3 ms·

> If your device is participating in a DDOS, then it is a bad actor and you should pay for that. I wonder how that would play into the debate on gun manufactur

> If your device is participating in a DDOS, then it is a bad actor and you should pay for that. I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over. It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.

adrianratnapala 10y ago
Gun users and car users are already liable in these cases. In the case of IoT security, it's probably more realistic that we see manufacturers held liable. But in my book owner liability would be fine exactly because it keeps ownership with the owner. If some DDOS victim can show your camera was pinging them, then he can sue you for 1 cent per ping or something. It's only $200 in total, no big deal. But it will make you ask for more security on your next IoT purchase.
- Larrikin 10y ago
  $200 would be devastating to large swathes of the population in the US
  - cfjgvjh 10y ago
    True, but I wonder if they'd be buying IoT devices in the first place.
Kronopath 10y ago
Those scenarios aren't comparable. For gun manufacturers, you need a person choosing to use a gun irresponsibly or maliciously to cause damage. Car liability is more complicated, but in a lot of cases it's the driver that's held at fault, and rightly so. In the cases where a defect in the car causes a crash, car manufacturers typically are held responsible. IMO a better metaphor would be to car manufacturers being held responsible for undue environmental degradation, something that does happen to a degree already. (Hello Volkswagen!) The manufacturer should be held responsible for damages to common infrastructure or resources caused by design flaws or deliberately negligent design.
hx87 10y ago
I have fairly strong control over how I use my gun, since it's a relatively simple device that doesn't make independent decisions. Less so for my car, especially more recent ones, and far less so for any IoT devices I own. Therefore, it makes sense for gun owners to have liability, although in the case of "smart" guns more liability should go to the manufacturer.
hga 10y ago
Echoing some of the other comments, guns as dangerous things are remarkably easy to use safely, e.g. compare ~600 fatal accidents/year and ~33,000 as I recall for cars (both, through quite a lot of effort, making large absolute drops over the last N decades while the population and number of them has significantly increased). But to use an Internet of Shit device safely, well, I could do it, but I'd have to uncrate a firewall, freshen its software and get it to play nicely with my AT&T U-verse modem/firewall, freshen my knowledge of packet filtering, and then.... This is not my forte, and obviously impossible for the vast majority of people. Instead, to borrow a phrase from RMS/FSF, these defective by design devices need policing, perhaps at a pretty severe level (e.g. requiring stable responsible entities, which could be 3rd parties (should be, actually, since hardware companies are particularly notorious for bad software and security practices), requiring updating capabilities, ISP policing (https://news.ycombinator.com/item?id=12772979 https://news.ycombinator.com/item?id=12772979), etc.), we need to generally improve the state of the art, etc. etc. etc. To bring it back to the gun analogy, some basic human factors allowing the rigorous application of 4 rules (https://en.wikipedia.org/wiki/Jeff_Cooper#Firearms_safety https://en.wikipedia.org/wiki/Jeff_Cooper#Firearms_safety) are all that's needed to keep them from causing unintentional harm (and teaching these isn't hard), just sitting in my holster this morning when I went shopping, mine wasn't going to do anything bad as long as I retained it from a bad actor trying to snatch it (and first he'd have to realize I was carrying it). Whereas all it takes is plugging in an IoS device into the net, following the instructions provided for the consumer, for bad actors to compromise them and cause increasing chaos. We're in for some interesting times; this furthers my determination to make sure I can be productive with my computer(s) without the net being available, and my recent and very much related to all this decision to not go "paperless" with all my utility etc. accounts.

adrianratnapala 10y ago

Gun users and car users are already liable in these cases. In the case of IoT security, it's probably more realistic that we see manufacturers held liable. But in my book owner liability would be fine exactly because it keeps ownership with the owner. If some DDOS victim can show your camera was pinging them, then he can sue you for 1 cent per ping or something. It's only $200 in total, no big deal. But it will make you ask for more security on your next IoT purchase.

Larrikin 10y ago
$200 would be devastating to large swathes of the population in the US
- cfjgvjh 10y ago
  True, but I wonder if they'd be buying IoT devices in the first place.

Kronopath 10y ago

Those scenarios aren't comparable. For gun manufacturers, you need a person choosing to use a gun irresponsibly or maliciously to cause damage. Car liability is more complicated, but in a lot of cases it's the driver that's held at fault, and rightly so. In the cases where a defect in the car causes a crash, car manufacturers typically are held responsible. IMO a better metaphor would be to car manufacturers being held responsible for undue environmental degradation, something that does happen to a degree already. (Hello Volkswagen!) The manufacturer should be held responsible for damages to common infrastructure or resources caused by design flaws or deliberately negligent design.

hx87 10y ago

I have fairly strong control over how I use my gun, since it's a relatively simple device that doesn't make independent decisions. Less so for my car, especially more recent ones, and far less so for any IoT devices I own. Therefore, it makes sense for gun owners to have liability, although in the case of "smart" guns more liability should go to the manufacturer.

hga 10y ago

Echoing some of the other comments, guns as dangerous things are remarkably easy to use safely, e.g. compare ~600 fatal accidents/year and ~33,000 as I recall for cars (both, through quite a lot of effort, making large absolute drops over the last N decades while the population and number of them has significantly increased). But to use an Internet of Shit device safely, well, I could do it, but I'd have to uncrate a firewall, freshen its software and get it to play nicely with my AT&T U-verse modem/firewall, freshen my knowledge of packet filtering, and then.... This is not my forte, and obviously impossible for the vast majority of people. Instead, to borrow a phrase from RMS/FSF, these defective by design devices need policing, perhaps at a pretty severe level (e.g. requiring stable responsible entities, which could be 3rd parties (should be, actually, since hardware companies are particularly notorious for bad software and security practices), requiring updating capabilities, ISP policing (https://news.ycombinator.com/item?id=12772979 https://news.ycombinator.com/item?id=12772979), etc.), we need to generally improve the state of the art, etc. etc. etc. To bring it back to the gun analogy, some basic human factors allowing the rigorous application of 4 rules (https://en.wikipedia.org/wiki/Jeff_Cooper#Firearms_safety https://en.wikipedia.org/wiki/Jeff_Cooper#Firearms_safety) are all that's needed to keep them from causing unintentional harm (and teaching these isn't hard), just sitting in my holster this morning when I went shopping, mine wasn't going to do anything bad as long as I retained it from a bad actor trying to snatch it (and first he'd have to realize I was carrying it). Whereas all it takes is plugging in an IoS device into the net, following the instructions provided for the consumer, for bad actors to compromise them and cause increasing chaos. We're in for some interesting times; this furthers my determination to make sure I can be productive with my computer(s) without the net being available, and my recent and very much related to all this decision to not go "paperless" with all my utility etc. accounts.