4 ms·

You say this as if it is just one device used in these attacks. And as if it will be easy to stroll over to the owner's location and determine the supply chain

by natch 10y ago

You say this as if it is just one device used in these attacks. And as if it will be easy to stroll over to the owner's location and determine the supply chain of that one device. And as if it will be easy to collect from the Chinese manufacturer who probably folded last week and reopened under a different name for completely different reasons.

philiphodgen 10y ago
This is why tort lawyers sue distributors and retailers in the USA. They are here and they have insurance. Once there is a court decision, a rational seller (oh, Amazon hypothetically) will understand that selling fly-by-night small manufacturer items is fraught with peril. The offending items disappear from the marketplace.
- AnthonyMouse 10y ago
  More likely the marketplace itself moves overseas. People use Amazon because they sell the stuff they want. If they stop selling it, the buyers go somewhere else. Amazon is a website. It could as easily be a website hosted out of China. Also, it sounds like you don't mind if the effect of your proposal is to destroy things like Etsy. And eBay.
  - philiphodgen 10y ago
    The legal system is less brain-dead than you imagine. :-) This is not the first time in history that a plague of imported items causes a problem. Etsy and eBay will survive. Ford survived the Exploding Pinto. Firestone survived its tire debacle. And we are all the safer for it.
    - AnthonyMouse 10y ago
      > Etsy and eBay will survive. Ford survived the Exploding Pinto. Firestone survived its tire debacle. And we are all the safer for it. Ford and Firestone aren't retailers, they're manufacturers, and they were held responsible for their own mistakes, not the mistakes of third parties. There is no reasonable way for online retailers to evaluate product safety of millions of small batch third party products. Either they sell them without evaluating them or they don't sell them. Imposing liability on them is exactly how you get them to not sell them, but then we can't have Etsy or eBay. > This is not the first time in history that a plague of imported items causes a problem. It seems like the first time the problem has happened in this particular way. Historically importing was a large-scale operation done in bulk with homogeneous products, so the importer knew what they were doing and had deep pockets. Today you can cost-effectively get a 99 cent piece of electronics shipped directly from a one-person shop in China. Either you shut down the entire idea of that, and then things are going to cost a lot more than they do now, or we need a different approach.
- natch 10y ago
  Um, AliExpress, heard of it?
- deleted 10y ago
  [deleted]
- natch 10y ago
  Your response is still completely ignoring the problem of identifying the offending devices. When all you have to go on is a spoof-able possibly dynamic IP address, and the device is probably behind NAT anyway, good luck tracking it down or knowing what it is, in enough cases to prevent you from making more than a small dent in the problem. Then even once you know what it is, that doesn't tell you who the owner is. Then even if you find the owner, that doesn't tell you the retailer or the distributor. By the time you find the distributor, the device will be obsolete anyway and replaced by the next generation of bad devices. Your way may have worked in the past when the harm was felt directly by the consumer who knew who the retailer was. But now, the harm is inflicted on remote parties who have no inkling about the source of the harmful devices. So your argument has a huge hole in it.
- zebraflask 10y ago
  I'm starting to think you might have some issues with Amazon. Would you care to elaborate?
AnthonyMouse 10y ago
On top of that, that isn't generally how liability works. If you make a crappy garage door that anyone can open, the people who bought one might be able to require you to fix it, or possibly make claims for losses if things are stolen. But when some vandals steal spray paint and sledge hammers and smash up the neighborhood, the vandals are the ones responsible for smashing up the neighborhood.
- philiphodgen 10y ago
  If it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility.
  - AnthonyMouse 10y ago
    > If it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility. That's the point. The unlawful intervening actor has 99% of the responsibility. The security vulnerability doesn't even give them anything inherently malicious or dangerous -- anyone can buy bandwidth and IP addresses on the open market. All the vulnerability does is give them the opportunity to take them without paying. The traditional rationale for imposing liability on the "wrong person" like that is when the actually responsible party can't be found and someone who could easily do something to prevent it can be found. But the manufacturers of these things can't be found either, and the retailers can't easily do anything about it.
- deleted 10y ago
  [deleted]

by natch 10y ago

philiphodgen 10y ago

This is why tort lawyers sue distributors and retailers in the USA. They are here and they have insurance. Once there is a court decision, a rational seller (oh, Amazon hypothetically) will understand that selling fly-by-night small manufacturer items is fraught with peril. The offending items disappear from the marketplace.

