4 ms·

As important as security is, and as much as I think Linux should be secured more proactively, I have to take issue with two things mentioned: 1. Most devices a

As important as security is, and as much as I think Linux should be secured more proactively, I have to take issue with two things mentioned: 1. Most devices are not administered by IT Professionals This is true and must be taken into consideration, but while every layman can't be a sysadmin, neither can you, I think in 2016, simply take a position of "I don't need to understand any of this, and everything should Just Work." I don't think that's realistic, if you want the home automation we see in the Jetsons, if you want smart devices in your home setup to make your coffee at exactly 5:56 AM, then you need to step up and take a little responsibility for learning how this stuff works and how to set it up. Now is it realistic for end users to perform kernel updates, testing functionality, and changing out for new packages as needed? Of course not. But a basic understanding of the underlying technology helps in a long way in troubleshooting the inevitable problems that will arise, and in letting you choose, intelligently, what OEM's to do business with. 2. Manufacturers leaving devices un-updated, unmaintained after production This is asinine, especially for the devices that require online connectivity. You already have a more-or-less constant WAN connection, so why on Earth can't these devices update their firmware when required? The answer is of course that after-sale support is not profitable but that too is unacceptable, if you're going to bake computers into your products, you as a company need to step the hell up and support them, not just throw them on the market for a quick buck and then run away with the cash. My 0.02.

drvdevd 10y ago
Android is probably a good example of the update problem in action, but it's hard to blame Linux directly for this. Rather it is indeed the product cycle that seems to be driving the problem as you point out in #2 there. But then again, isn't it reasonable to expect some sort of deprecation or end of life for most products? Also, even if manufacturers are held to account more, we will still see severe bugs, IMO, in Linux or even some hypothetically more secure, future OS. As it's framed in this article at least, I think the automotive manufacturer metaphor falls down at some point (even if most cars now run Linux too). I think software is just vastly more complex and we are just now learning how to cope with that complexity.
- FussyZeus 10y ago
  > But then again, isn't it reasonable to expect some sort of deprecation or end of life for most products? In a cell phone? Sure, because the replacement process is a somewhat annoying sales appointment at $carrier. In a thermostat? No, because it should last years. Maybe decades if it's a good one. IoT falls apart in this arena because the hardware is designed to be replaced often, and that's exactly what house hardware should not be. And if the software is too complex, then don't do it. Do it right or don't bother.
  - caf 10y ago
    I wonder if the solution for IoT things like the network-connected door lock mentioned in the article is the emergence of third-party companies that are contracted by the initial manufacturer to provide ongoing updates for the expected product life (eg 15 years). The idea being that these patching companies would become recognised brands, and the manufacturer would get to put a "Supported by FooCorp until 2031" badge on their packaging, and consumers would start to expect to see this.
    - FussyZeus 10y ago
      My other thought relating to what you said would be why on Earth does a door lock need Linux? This is not exactly a massively complicated device, it controls a 2-state mechanism and needs to work at about a five foot radius. The fact that something like that, in an IoT mindset, needs an entire webserver is ridiculous. This is much more suited to a micro-controller with custom firmware and a tiny attack surface. No, maybe you won't be able to set it up with a smartphone and 2 minutes, but it also might WORK BETTER if it wasn't able to do that.
- pjmlp 10y ago
  > I think software is just vastly more complex and we are just now learning how to cope with that complexity. If an engineer builds a bridge and it falls down, s/he will get punished for it. If a doctor or a lawyer makes a similar hard mistake, s/he will get punished for it. The same needs to happen to software engineering, specially given that in most countries software engineering is a degree with the respective Engineering Order.

drvdevd 10y ago

Android is probably a good example of the update problem in action, but it's hard to blame Linux directly for this. Rather it is indeed the product cycle that seems to be driving the problem as you point out in #2 there. But then again, isn't it reasonable to expect some sort of deprecation or end of life for most products? Also, even if manufacturers are held to account more, we will still see severe bugs, IMO, in Linux or even some hypothetically more secure, future OS. As it's framed in this article at least, I think the automotive manufacturer metaphor falls down at some point (even if most cars now run Linux too). I think software is just vastly more complex and we are just now learning how to cope with that complexity.

FussyZeus 10y ago
> But then again, isn't it reasonable to expect some sort of deprecation or end of life for most products? In a cell phone? Sure, because the replacement process is a somewhat annoying sales appointment at $carrier. In a thermostat? No, because it should last years. Maybe decades if it's a good one. IoT falls apart in this arena because the hardware is designed to be replaced often, and that's exactly what house hardware should not be. And if the software is too complex, then don't do it. Do it right or don't bother.
- caf 10y ago
  I wonder if the solution for IoT things like the network-connected door lock mentioned in the article is the emergence of third-party companies that are contracted by the initial manufacturer to provide ongoing updates for the expected product life (eg 15 years). The idea being that these patching companies would become recognised brands, and the manufacturer would get to put a "Supported by FooCorp until 2031" badge on their packaging, and consumers would start to expect to see this.
  - FussyZeus 10y ago
    My other thought relating to what you said would be why on Earth does a door lock need Linux? This is not exactly a massively complicated device, it controls a 2-state mechanism and needs to work at about a five foot radius. The fact that something like that, in an IoT mindset, needs an entire webserver is ridiculous. This is much more suited to a micro-controller with custom firmware and a tiny attack surface. No, maybe you won't be able to set it up with a smartphone and 2 minutes, but it also might WORK BETTER if it wasn't able to do that.
pjmlp 10y ago
> I think software is just vastly more complex and we are just now learning how to cope with that complexity. If an engineer builds a bridge and it falls down, s/he will get punished for it. If a doctor or a lawyer makes a similar hard mistake, s/he will get punished for it. The same needs to happen to software engineering, specially given that in most countries software engineering is a degree with the respective Engineering Order.