4 ms·

The solution is simple: The government holds them accountable for creating shoddy products. The companies creating these products pay for the damages done. It's

The solution is simple: The government holds them accountable for creating shoddy products. The companies creating these products pay for the damages done. It's really this simple. Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Right now it's considered a tour-de-force of international cooperation when police agencies from two different countries can cooperate enough to arrest scammers who were pretending to be IRS agents over the phone and were doing real damage to peoples' lives. (http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundreds-of-people-allegedly-involved-in-irs-phone-scam/ http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundr...) Unfortunately, the U.S seems to have this completely unhealthy obsession with keeping the government impotent and companies powerful at the expense of the people. And not just the american people, but the entire world. Americans understand that even well-intentioned laws and regulations can ultimately be used against citizens and consumers through regulatory-capture. These are all rules being set by democratic states, yes, but dilution-of-interest is a real thing and very few people vote for a president or prime minister based on their telecommunications policy. I would rather the government just butts-out unless peoples' lives are at risk.

TeMPOraL 10y ago
> Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap, and leverage international law to move against the people who manufacture it. There need to be safety and security standards developed, just as they are for almost everything else you buy.
- CountSessine 10y ago
  Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap Were any of these being sold in the US? and leverage international law to move against the people who manufacture it. International law really doesn't work the way you think it does. International law, that most diaphanous of concepts and most nebulous of efforts, is just barely effective enough to prevent the sale of materials used in the manufacture of nuclear weapons. $30 IoT routers that can be used to attack silicon valley internet companies isn't on anyone's radar. And what does move against mean? Fines? Jail time? How long will it take to convince anyone to agree to that? Would anyone even agree on a dollar figure for damages? What was damaged here? Was any equipment broken? Was anyone killed? There need to be safety and security standards developed, just as they are for almost everything else you buy This makes sense, but I think it's a long road. Safety standards are imposed and enforced at a national, not an international level, except to harmonize regulations (not unify enforcement!) in some cases. And packets don't respect national boundaries. I don't think regulation is tractable in this case. I think all we've got is technical solutions or 'internet governance', much like how everyone knows not to allow open mail servers on their networks anymore.
  - notzorbo3 10y ago
    > Safety standards are imposed and enforced at a national, not an international level That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there.
    - CountSessine 10y ago
      That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. Untrue? Let me know when the United States and China have joined the European Union. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there. That's absolutely crazy. CE can regulate electrical and physical safety because Frenchmen die from roughly the same electrical voltages as Englishmen. There's just not much argument about this, and it doesn't apply to goods not sold in the EU anyways. Who really agrees about computer security? Really? An open telnet port is BAD. What about an ssh port using a shared key that doesn't require a password reset? What if the network stack hasn't been audited? What about a web interface? Is that secure? Computer security is so much more complicated and so much more nebulous than electrocuting Frenchmen. And you want to hammer out standards for this at the UN or the OECD or some other body that interfaces to national police? That's insane and it's going to turn into some horrible OSI-esque regulatory Frankenstein monster.

TeMPOraL 10y ago

> Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from? Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap, and leverage international law to move against the people who manufacture it. There need to be safety and security standards developed, just as they are for almost everything else you buy.

CountSessine 10y ago
Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap Were any of these being sold in the US? and leverage international law to move against the people who manufacture it. International law really doesn't work the way you think it does. International law, that most diaphanous of concepts and most nebulous of efforts, is just barely effective enough to prevent the sale of materials used in the manufacture of nuclear weapons. $30 IoT routers that can be used to attack silicon valley internet companies isn't on anyone's radar. And what does move against mean? Fines? Jail time? How long will it take to convince anyone to agree to that? Would anyone even agree on a dollar figure for damages? What was damaged here? Was any equipment broken? Was anyone killed? There need to be safety and security standards developed, just as they are for almost everything else you buy This makes sense, but I think it's a long road. Safety standards are imposed and enforced at a national, not an international level, except to harmonize regulations (not unify enforcement!) in some cases. And packets don't respect national boundaries. I don't think regulation is tractable in this case. I think all we've got is technical solutions or 'internet governance', much like how everyone knows not to allow open mail servers on their networks anymore.
- notzorbo3 10y ago
  > Safety standards are imposed and enforced at a national, not an international level That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there.
  - CountSessine 10y ago
    That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. Untrue? Let me know when the United States and China have joined the European Union. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there. That's absolutely crazy. CE can regulate electrical and physical safety because Frenchmen die from roughly the same electrical voltages as Englishmen. There's just not much argument about this, and it doesn't apply to goods not sold in the EU anyways. Who really agrees about computer security? Really? An open telnet port is BAD. What about an ssh port using a shared key that doesn't require a password reset? What if the network stack hasn't been audited? What about a web interface? Is that secure? Computer security is so much more complicated and so much more nebulous than electrocuting Frenchmen. And you want to hammer out standards for this at the UN or the OECD or some other body that interfaces to national police? That's insane and it's going to turn into some horrible OSI-esque regulatory Frankenstein monster.