9 ms·

> When it didn’t matter—when it was Facebook, when it was Twitter, when it was email—it was OK to let programmers, to give them the special right to code the wo

> When it didn’t matter—when it was Facebook, when it was Twitter, when it was email—it was OK to let programmers, to give them the special right to code the world as they saw fit. We were able to do that. But now that it’s the world of dangerous things—and it’s cars and planes and medical devices and everything else—maybe we can’t do that anymore. Mark this mindset as the beginning of the end of the open, inclusive programming world as we know it. Schnier visited RIT (my alma mater) last spring, and his presentation revolved around the threat presented by IoT and the growing need for national legislation to encumber it. I asked him a pointed question about how this scaled to the _international_ level, which he decided mostly not to answer (focus on domestic policy first, and such). Because the answer is simple: _it doesn't_. Without global collaboration, this philosophy is the beginning of national internet feifdoms - moreso than what exists today - and the beginning of the end of the global collaboration we freely enjoy today. I value this freedom a lot. I respect Mr. Schneier for his poignant responses to popular security issues and his ability to be a public face for computer security, but I strongly disagree with where he's lobbying we take the future to. Maybe I just can't accept the hard reality that "security isn't easy" and that government regulation is the only way to force security on people.

mej10 10y ago
DISCLAIMER: I don't necessarily think the types of regulations proposed are the answer, but at the very least there should be some responsibility on people using high-bandwidth connections. It would probably have to be legally mandated. Even if his proposal doesn't fix the rest of the world it would set an example for other countries. It would also give other countries more that they can do themselves. Like with the DNS DDoS, the traffic originated in the US -- even if the perpetrator was in another country. Getting the US locked down means that those countries can start taking responsibility (and I mean that in a positive way) for their own piece of the internet. Right now there isn't even a place for them to start.
cesarb 10y ago
> Without global collaboration, this philosophy is the beginning of national internet feifdoms - moreso than what exists today - and the beginning of the end of the global collaboration we freely enjoy today. You mean like a national network? I believe something like that existed in several countries. And the Internet of old grew over them, as a way to interconnect nodes within disparate networks (thus the name Internet). Give it enough time, and the national networks will merge into a single global network again.
Florin_Andrei 10y ago
I think we're probably transitioning into the stage where the global computing infrastructure finally resembles biologic systems. Malicious agents will be everywhere. Attacks will be carried out all the time, at various scales. Anything that wants to survive in this environment will need to have some sort of immune system. Likely there will be a hierarchy of defenses at various levels, as a matter of business as usual.
- nerfhammer 10y ago
  If we had other civilizations to compete with for resources we could evolve into the cogs of a single superorganism!
- TeMPOraL 10y ago
  Biological systems are different from our infrastructure in that it seems that no part of an organism tries to fuck over another to get more resources for itself. I assume this is a result of a local minimum (an organism that fights within itself would kill itself quick), but maybe there are some mechanisms ensuring cooperation within the organism too? E.g. something that prevents a developing brain to grow to capture more oxygen from the bloodstream than it should, starving out other organs? Maybe someone with a biology knowledge / background can chime in on this?
  - mr_overalls 10y ago
    Cancer is a central example of one part of an organism seizing resources in a way that threatens the organism itself.
  - Florin_Andrei 10y ago
    Well, you're looking at the Internet as a single organism. I don't think that's appropriate. There are many, many selfish entities that populate it, that would happily wreak massive destruction. Case in point - the recent IoT Dyn attacks.
drvdevd 10y ago
Security isn't easy. It remains to be seen whether regulation will actually be helpful in getting it right. Personally, I don't believe that it will, but that's just my opinion. As with most things in this field, it's one thing to talk about it, another to do it. Schneier has been talking about software liability for a long time.
- sixothree 10y ago
  I'm not sure regulation in this country is capable of making it easier to provide better security.
  - nickpsecurity 10y ago
    It was done successfully before. Resulted in most secure products ever to exist. A few still use such methods with excellent results during pentests. Also preempted major vulnerabilities in popular stuff. Bell, of Bell-LaPadula security model, describes it here: http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back-Addendum.pdf http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B...
deleted 10y ago
[deleted]
cobbzilla 10y ago
I generally agree with this, but with respect to IoT, let's be honest: these are things, and they are connecting to the Internet from some country. Would it be so bad if the law required "any connected device sold in the US must permit firmware updates, at least for security patches?" If the devices are on a US network, it seems reasonable to require them to meet certain standards. Other countries can set their own standards, just like we have FCC standards for wifi/spectrum usage in the US, and in the EU the CE sets the standards. This has not balkanized wifi; if properly done, I don't think it would balkanize IoT.
- taeric 10y ago
  The problem with "permitting firmware updates, at least for security updates", is there are no vendors that only do security updates. Our industry is guilty of using security updates as the proverbial carrot. :(
  - TeMPOraL 10y ago
    Indeed; since I first had a cable connection, I remember the software industry using automated updates as a continuous delivery platform. That's why I always hated updates and often disabled them in the past (back when I could feel the impact on my Internet connection and processing power).
skybrian 10y ago
