for that and you can pay a small monthly fee (or it's free. The standard is the important part). Similarly, a standard for how to change settings for devices would be useful. HTML obviously works, but being so general may not be the best solution for what amounts to simple needs. A REST endpoint that supports a few well defined routes for discovery of routes and descriptions of them, as well as a route to return the entire configuration for backup, might work better, especially as it could easily be embedded in a larger dashboard for other devices (such as a "home" dashboard).
- rogerbinns 10y ago
  Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhaps certification instead of standards? The equivalent of UL (Underwriters Laboratory) would work, but it would need to suit the nature, prices and timelines of these products. At least consumers would then know to look for the logo. While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. Additionally making them robust against general clients versus only in-house ones is a lot more work. The general ones would attempt to do nonsensical or potentially even harmful settings, and so would require more engineering spend to protect against.
  - kbenson 10y ago
    > Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). I think that's inherently a feature of them being too closely linked with the companies that provide them. Phones are the extreme case of what IoT devices could become. Once the phone OS is no longer supported by provider, keeping it is both a liability, and increasingly problematic as things stop working. Compare to old Nokia bumb brick phones. People still use those. While the close control over phones has yielded some advantages (a boost to their markets and security, for one), a phone is generally much more complex than the average IoT device, and is closer to a general purpose device. > As for the last paragraph, perhaps certification instead of standards? Certification doesn't prevent a service from going away a year later. We need a way to hook the device up to another service. If it's a standard, there's nothing to prevent an open source product that you can install on your own server, local or remote. > While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. I would be interested in exploring some specific examples. What, besides aggregation of audio, video, or stats, and configuration options is there that would be hard to support? Also, I'm not saying we can't or shouldn't have specialized services where it makes sense, just that we should have open standards that companies can work to implement if they choose. > Additionally making them robust against general clients versus only in-house ones is a lot more work. They always need to be robust against general clients. Allowing companies to think they can get away with ignoring this will be very problematic in the future. Having a well defined standard and likely off-the-shelf software to help implement it will probably do quite a bit towards making things more secure, not less. See home routers and the use of openWRT, Tomato, etc. I think this would more than likely raise the lowest common denominator when it comes to security of IoT devices.

kbenson 10y ago

> Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who can say that as of right now? Compare this to other industries. For cars, you have companies with varying levels of reputation (and that ebbs and flows over time). A big part of this is that car companies (and dealerships) aren't continually forcing you into using their related services. Oh, they'll encourage you and try to set up situations where it's strongly encouraged, but they know that many people will refuse to buy if they had no choice but to service their vehicle at the dealership they bought it from. What do you think would happen if Honda decided that for the next model year all fasteners were going to be non-standard sizes and with proprietary heads (think locking wheel nuts for for everything)? After the first few horror stories, Honda would deservedly start getting a reputation for being much harder to deal with, and lots of hidden costs. Right now we are moving towards a situation where all the IoT companies work like this, but they are all so new, and changing so often, that there's no benefit to a good reputation because there's no associated history to go with it. What we need are standards. Google and other major video platforms could help with part of this. Adopt a github type model for youtube or some service like it, where it works as it does now but if you want a private device-driven stream of video to be accepted, there's a standard for that and you can pay a small monthly fee (or it's free. The standard is the important part). Similarly, a standard for how to change settings for devices would be useful. HTML obviously works, but being so general may not be the best solution for what amounts to simple needs. A REST endpoint that supports a few well defined routes for discovery of routes and descriptions of them, as well as a route to return the entire configuration for backup, might work better, especially as it could easily be embedded in a larger dashboard for other devices (such as a "home" dashboard).

rogerbinns 10y ago
Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhaps certification instead of standards? The equivalent of UL (Underwriters Laboratory) would work, but it would need to suit the nature, prices and timelines of these products. At least consumers would then know to look for the logo. While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. Additionally making them robust against general clients versus only in-house ones is a lot more work. The general ones would attempt to do nonsensical or potentially even harmful settings, and so would require more engineering spend to protect against.
- kbenson 10y ago
  > Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). I think that's inherently a feature of them being too closely linked with the companies that provide them. Phones are the extreme case of what IoT devices could become. Once the phone OS is no longer supported by provider, keeping it is both a liability, and increasingly problematic as things stop working. Compare to old Nokia bumb brick phones. People still use those. While the close control over phones has yielded some advantages (a boost to their markets and security, for one), a phone is generally much more complex than the average IoT device, and is closer to a general purpose device. > As for the last paragraph, perhaps certification instead of standards? Certification doesn't prevent a service from going away a year later. We need a way to hook the device up to another service. If it's a standard, there's nothing to prevent an open source product that you can install on your own server, local or remote. > While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. I would be interested in exploring some specific examples. What, besides aggregation of audio, video, or stats, and configuration options is there that would be hard to support? Also, I'm not saying we can't or shouldn't have specialized services where it makes sense, just that we should have open standards that companies can work to implement if they choose. > Additionally making them robust against general clients versus only in-house ones is a lot more work. They always need to be robust against general clients. Allowing companies to think they can get away with ignoring this will be very problematic in the future. Having a well defined standard and likely off-the-shelf software to help implement it will probably do quite a bit towards making things more secure, not less. See home routers and the use of openWRT, Tomato, etc. I think this would more than likely raise the lowest common denominator when it comes to security of IoT devices.