7 ms·
The free market will solve this problem with an existing and efficient tool. Tort law. A few wins in court will do the trick. Here is how. A victim of a DDoS
by philiphodgen 10y ago
The free market will solve this problem with an existing and efficient tool.
Tort law.
A few wins in court will do the trick. Here is how.
A victim of a DDoS attack sues manufacturers, distributors, and retailers of that product for selling a defective product--the IoT device used in the IoT attack.
As soon as there is a win, the product disappears. Distributors and retailers must now price in the externality of the risk created by the product. It is far easier to take the product off the shelf. Therefore the manufacturer must either make a better product or die.
We don't need government regulation. We just need time. The legal system will do what it is designed to do: assign economic consequences to the right parties.
- deleted 10y ago[deleted]
- natch 10y agoYou say this as if it is just one device used in these attacks. And as if it will be easy to stroll over to the owner's location and determine the supply chain of that one device. And as if it will be easy to collect from the Chinese manufacturer who probably folded last week and reopened under a different name for completely different reasons.
- philiphodgen 10y agoThis is why tort lawyers sue distributors and retailers in the USA. They are here and they have insurance. Once there is a court decision, a rational seller (oh, Amazon hypothetically) will understand that selling fly-by-night small manufacturer items is fraught with peril. The offending items disappear from the marketplace.
- AnthonyMouse 10y agoMore likely the marketplace itself moves overseas. People use Amazon because they sell the stuff they want. If they stop selling it, the buyers go somewhere else. Amazon is a website. It could as easily be a website hosted out of China. Also, it sounds like you don't mind if the effect of your proposal is to destroy things like Etsy. And eBay.
- philiphodgen 10y agoThe legal system is less brain-dead than you imagine. :-) This is not the first time in history that a plague of imported items causes a problem. Etsy and eBay will survive. Ford survived the Exploding Pinto. Firestone survived its tire debacle. And we are all the safer for it.
- AnthonyMouse 10y ago> Etsy and eBay will survive. Ford survived the Exploding Pinto. Firestone survived its tire debacle. And we are all the safer for it. Ford and Firestone aren't retailers, they're manufacturers, and they were held responsible for their own mistakes, not the mistakes of third parties. There is no reasonable way for online retailers to evaluate product safety of millions of small batch third party products. Either they sell them without evaluating them or they don't sell them. Imposing liability on them is exactly how you get them to not sell them, but then we can't have Etsy or eBay. > This is not the first time in history that a plague of imported items causes a problem. It seems like the first time the problem has happened in this particular way. Historically importing was a large-scale operation done in bulk with homogeneous products, so the importer knew what they were doing and had deep pockets. Today you can cost-effectively get a 99 cent piece of electronics shipped directly from a one-person shop in China. Either you shut down the entire idea of that, and then things are going to cost a lot more than they do now, or we need a different approach.
- natch 10y agoUm, AliExpress, heard of it?
- deleted 10y ago[deleted]
- natch 10y agoYour response is still completely ignoring the problem of identifying the offending devices. When all you have to go on is a spoof-able possibly dynamic IP address, and the device is probably behind NAT anyway, good luck tracking it down or knowing what it is, in enough cases to prevent you from making more than a small dent in the problem. Then even once you know what it is, that doesn't tell you who the owner is. Then even if you find the owner, that doesn't tell you the retailer or the distributor. By the time you find the distributor, the device will be obsolete anyway and replaced by the next generation of bad devices. Your way may have worked in the past when the harm was felt directly by the consumer who knew who the retailer was. But now, the harm is inflicted on remote parties who have no inkling about the source of the harmful devices. So your argument has a huge hole in it.
- zebraflask 10y agoI'm starting to think you might have some issues with Amazon. Would you care to elaborate?
- AnthonyMouse 10y agoOn top of that, that isn't generally how liability works. If you make a crappy garage door that anyone can open, the people who bought one might be able to require you to fix it, or possibly make claims for losses if things are stolen. But when some vandals steal spray paint and sledge hammers and smash up the neighborhood, the vandals are the ones responsible for smashing up the neighborhood.
- philiphodgen 10y agoIf it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility.
