11 ms·

How is this "tragedy of the commons"? The only "common" they are using is the RF spectrum, which they are presumably not polluting too badly or the FCC would st

by wyager 10y ago

How is this "tragedy of the commons"? The only "common" they are using is the RF spectrum, which they are presumably not polluting too badly or the FCC would start smashing down doors. Let's not start claiming the internet itself somehow qualifies as a "common", because with common ownership rationally comes common censorship (as with the FCC and public broadcasts).

smallnamespace 10y ago
Seems unwise to reason backwards from your desired conclusion (commons implies censorship/regulation, so it can't be a commons). Security is indeed a commons because the overall security of the ecosystem only benefits each person weakly, and so every actor rationally benefits by neglecting security. External regulation isn't the only way to address commons problems. Manufacturers can see the writing on the wall and work together to solve issues, but only if the public pushes them to.
- akavel 10y ago
  I imagine that it can also get better once a company can gain competitive advantage by advertising that "our device is secure!" But I suppose a precondition for this is customer awareness of the issue, which probably requires some well publicized high impact/casualty incidents first? :/
  - vertex-four 10y ago
    Of course, anyone can say "our device is secure", and if the industry is left to its own devices to create a standard for being allowed to say that, they'll pick the cheapest standard possible. Then, so long as they can say "we were following the standards", and the standards company can say "we're updating the standard" every time, nobody cares.
  - TeMPOraL 10y ago
    > But I suppose a precondition for this is customer awareness of the issue, which probably requires some well publicized high impact/casualty incidents first? :/ I'd say it absolutely requires a high-impact case, something like downing of an airplane, or a cyberattack that sets half of the city in flames. Otherwise, any concern of people about security will quickly get papered over by marketing - as it always is.
cobbzilla 10y ago
I think you are mistaking "tragedy of the commons". It is a behavioral outcome, where individual actors take actions that immediately benefit them, but if everyone else does the same thing, then no one wins. Overfishing a public pond is a common example (the commons is obvious here: the pond), but another great example is standing up to get a better view at a large stadium event. If you stand up, you can see better. Unfortunately, this means the person behind you also has to stand up. Once everyone is standing up, no one is any better off than if they were all sitting. The analogy here is more like the latter: It is better for Manufacturer X to rush their IoT device to market to maximize profits, ignoring security concerns. If every manufacturer does this (the person in front of you at the stadium just stood up, so you stand up too), then whoa, we have millions of insecure devices waiting to be exploited. This is indeed a tragedy of the commons.

by wyager 10y ago

smallnamespace 10y ago

Seems unwise to reason backwards from your desired conclusion (commons implies censorship/regulation, so it can't be a commons). Security is indeed a commons because the overall security of the ecosystem only benefits each person weakly, and so every actor rationally benefits by neglecting security. External regulation isn't the only way to address commons problems. Manufacturers can see the writing on the wall and work together to solve issues, but only if the public pushes them to.

akavel 10y ago
I imagine that it can also get better once a company can gain competitive advantage by advertising that "our device is secure!" But I suppose a precondition for this is customer awareness of the issue, which probably requires some well publicized high impact/casualty incidents first? :/
- vertex-four 10y ago
  Of course, anyone can say "our device is secure", and if the industry is left to its own devices to create a standard for being allowed to say that, they'll pick the cheapest standard possible. Then, so long as they can say "we were following the standards", and the standards company can say "we're updating the standard" every time, nobody cares.
- TeMPOraL 10y ago
  > But I suppose a precondition for this is customer awareness of the issue, which probably requires some well publicized high impact/casualty incidents first? :/ I'd say it absolutely requires a high-impact case, something like downing of an airplane, or a cyberattack that sets half of the city in flames. Otherwise, any concern of people about security will quickly get papered over by marketing - as it always is.

cobbzilla 10y ago

I think you are mistaking "tragedy of the commons". It is a behavioral outcome, where individual actors take actions that immediately benefit them, but if everyone else does the same thing, then no one wins. Overfishing a public pond is a common example (the commons is obvious here: the pond), but another great example is standing up to get a better view at a large stadium event. If you stand up, you can see better. Unfortunately, this means the person behind you also has to stand up. Once everyone is standing up, no one is any better off than if they were all sitting. The analogy here is more like the latter: It is better for Manufacturer X to rush their IoT device to market to maximize profits, ignoring security concerns. If every manufacturer does this (the person in front of you at the stadium just stood up, so you stand up too), then whoa, we have millions of insecure devices waiting to be exploited. This is indeed a tragedy of the commons.