3 ms·
Just because a device is deemed to be 'secure' one day, doesn't mean there aren't hidden vulnerabilities and therefore in the future it will be deemed as 'insec
by _joel 10y ago
Just because a device is deemed to be 'secure' one day, doesn't mean there aren't hidden vulnerabilities and therefore in the future it will be deemed as 'insecure'. How would you manage that after the hardware has shipped and is on the shelves?
It gives a false impression of security if you simplify it to a sticker on a box. Plus it's not exactly hard for a device to put a false label or counterfeit in some way.
All hardware should follow basic security principles, it shouldn't be something you can grade on. If there's been an issue then the company should be rightly called out, which seems to have happened in this case.
- zeta0134 10y agoI think that one of the baseline requirements for an internet connected device to be considered fully secure is automatic patching by the manufacturer, with a signature verification system for the patches. If a vulnerability is found, this allows the manufacturer to patch it out of shipped devices before it can be exploited, reducing the attack surface considerably. This isn't perfect (especially if the signature mechanism itself can be exploited; hello attacker-patchable devices) but it's a start.
- nitrogen 10y agoOne problem is that manufacturer-controlled updates are at odds with consumer ownership of software and hardware. The demands of privacy advocates are almost diametrically opposed to the concept of automatic pushed updates. There have been plenty of examples where manufacturer updates have made devices worse in some way.