- AnthonyMouse 10y ago> If it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility. That's the point. The unlawful intervening actor has 99% of the responsibility. The security vulnerability doesn't even give them anything inherently malicious or dangerous -- anyone can buy bandwidth and IP addresses on the open market. All the vulnerability does is give them the opportunity to take them without paying. The traditional rationale for imposing liability on the "wrong person" like that is when the actually responsible party can't be found and someone who could easily do something to prevent it can be found. But the manufacturers of these things can't be found either, and the retailers can't easily do anything about it.
- deleted 10y ago[deleted]
- meowface 10y agoEven if you assume an overwhelming court victory (by settlement or judgment), there will still inevitably be tens of millions of vulnerable devices out there. I'm betting most of these products don't have anything in the way of automated remote patching. And if these bot herders are smart, they're changing the vulnerable configurations or adding rudimentary ACLs so that they can keep the bots to themselves. White hat IoT-fixing scripts may not be too effective. But yes, court action is probably necessary to prevent the problem from getting much worse than it already is.
- fbender 10y agoAm I the only one who finds the notion that "the free market will solve this problem" by using the court system (an entity of the state operating on laws passed by the government) at odds?
- Analemma_ 10y agoAnd whose judgements are enforced by the government monopoly on violence! Libertarians have this curious tendency to define institutions as "government" or "not-government" however it suits them best...
- zebraflask 10y agoThat's a common, if naive, misconception. How exactly is a plaintiff going to enforce a judgment against a manufacturer overseas, or against an Internet-enabled thermostat? The US legal system, at least, was designed for quite a few things, but enforcing Econ 101 was not one of them.
- philiphodgen 10y agoThe lawsuit will work because US distributors and retailers (hi Amazon) have joint and several liability for damage caused by defective products they sell. You don't have to chase small anonymous overseas manufacturers. Distributors, acting in their own self-interest, choose to not sell the offending products.
- natch 10y agoThe lawsuit will never happen, because the consumer isn't the one feeling the harm in this case. The party feeling the harm doesn't know what the device was, where it was, whether it is still on any network, whether it is behind NAT, who owns the device, who bought the device, who distributed the device, who the retailer was, or what the attributes of the device are. So they will have a hell of a time filing a lawsuit, or, even if they try, getting standing to sue anybody.
- ComodoHacker 10y agoHey, can one sue manufacturer of a stolen car that was used to rob and kill people (and returned to the owner afterwards of you wish)? Does it matter if that car model was easier or harder to hijack?
- philiphodgen 10y agoI sell a defective telephone pole. A vandal comes along and pushes it. The pole falls on your house. I am liable for damages to your house. The vandal is, too.
- deleted 10y ago[deleted]
- philiphodgen 10y agoUPDATE. I am surprised that no one proposed the obvious counter argument to my "Tort law über alles" position. The world is a big place. Even if we successfully eliminate bad devices from the U.S. market there will be million of malformed devices everywhere else. They can be herded into a rampaging DDoS horde. The U.S. tort system is powerless to prevent that from happening. Nothing is easy. We should remember the lesson of Chesterton's fence.
- natch 10y agoI didn't raise that, because I felt it was a red herring. More importantly, with regulation we would at least have a prayer of making a dent. With lawsuits, not a prayer. It's hard to sue when you don't know what the device is, where it is in the world, whether its IP address is real or not, whether it's behind NAT, who the owner is, who bought it, who distributed it, who the retailer is, who their supplier is, who the manufacturer is, and whether it was even a real device or not. Regulation would be way more effective, relatively speaking.
- philiphodgen 10y agoWho would be the regulator for webcams sold in Uzbekistan? Who would enforce those regulations in Ukraine? I'm not saying regulation is bad. And we have it already. Look at that alphabet soup of little logos in the back of every electronic device you own. I'm just saying regulation is an imperfect solution. Tort law and economic incentives are an imperfect solution. And I am wary of government solutions, even if they are the better choice.
- natch 10y agoThat's not how it works. They don't design shitty products specifically for sale in Uzbekistan. Off-brand crappy products are typically simply copied from the designs of mainstream products, and the features baked in for the large markets (US) get automatically included. Often times this happens with secret "third" shifts where the factory reports two shifts per day to the main customer that supplied a design for manufacture, and then the third shift is run illicitly and solely for the profit of the factory management / owners. These illicit products are then sole to places where enforcement is sketchy. They don't go and retool the factory for the third shift just to make stuff more crappy. Yes there are still some crappy products that fall through the cracks. But the rising tide would eventually help lift all boats.