2 ms·
I think that one of the baseline requirements for an internet connected device to be considered fully secure is automatic patching by the manufacturer, with a s
by zeta0134 10y ago
I think that one of the baseline requirements for an internet connected device to be considered fully secure is automatic patching by the manufacturer, with a signature verification system for the patches. If a vulnerability is found, this allows the manufacturer to patch it out of shipped devices before it can be exploited, reducing the attack surface considerably.
This isn't perfect (especially if the signature mechanism itself can be exploited; hello attacker-patchable devices) but it's a start.
- nitrogen 10y agoOne problem is that manufacturer-controlled updates are at odds with consumer ownership of software and hardware. The demands of privacy advocates are almost diametrically opposed to the concept of automatic pushed updates. There have been plenty of examples where manufacturer updates have made devices worse in some way.