4 ms·

>Not at all the case with IoT Why? The rest of your comment doesn't address that. >See Bruce Schneier's recent article on the matter, where he makes the case

>Not at all the case with IoT Why? The rest of your comment doesn't address that. >See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point He also doesn't explain why. He literally writes: >>In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: >>they're now selling newer and better models, and the original buyers only cared about price and features. ... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me.

xenadu02 10y ago
>> In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. > Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: Not really. When a desktop PC is compromised sometimes it is noticed because eventually malware comes along that bricks the system, installs ransomware, or otherwise discloses itself. But the sad truth is that a lot of compromised desktop PCs aren't noticed which is why there are millions used in botnets right now. Microsoft decided to take it seriously and pushed automatic updates, adopted secure coding standards, etc. It took a decade to make a good dent in the problem and it still isn't completely resolved. >>they're now selling newer and better models, and the original buyers only cared about price and features. >... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. >Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: If all manufacturers have to meet certain standards then no one can undercut anyone else by skipping out. You can save some money by not including various safety features but then you can't sell those devices to over half the world so what's the point? If it is all voluntary you have busy consumers who don't have the requisite background knowledge (nor the time) to learn the details of software security, nor audit the code for secure coding standards and that's assuming the code was even available. If you want to make the claim that every human being should be an expert at evaluating such claims that's a massive inefficiency. Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. Not everyone can be an expert in chemistry, software, mechanical design, food safety, et al simultaneously. (Not to mention needing perfect and instantaneous information). Claiming that lawsuits will fix everything after-the-fact ignores the real human cost, the lost potential of the ruined lives, and doesn't work unless you completely eliminate the corporate veil and make everyone personally liable. Otherwise every company will just be incorporated with various shells to ensure you can't actually recover anything. That goes on today - get sued? File bankruptcy and re-incorporate under a new name. You don't even need to move the factory because the seller was just leasing it from your shell incorporated in the Bahamas. >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... >I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me. Did you just not get on the internet this Friday or what? It isn't fear mongering, we're living in a world right now where there are millions of cheaply made IoT devices with hard-coded telnet ports wide-open. They can't ever be fixed because they weren't made with any ability to update the firmware. Their owners don't even know they are infected. What mechanism are you proposing to magically make the manufacturers or consumers a) give a shit and b) gain the capability to evaluate products on a security basis? This is a classic tragedy of the commons situation. Each individual makes a rational decision for themselves (saving money) but it results in a massively bad outcome for the whole world.
- necessity 10y ago
  >Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. lol
Ar-Curunir 10y ago
If said companies cannot afford to test or provide patches, maybe they shouldn't be in the game of creating unpatchable internet-facing devices. IoT companies have been pushing crappy proprietary solutions for a while now; mobile phones and computers are exempt from this primarily because they run a few major OSes, which can be relatively easily patched. IoT devices are a shithole of poorly written code that doesn't even work properly, let alone securely.
- necessity 10y ago
  So only tech giants can play..?
  - TeMPOraL 10y ago
    I'd prefer it that way, to be honest - because your average small company has exactly zero incentive to deliver actually useful product. They can easily sell crap and avoid consequences. It's how software is done too, except that a crappy SaaS startup can't be easily turned into a botnet. Not that big companies don't try to sell crap - but they can't so easily evade consequences, so they at least have to think about self-preservation.

xenadu02 10y ago

>> In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own. > Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with: Not really. When a desktop PC is compromised sometimes it is noticed because eventually malware comes along that bricks the system, installs ransomware, or otherwise discloses itself. But the sad truth is that a lot of compromised desktop PCs aren't noticed which is why there are millions used in botnets right now. Microsoft decided to take it seriously and pushed automatic updates, adopted secure coding standards, etc. It took a decade to make a good dent in the problem and it still isn't completely resolved. >>they're now selling newer and better models, and the original buyers only cared about price and features. >... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being: >>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never. >Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?: If all manufacturers have to meet certain standards then no one can undercut anyone else by skipping out. You can save some money by not including various safety features but then you can't sell those devices to over half the world so what's the point? If it is all voluntary you have busy consumers who don't have the requisite background knowledge (nor the time) to learn the details of software security, nor audit the code for secure coding standards and that's assuming the code was even available. If you want to make the claim that every human being should be an expert at evaluating such claims that's a massive inefficiency. Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. Not everyone can be an expert in chemistry, software, mechanical design, food safety, et al simultaneously. (Not to mention needing perfect and instantaneous information). Claiming that lawsuits will fix everything after-the-fact ignores the real human cost, the lost potential of the ruined lives, and doesn't work unless you completely eliminate the corporate veil and make everyone personally liable. Otherwise every company will just be incorporated with various shells to ensure you can't actually recover anything. That goes on today - get sued? File bankruptcy and re-incorporate under a new name. You don't even need to move the factory because the seller was just leasing it from your shell incorporated in the Bahamas. >>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers. ... >I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me. Did you just not get on the internet this Friday or what? It isn't fear mongering, we're living in a world right now where there are millions of cheaply made IoT devices with hard-coded telnet ports wide-open. They can't ever be fixed because they weren't made with any ability to update the firmware. Their owners don't even know they are infected. What mechanism are you proposing to magically make the manufacturers or consumers a) give a shit and b) gain the capability to evaluate products on a security basis? This is a classic tragedy of the commons situation. Each individual makes a rational decision for themselves (saving money) but it results in a massively bad outcome for the whole world.

necessity 10y ago
>Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. lol

Ar-Curunir 10y ago

If said companies cannot afford to test or provide patches, maybe they shouldn't be in the game of creating unpatchable internet-facing devices. IoT companies have been pushing crappy proprietary solutions for a while now; mobile phones and computers are exempt from this primarily because they run a few major OSes, which can be relatively easily patched. IoT devices are a shithole of poorly written code that doesn't even work properly, let alone securely.

necessity 10y ago
So only tech giants can play..?
- TeMPOraL 10y ago
  I'd prefer it that way, to be honest - because your average small company has exactly zero incentive to deliver actually useful product. They can easily sell crap and avoid consequences. It's how software is done too, except that a crappy SaaS startup can't be easily turned into a botnet. Not that big companies don't try to sell crap - but they can't so easily evade consequences, so they at least have to think about self-preservation.