4 ms·

This article, like many security articles, shows an unwillingness to reason about security in a non-extreme manner. All aspects of life include risk, internet

This article, like many security articles, shows an unwillingness to reason about security in a non-extreme manner. All aspects of life include risk, internet or IoT security are just one axis of risk that must be weighed when making decisions and, well, living. I find The Wirecutter's advice to be perfectly sound and reasonable.

mjg59 10y ago
Most people aren't sufficiently informed to be able to make those decisions in a reasonable way, and having the Wirecutter provide this kind of advice without explaining that there are cases where some people do need to be more paranoid is harming those people. Telling people that everything will be fine when we know that for some people there's a much higher probability that it won't be shouldn't be acceptable.
- enraged_camel 10y ago
  >>Most people aren't sufficiently informed to be able to make those decisions in a reasonable way Exactly. The vast majority of people aren't aware that their "smart thermostat" can be hacked and used to perform a denial of service attack on websites.
  - anc84 10y ago
    I'd wager that the vast majority of people also does not care the slightest about that. The manufacturer is at fault for that, not the person who bought the device. Unless people themselves get any drawback, why should they care?
    - enraged_camel 10y ago
      Well, it's like how people used to not care about leaving their wifi access points unprotected back in the day. It took several years of news stories of neighbors downloading child porn through those WAPs (and things like that) before people became aware of the risks and password protection became standard practice.
eveningcoffee 10y ago
You lost it in a minute you came to a conclusion you need or may need a IoT device in you home. Please do not get me wrong. I am big fan of smart homes and there is long history in this market, but sorry, what happens in my home must stay in my home and not leak out to some remote server. An IoT device in our home is perhaps not a huge security risk for an individual, but it is even larger risk for the society as a whole.
- emodendroket 10y ago
  Yes, I agree, which is why I don't use the Internet or computers in my home (??).
  - deleted 10y ago
    [deleted]
jerf 10y ago
It is likely that you will never be in a car crash with your current car. It is likely that the money you spent on crumple zones, airbags, and seat belts was entirely wasted. But if we conclude from that that we should remove these things from cars, we would be wrong, because we have to reason at scale about these things. At scale, the extreme events happen with some frequency. It should also be pointed out that we are now living in a world where we are not hypothesizing that someday IoT devices may have serious insecurities that lead to real problems for people, but one where we know it is true because it happens. When the Internet basically went down on the east coast and some other places last week, plenty of people who were affected by that were also the ones who owned the devices that caused it. At scale, they made a decision to buy something that ended up taking the Internet out for themselves and others. It does no good to reason that each of them only took a small risk individually when what affects us all is the collective risk of those actions. Just like in the automotive case, where we must consider the effects of various safety interventions on society as a whole and at scale, we must consider the effects of this security on society as a whole and at scale. Unlike the automotive case, computers have extra concerns about their ability to interact in ways that physical devices can not. And at that scale and with those concerns, no, there's nothing unreasonable about this analysis, especially in the face of the existing Mirai botnet. It's not just the visual-imagination compelling stories like burglars breaking into your house because they saw you weren't home from your camera (and then, presumably, remotely shut it off); it's all the possibilities. You shouldn't buy a device that is open to the internet with a default root password that can't be changed and has no firmware update mechanism even available. It's not hard to take the Kantian imperative and actually show that to be unethical of you. (While the Kantian imperative is philosophically controversial, I think this is one of those cases where it applies pretty well.)

mjg59 10y ago

Most people aren't sufficiently informed to be able to make those decisions in a reasonable way, and having the Wirecutter provide this kind of advice without explaining that there are cases where some people do need to be more paranoid is harming those people. Telling people that everything will be fine when we know that for some people there's a much higher probability that it won't be shouldn't be acceptable.

enraged_camel 10y ago
>>Most people aren't sufficiently informed to be able to make those decisions in a reasonable way Exactly. The vast majority of people aren't aware that their "smart thermostat" can be hacked and used to perform a denial of service attack on websites.
- anc84 10y ago
  I'd wager that the vast majority of people also does not care the slightest about that. The manufacturer is at fault for that, not the person who bought the device. Unless people themselves get any drawback, why should they care?
  - enraged_camel 10y ago
    Well, it's like how people used to not care about leaving their wifi access points unprotected back in the day. It took several years of news stories of neighbors downloading child porn through those WAPs (and things like that) before people became aware of the risks and password protection became standard practice.

eveningcoffee 10y ago

You lost it in a minute you came to a conclusion you need or may need a IoT device in you home. Please do not get me wrong. I am big fan of smart homes and there is long history in this market, but sorry, what happens in my home must stay in my home and not leak out to some remote server. An IoT device in our home is perhaps not a huge security risk for an individual, but it is even larger risk for the society as a whole.

emodendroket 10y ago
Yes, I agree, which is why I don't use the Internet or computers in my home (??).
- deleted 10y ago
  [deleted]

jerf 10y ago

It is likely that you will never be in a car crash with your current car. It is likely that the money you spent on crumple zones, airbags, and seat belts was entirely wasted. But if we conclude from that that we should remove these things from cars, we would be wrong, because we have to reason at scale about these things. At scale, the extreme events happen with some frequency. It should also be pointed out that we are now living in a world where we are not hypothesizing that someday IoT devices may have serious insecurities that lead to real problems for people, but one where we know it is true because it happens. When the Internet basically went down on the east coast and some other places last week, plenty of people who were affected by that were also the ones who owned the devices that caused it. At scale, they made a decision to buy something that ended up taking the Internet out for themselves and others. It does no good to reason that each of them only took a small risk individually when what affects us all is the collective risk of those actions. Just like in the automotive case, where we must consider the effects of various safety interventions on society as a whole and at scale, we must consider the effects of this security on society as a whole and at scale. Unlike the automotive case, computers have extra concerns about their ability to interact in ways that physical devices can not. And at that scale and with those concerns, no, there's nothing unreasonable about this analysis, especially in the face of the existing Mirai botnet. It's not just the visual-imagination compelling stories like burglars breaking into your house because they saw you weren't home from your camera (and then, presumably, remotely shut it off); it's all the possibilities. You shouldn't buy a device that is open to the internet with a default root password that can't be changed and has no firmware update mechanism even available. It's not hard to take the Kantian imperative and actually show that to be unethical of you. (While the Kantian imperative is philosophically controversial, I think this is one of those cases where it applies pretty well.)