3 ms·

Don't sure the makers. Sue the people who own and use the devices. The first few times will be ugly and unfortunate, but if it becomes clear that buying a vul

Don't sure the makers. Sue the people who own and use the devices. The first few times will be ugly and unfortunate, but if it becomes clear that buying a vulnerable device and installing it in your home is a potentially life-ruining liability, people will quickly stop buying and using the devices. And without a market for insecure IoT gadgets, well, one way or another we won't have insecure IoT gadgets.

flukus 10y ago
How do you decide who to sue? If your device is part of a botnet there may be thousands of owners partially responsible. Most of them are probably in different country.
- ubernostrum 10y ago
  All you have to do is hit a few people in the US. This is, ironically, one of the few cases where looking up IP address and ISP records works, since the issue here is not "some random person on my wifi pirated a movie", but rather "you owned this device which was part of a botnet". Once a few Americans have been hit with ruinous lawsuits, the market for insecure devices will collapse, worldwide, overnight.
  - pikzen 10y ago
    ...Are you seriously advocating to cause financial ruin to many persons for buying a device they didn't know was vulnerable and being attacked by someone? I don't even know what to say. Aside that you're clearly not targeting the right thing.
    - ubernostrum 10y ago
      I'm saying that if someone seriously wants to end insecure IoT gadgets, there is nowhere else in the chain, other than the end consumer, to usefully target. Manufacturers are typically overseas in jurisdictions where the appropriate regulations won't reach, and retailers can be bypassed by online sales and delivery. So if you want to use the threat of lawsuit to discourage insecure devices, the end user who purchases the device is the only entity in the chain who can be targeted. And, you have to admit, it'd be effective: the market would instantly collapse if device owners could be held liable for damage caused by their devices.

flukus 10y ago

How do you decide who to sue? If your device is part of a botnet there may be thousands of owners partially responsible. Most of them are probably in different country.

ubernostrum 10y ago
All you have to do is hit a few people in the US. This is, ironically, one of the few cases where looking up IP address and ISP records works, since the issue here is not "some random person on my wifi pirated a movie", but rather "you owned this device which was part of a botnet". Once a few Americans have been hit with ruinous lawsuits, the market for insecure devices will collapse, worldwide, overnight.
- pikzen 10y ago
  ...Are you seriously advocating to cause financial ruin to many persons for buying a device they didn't know was vulnerable and being attacked by someone? I don't even know what to say. Aside that you're clearly not targeting the right thing.
  - ubernostrum 10y ago
    I'm saying that if someone seriously wants to end insecure IoT gadgets, there is nowhere else in the chain, other than the end consumer, to usefully target. Manufacturers are typically overseas in jurisdictions where the appropriate regulations won't reach, and retailers can be bypassed by online sales and delivery. So if you want to use the threat of lawsuit to discourage insecure devices, the end user who purchases the device is the only entity in the chain who can be targeted. And, you have to admit, it'd be effective: the market would instantly collapse if device owners could be held liable for damage caused by their devices.