AnthonyMouse 10y ago
More likely the marketplace itself moves overseas. People use Amazon because they sell the stuff they want. If they stop selling it, the buyers go somewhere else. Amazon is a website. It could as easily be a website hosted out of China. Also, it sounds like you don't mind if the effect of your proposal is to destroy things like Etsy. And eBay.
- philiphodgen 10y ago
  The legal system is less brain-dead than you imagine. :-) This is not the first time in history that a plague of imported items causes a problem. Etsy and eBay will survive. Ford survived the Exploding Pinto. Firestone survived its tire debacle. And we are all the safer for it.
  - AnthonyMouse 10y ago
    > Etsy and eBay will survive. Ford survived the Exploding Pinto. Firestone survived its tire debacle. And we are all the safer for it. Ford and Firestone aren't retailers, they're manufacturers, and they were held responsible for their own mistakes, not the mistakes of third parties. There is no reasonable way for online retailers to evaluate product safety of millions of small batch third party products. Either they sell them without evaluating them or they don't sell them. Imposing liability on them is exactly how you get them to not sell them, but then we can't have Etsy or eBay. > This is not the first time in history that a plague of imported items causes a problem. It seems like the first time the problem has happened in this particular way. Historically importing was a large-scale operation done in bulk with homogeneous products, so the importer knew what they were doing and had deep pockets. Today you can cost-effectively get a 99 cent piece of electronics shipped directly from a one-person shop in China. Either you shut down the entire idea of that, and then things are going to cost a lot more than they do now, or we need a different approach.
natch 10y ago
Um, AliExpress, heard of it?
deleted 10y ago
[deleted]
natch 10y ago
Your response is still completely ignoring the problem of identifying the offending devices. When all you have to go on is a spoof-able possibly dynamic IP address, and the device is probably behind NAT anyway, good luck tracking it down or knowing what it is, in enough cases to prevent you from making more than a small dent in the problem. Then even once you know what it is, that doesn't tell you who the owner is. Then even if you find the owner, that doesn't tell you the retailer or the distributor. By the time you find the distributor, the device will be obsolete anyway and replaced by the next generation of bad devices. Your way may have worked in the past when the harm was felt directly by the consumer who knew who the retailer was. But now, the harm is inflicted on remote parties who have no inkling about the source of the harmful devices. So your argument has a huge hole in it.
zebraflask 10y ago
I'm starting to think you might have some issues with Amazon. Would you care to elaborate?

AnthonyMouse 10y ago

On top of that, that isn't generally how liability works. If you make a crappy garage door that anyone can open, the people who bought one might be able to require you to fix it, or possibly make claims for losses if things are stolen. But when some vandals steal spray paint and sledge hammers and smash up the neighborhood, the vandals are the ones responsible for smashing up the neighborhood.

philiphodgen 10y ago
If it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility.
- AnthonyMouse 10y ago
  > If it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility. That's the point. The unlawful intervening actor has 99% of the responsibility. The security vulnerability doesn't even give them anything inherently malicious or dangerous -- anyone can buy bandwidth and IP addresses on the open market. All the vulnerability does is give them the opportunity to take them without paying. The traditional rationale for imposing liability on the "wrong person" like that is when the actually responsible party can't be found and someone who could easily do something to prevent it can be found. But the manufacturers of these things can't be found either, and the retailers can't easily do anything about it.
deleted 10y ago
[deleted]