6 ms·

I join you in applauding Hangzhou Xiongmai in doing the recall. Still, I think liability (for either users or manufacurers) is the right answer. If your devic

I join you in applauding Hangzhou Xiongmai in doing the recall. Still, I think liability (for either users or manufacurers) is the right answer. If your device is participating in a DDOS, then it is a bad actor and you should pay for that. As for regulation, I am in favor of the right regulations (which I suspect will be rules about liability). The danger is that we end up with rules forcing particular engineering methods and security certifications. That will benefit the incumbent companies who already used the official methods, without necessarily improving the software. In fact it would create "standing targets" that will benefit attackers.

joe_the_user 10y ago
The definitely the right regulation but I think regulation is going to be needed. The simplest thing is forcing devices to generate unique random passwords when connected. After-the-fact liability can't stop a million small users from buying off-brand merchandise and can't stop off-brand merchandise makers from functioning - especially if quality manufacturers add a premium for the liability they face.
- socmag 10y ago
  Zero regulation is required. That's the whole point of the Internet. It is the responsibility of the IETF and the infrastructure manufacturers. There is absolutely no way to control the actions of individual devices, nor should there be. The liability lies with the network itself. Period.
goalieca 10y ago
If we look at nist guidelines for cryptography then it's fairly stable but really well designed. The official fips and cc certification process takes a lot of time and money.
deleted 10y ago
[deleted]
thomasahle 10y ago
> If your device is participating in a DDOS, then it is a bad actor and you should pay for that. I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over. It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.
- adrianratnapala 10y ago
  Gun users and car users are already liable in these cases. In the case of IoT security, it's probably more realistic that we see manufacturers held liable. But in my book owner liability would be fine exactly because it keeps ownership with the owner. If some DDOS victim can show your camera was pinging them, then he can sue you for 1 cent per ping or something. It's only $200 in total, no big deal. But it will make you ask for more security on your next IoT purchase.
  - Larrikin 10y ago
    $200 would be devastating to large swathes of the population in the US
    - cfjgvjh 10y ago
      True, but I wonder if they'd be buying IoT devices in the first place.
- Kronopath 10y ago
  Those scenarios aren't comparable. For gun manufacturers, you need a person choosing to use a gun irresponsibly or maliciously to cause damage. Car liability is more complicated, but in a lot of cases it's the driver that's held at fault, and rightly so. In the cases where a defect in the car causes a crash, car manufacturers typically are held responsible. IMO a better metaphor would be to car manufacturers being held responsible for undue environmental degradation, something that does happen to a degree already. (Hello Volkswagen!) The manufacturer should be held responsible for damages to common infrastructure or resources caused by design flaws or deliberately negligent design.
djsumdog 10y ago
Everyone makes mistakes and I'm against more liability regulations, which could just end up hurting smaller companies. Best practice is to require your customer to set an initial password before they can even use the device. But to make something labial for missing a potential attack vector seems counterproductive.
dx034 10y ago
Regarding manufacturer liability: As this is a software issue, it would also apply to all software manufacturers. Suddenly, Microsoft/Apple/Google could be liable for damage through viruses that was enabled by a bug in their software. I don't think that law would ever be passed. The current problems are not that different from computer viruses a decade ago. The problem was only fixed after some major incidents (not that computers are virus free now, but you can install windows and connect it to the internet without having a virus on your device within 5 minutes).
WalterBright 10y ago
I'd be very, very careful about deciding on regulation. The industry has done very, very well for us with no regulation whatsoever. The state of the industry also changes so fast, it's hard to see how regulation could even be relevant.

joe_the_user 10y ago

The definitely the right regulation but I think regulation is going to be needed. The simplest thing is forcing devices to generate unique random passwords when connected. After-the-fact liability can't stop a million small users from buying off-brand merchandise and can't stop off-brand merchandise makers from functioning - especially if quality manufacturers add a premium for the liability they face.

socmag 10y ago
Zero regulation is required. That's the whole point of the Internet. It is the responsibility of the IETF and the infrastructure manufacturers. There is absolutely no way to control the actions of individual devices, nor should there be. The liability lies with the network itself. Period.

goalieca 10y ago

If we look at nist guidelines for cryptography then it's fairly stable but really well designed. The official fips and cc certification process takes a lot of time and money.

deleted 10y ago

[deleted]

thomasahle 10y ago

> If your device is participating in a DDOS, then it is a bad actor and you should pay for that. I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over. It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.

adrianratnapala 10y ago
Gun users and car users are already liable in these cases. In the case of IoT security, it's probably more realistic that we see manufacturers held liable. But in my book owner liability would be fine exactly because it keeps ownership with the owner. If some DDOS victim can show your camera was pinging them, then he can sue you for 1 cent per ping or something. It's only $200 in total, no big deal. But it will make you ask for more security on your next IoT purchase.
- Larrikin 10y ago
  $200 would be devastating to large swathes of the population in the US
  - cfjgvjh 10y ago
    True, but I wonder if they'd be buying IoT devices in the first place.
Kronopath 10y ago
Those scenarios aren't comparable. For gun manufacturers, you need a person choosing to use a gun irresponsibly or maliciously to cause damage. Car liability is more complicated, but in a lot of cases it's the driver that's held at fault, and rightly so. In the cases where a defect in the car causes a crash, car manufacturers typically are held responsible. IMO a better metaphor would be to car manufacturers being held responsible for undue environmental degradation, something that does happen to a degree already. (Hello Volkswagen!) The manufacturer should be held responsible for damages to common infrastructure or resources caused by design flaws or deliberately negligent design.

djsumdog 10y ago

Everyone makes mistakes and I'm against more liability regulations, which could just end up hurting smaller companies. Best practice is to require your customer to set an initial password before they can even use the device. But to make something labial for missing a potential attack vector seems counterproductive.

dx034 10y ago

Regarding manufacturer liability: As this is a software issue, it would also apply to all software manufacturers. Suddenly, Microsoft/Apple/Google could be liable for damage through viruses that was enabled by a bug in their software. I don't think that law would ever be passed. The current problems are not that different from computer viruses a decade ago. The problem was only fixed after some major incidents (not that computers are virus free now, but you can install windows and connect it to the internet without having a virus on your device within 5 minutes).

WalterBright 10y ago

I'd be very, very careful about deciding on regulation. The industry has done very, very well for us with no regulation whatsoever. The state of the industry also changes so fast, it's hard to see how regulation could even be relevant.