3 ms·
Okay, so some regulator comes up with a security test, the device passes the test, and then later on some security researcher discovers a flaw in either the tes
by speedplane 10y ago
Okay, so some regulator comes up with a security test, the device passes the test, and then later on some security researcher discovers a flaw in either the test or in the device in a way that was not expected. What now? The manufacturer may well be out of business or they may be too small to recall all of their devices. They cannot be counted on to remedy the situation. As much as you'd like to blame the manufacturers, blaming them won't do much good.
- pmontra 10y agoYou are right. We need a multi pronged approach. More secure devices is something we need no matter what. If compliance tests are required, I suspect that companies will emerge to provide management and upgrade services to devices. Manufacturers won't have to care of all aspects of security and will work with them. This will lower costs because economies of scale will happen inside the service company. This is going to require some standardization on the software platforms (but many are using Linux anyway) and the update methods. But those companies will become targets or accomplices. Beware. Second pronge. ISPs should firewall customers from within. I have a concern that this is going to be another step towards the Big Brother. I'm not an expert of networking so I can't make suggestions here but if that webcam from a long time disappeared manufacturer starts doing DDoSes, the ISP cuts it off the Internet. This is fine with me. Beware of false positives.
- pyvpx 10y agothey are shipping criminally negligent software with their products. A future standard should simply require a known, open, secure method for updating firmware to their devices. demanding it be secure from the start is...dangerously naive.