4 ms·

> Safety standards are imposed and enforced at a national, not an international level That's simply untrue. The European Union and its predecessors have for de

> Safety standards are imposed and enforced at a national, not an international level That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there.

CountSessine 10y ago
That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. Untrue? Let me know when the United States and China have joined the European Union. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there. That's absolutely crazy. CE can regulate electrical and physical safety because Frenchmen die from roughly the same electrical voltages as Englishmen. There's just not much argument about this, and it doesn't apply to goods not sold in the EU anyways. Who really agrees about computer security? Really? An open telnet port is BAD. What about an ssh port using a shared key that doesn't require a password reset? What if the network stack hasn't been audited? What about a web interface? Is that secure? Computer security is so much more complicated and so much more nebulous than electrocuting Frenchmen. And you want to hammer out standards for this at the UN or the OECD or some other body that interfaces to national police? That's insane and it's going to turn into some horrible OSI-esque regulatory Frankenstein monster.
clarry 10y ago
The CE mark isn't a stamp of approval from a regulatory body. It's a claim made by the manufacturer of the product, a claim that says "yes sure we follow these european rules". Anybody can put that stamp on their product. Now do they actually meet the regulations? There is no international, let alone global "police" checking these products' conformity before they enter the market. In different countries, there are local authorities who might make random inspections, potentially exposing a fraction of the products that do not actually meet the regulations.
- TeMPOraL 10y ago
  True. In case of CE, ensuring that CE-declared products are actually compliant is the responsibility of each EU's member state. They do this mostly on case-by-case basis - and citizens are free to report violations of conformity. So in case that e.g. my CE-labeled charger catches fire, I can report it to appropriate authority, which will then investigate and is free to fine and/or jail the manufacturer (if local) or the importer if the product is found to be non-conforming and is a safety threat. So yeah, CE may be a self-certification stamp, but if you put one on your product, you open yourself for legal actions if your product doesn't conform to the appropriate standards. Extending this to cover networking safety aspects of devices is the minimum I hope regulators will do.

CountSessine 10y ago

That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level. Untrue? Let me know when the United States and China have joined the European Union. The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there. That's absolutely crazy. CE can regulate electrical and physical safety because Frenchmen die from roughly the same electrical voltages as Englishmen. There's just not much argument about this, and it doesn't apply to goods not sold in the EU anyways. Who really agrees about computer security? Really? An open telnet port is BAD. What about an ssh port using a shared key that doesn't require a password reset? What if the network stack hasn't been audited? What about a web interface? Is that secure? Computer security is so much more complicated and so much more nebulous than electrocuting Frenchmen. And you want to hammer out standards for this at the UN or the OECD or some other body that interfaces to national police? That's insane and it's going to turn into some horrible OSI-esque regulatory Frankenstein monster.

clarry 10y ago

The CE mark isn't a stamp of approval from a regulatory body. It's a claim made by the manufacturer of the product, a claim that says "yes sure we follow these european rules". Anybody can put that stamp on their product. Now do they actually meet the regulations? There is no international, let alone global "police" checking these products' conformity before they enter the market. In different countries, there are local authorities who might make random inspections, potentially exposing a fraction of the products that do not actually meet the regulations.

TeMPOraL 10y ago
True. In case of CE, ensuring that CE-declared products are actually compliant is the responsibility of each EU's member state. They do this mostly on case-by-case basis - and citizens are free to report violations of conformity. So in case that e.g. my CE-labeled charger catches fire, I can report it to appropriate authority, which will then investigate and is free to fine and/or jail the manufacturer (if local) or the importer if the product is found to be non-conforming and is a safety threat. So yeah, CE may be a self-certification stamp, but if you put one on your product, you open yourself for legal actions if your product doesn't conform to the appropriate standards. Extending this to cover networking safety aspects of devices is the minimum I hope regulators will do.