3 ms·

I disagree. It should be the responsibility of the ISPs to monitor their network and shut down the harmful devices. Going after the hardware manufacturers is po

I disagree. It should be the responsibility of the ISPs to monitor their network and shut down the harmful devices. Going after the hardware manufacturers is pointless, many of them are far too small to do anything about the problems they've created. You can sue them out of existence, but dozens more will pop up in their place.

pmontra 10y ago
But they are big enough to pass FCC, CE (for Europe) and all the other certifications required to sell their goods. This is only one more compliance test to pass. It's not special because it's computer stuff.
- speedplane 10y ago
  Okay, so some regulator comes up with a security test, the device passes the test, and then later on some security researcher discovers a flaw in either the test or in the device in a way that was not expected. What now? The manufacturer may well be out of business or they may be too small to recall all of their devices. They cannot be counted on to remedy the situation. As much as you'd like to blame the manufacturers, blaming them won't do much good.
  - pmontra 10y ago
    You are right. We need a multi pronged approach. More secure devices is something we need no matter what. If compliance tests are required, I suspect that companies will emerge to provide management and upgrade services to devices. Manufacturers won't have to care of all aspects of security and will work with them. This will lower costs because economies of scale will happen inside the service company. This is going to require some standardization on the software platforms (but many are using Linux anyway) and the update methods. But those companies will become targets or accomplices. Beware. Second pronge. ISPs should firewall customers from within. I have a concern that this is going to be another step towards the Big Brother. I'm not an expert of networking so I can't make suggestions here but if that webcam from a long time disappeared manufacturer starts doing DDoSes, the ISP cuts it off the Internet. This is fine with me. Beware of false positives.
  - pyvpx 10y ago
    they are shipping criminally negligent software with their products. A future standard should simply require a known, open, secure method for updating firmware to their devices. demanding it be secure from the start is...dangerously naive.
mrweasel 10y ago
That would cause a lot of trouble for many people. Imaging having an ISP that cut of the internet connection for a customer, because "some device" is misbehaving. The customer, who may not be that tech savvy, will now be forced to figure out if it's the fridge, TV, AC, wireless router, security system or whatever, that has been compromised. Even if the customer figures out that which device that's to blame, the manufacturer may not have patches, or even be in business any more. So we end up in a situation where you need to replace devices, which ordinary people expect to have 10+ years lifetime. I don't think you're wrong though, the ISP should shutdown harmful devices, but the manufacturer also need to be held responsible. It's just extremely complicated to address the manufacturer, because many are just reselling white label solutions, or companies created for that one product. Honestly many of the IoT devices shouldn't exists to begin with, or be allowed to communicate with the internet.
- _Codemonkeyism 10y ago
  After this the customer will be much more conscious about device buying and will only buy security certified gear. The customer is the person buying insecure stuff and hooks it up to the internet.
- michaelt 10y ago
  Here in the UK if my car is a danger to other road users, I'm banned from using it even if the defect isn't my fault, the manufacturer has gone out of business, and the car is only a fraction of the way into its expected lifetime. Caveat emptor. If that makes it hard for new manufacturers to enter the market, they could always form an industry association and, through some combination of source code escrow and insurance, reassure customers their products will be maintained even if the supplier goes out of business. Travel agents, window manufacturers and cavity wall insulators all have such schemes.
pyvpx 10y ago
I thought we wanted ISPs to be "dumb" pipes? or did I not get the new position paper memo... Putting the burden on ISPs is never going to happen. They are in the business of moving bits. While some, unfortunately, do things like traffic shaping, deep packet inspection, and all other sorts of middleboxes -- that is all for economic purposes. There is not nor will ever be an economic incentive for an ISP to filter traffic traversing their network unless it is directly impacting their operations. and when that happens, they take the most direct and effective route: bit bucket it and notify the offender to clean up their house :)

pmontra 10y ago

But they are big enough to pass FCC, CE (for Europe) and all the other certifications required to sell their goods. This is only one more compliance test to pass. It's not special because it's computer stuff.

speedplane 10y ago
Okay, so some regulator comes up with a security test, the device passes the test, and then later on some security researcher discovers a flaw in either the test or in the device in a way that was not expected. What now? The manufacturer may well be out of business or they may be too small to recall all of their devices. They cannot be counted on to remedy the situation. As much as you'd like to blame the manufacturers, blaming them won't do much good.
- pmontra 10y ago
  You are right. We need a multi pronged approach. More secure devices is something we need no matter what. If compliance tests are required, I suspect that companies will emerge to provide management and upgrade services to devices. Manufacturers won't have to care of all aspects of security and will work with them. This will lower costs because economies of scale will happen inside the service company. This is going to require some standardization on the software platforms (but many are using Linux anyway) and the update methods. But those companies will become targets or accomplices. Beware. Second pronge. ISPs should firewall customers from within. I have a concern that this is going to be another step towards the Big Brother. I'm not an expert of networking so I can't make suggestions here but if that webcam from a long time disappeared manufacturer starts doing DDoSes, the ISP cuts it off the Internet. This is fine with me. Beware of false positives.
- pyvpx 10y ago
  they are shipping criminally negligent software with their products. A future standard should simply require a known, open, secure method for updating firmware to their devices. demanding it be secure from the start is...dangerously naive.

mrweasel 10y ago

That would cause a lot of trouble for many people. Imaging having an ISP that cut of the internet connection for a customer, because "some device" is misbehaving. The customer, who may not be that tech savvy, will now be forced to figure out if it's the fridge, TV, AC, wireless router, security system or whatever, that has been compromised. Even if the customer figures out that which device that's to blame, the manufacturer may not have patches, or even be in business any more. So we end up in a situation where you need to replace devices, which ordinary people expect to have 10+ years lifetime. I don't think you're wrong though, the ISP should shutdown harmful devices, but the manufacturer also need to be held responsible. It's just extremely complicated to address the manufacturer, because many are just reselling white label solutions, or companies created for that one product. Honestly many of the IoT devices shouldn't exists to begin with, or be allowed to communicate with the internet.

_Codemonkeyism 10y ago
After this the customer will be much more conscious about device buying and will only buy security certified gear. The customer is the person buying insecure stuff and hooks it up to the internet.
michaelt 10y ago
Here in the UK if my car is a danger to other road users, I'm banned from using it even if the defect isn't my fault, the manufacturer has gone out of business, and the car is only a fraction of the way into its expected lifetime. Caveat emptor. If that makes it hard for new manufacturers to enter the market, they could always form an industry association and, through some combination of source code escrow and insurance, reassure customers their products will be maintained even if the supplier goes out of business. Travel agents, window manufacturers and cavity wall insulators all have such schemes.

pyvpx 10y ago

I thought we wanted ISPs to be "dumb" pipes? or did I not get the new position paper memo... Putting the burden on ISPs is never going to happen. They are in the business of moving bits. While some, unfortunately, do things like traffic shaping, deep packet inspection, and all other sorts of middleboxes -- that is all for economic purposes. There is not nor will ever be an economic incentive for an ISP to filter traffic traversing their network unless it is directly impacting their operations. and when that happens, they take the most direct and effective route: bit bucket it and notify the offender to clean up their house :)