It's not like regulating devices is unprecedented. New devices already have to be approved by the FCC before being sold in the U.S. Suppose that the FCC also checked that Internet-capable devices are safe to be connected to the Internet? This would have global impact because most companies want to sell their devices in the U.S. (And even more so if other countries with big markets cooperated with similar standards.) Another possible model would be something like having Underwriters Laboratories and other independent organizations check the devices. This is never going to be perfect, but it doesn't need to be. The goal is to make sure that devices people buy at the store are reasonably secure. In previous eras, the goal of new regulation was to make sure that you can still listen to the radio and watch TV, and that people don't often get electrocuted by their appliances. By and large it seems to have worked. For more: https://en.wikipedia.org/wiki/Nationally_Recognized_Testing_Laboratories https://en.wikipedia.org/wiki/Nationally_Recognized_Testing_...
- imglorp 10y ago
  The FCC worked because the devices they regulate are mostly local in range, but this stuff is global. Even if you do get some regulation in the First World internet devices, there are still going to be millions of legacy devices, millions more unregulated in the Third World, plus how many illegal ones and even more with latent flaws. All of them are going to be targets in the next DDOS botnet wakeup. So what do you do there, put up national firewalls? How? There's around 9,000 CVE's this year so far. Should devices be checked against all of them? How about next week, does the vendor have to go back and check your fridge? Do they have to patch it? For how long? Who pays for all that? A $20 webcam suddenly needs $500/year just in ongoing maintenance and updates. I don't have any answers, only questions.
  - wwwigham 10y ago
    And, not to be prudish, but the lack of regulation is part of what has allowed the industry to explode. It's more unlikely I can succeed at a kickstarter for a neat computer dongle if it needs an extra few thousand dollars for regulatory approval before I can ship it. While I have no personal experience with the FDA approval process, my father worked for a company in the healthcare industry - I'd hear stories of multi-month long FDA audits of their hardware after a 'statistically significant' number of failures in the field. That kind of pressure is not amenable to single-man operations, as is frequent in our field - nor should a dev be on the hook for lifetime tech support for a silly lightbulb or other trinket. Yea, the infrastructure as it currently stands has issues, but while regulatory pressure will whip the big players into line, it could also easily choke out smaller players and startups. On the subject of answers, rather than questions... I have a funny story. So the XBox one has this neat feature where you can control your console via an app on your local area network PC or phone. The default setting was that any device on the network the Xbox was connected to could control it. Imagine this, in a college dorm. I saw a lot of xboxes available to control. So, after testing with a friend (yep, I could easily interfere with whatever), I developed a key combo that I could rapidly input from any console state which would open the settings menu and disable the remote control feature, locking out my own access (And I'd know it had worked because I'd be disconnected). That's right, I effectively developed a virus which patched the vulnerability. If attackers have the advantage in this field, then maybe we should put more effort into thinking about friendly counter-attackers. If the silly IoT device can be pwned, then it can be pwned for good, as it were. Does anyone know of any groups working in this area, or any research done towards it? Pen-testing and other white hat hacking activities I know about, but does anyone officially do this kind of guerilla-patching?
hash-set 10y ago
So when did he get bought? Leglislation? He's getting old or something. The Bruce Schneier I remember was a lot more rebellious.
- wheelerwj 10y ago
  We just voted Donald Trump into the white house. Sanity IS rebelious.
hackuser 10y ago
What better solution to the problem do you have?
- patkai 10y ago
  Don't connect cars to the Internet? I can't believe companies like GM do it. They recently had huge problems with ignition keys, but I guess they are confident that putting cars online will be OK without hiccups.
  - wheelerwj 10y ago
    Hahaha, right? You know what inspires confidence? Built in 4g connections during a 5 million vehicle safety recall. /s.
nine_k 10y ago
One positive thing that might result is FCC or another agency's requirement to open the source of the critical parts of the system. An analogy: if you produce a soda, you can keep the recipe secret. If you produce a potent regulated medicine, you publish detailed formulas and include them in every box of the drug.
- syshum 10y ago
  FCC is openly hostile to Open Source, so I doubt they would require anything to be Open Source
  - TeMPOraL 10y ago
    Is it? I never knew that. Could you provide some examples of that (besides the whole OpenWRT / patching your router debacle)? I'm curious.
- nickpsecurity 10y ago
  I like your analogy between drug formulas and FOSS. I might use that talking to decision-makers in the future.
kbart 10y ago
"I asked him a pointed question about how this scaled to the _international_ level, which he decided mostly not to answer (focus on domestic policy first, and such)" He did answer that on his blog however: "It's true that this is a domestic solution to an international problem and that there's no U.S. regulation that will affect, say, an Asian-made product sold in South America, even though that product could still be used to take down U.S. websites. But the main costs in making software come from development. If the United States and perhaps a few other major markets implement strong Internet-security regulations on IoT devices, manufacturers will be forced to upgrade their security if they want to sell to those markets. And any improvements they make in their software will be available in their products wherever they are sold, simply because it makes no sense to maintain two different versions of the software. This is truly an area where the actions of a few countries can drive worldwide change."[0] And I mostly agree with him. If major markets start require certification of security (maybe something like FCC and CE), the rest of the world will follow as they want to trade in these premium markets. Sure, it will not solve the problem overnight, but at least it could be made less severe. 0. https://www.schneier.com/blog/archives/2016/11/regulation_of_t.html https://www.schneier.com/blog/archives/2016/11/regulation_of...
- evgen 10y ago
  If you want to see a simple example of this in action, consider the impact that the California Air Resources Board has had on vehicle emissions globally. If you want to sell a car in CA it has to meet CARB standards. This effectively means that if you want to see a car in the US it has to meet CARB standards. As a consequence one of the largest car markets requires a specific minimum level in terms of emissions and almost all cars built for an export market can meet these standards or be easily modified to do so. One state moved the needle here just by virtue of being the largest component of what was the largest market. There is no reason the same could not be done for internet-connected devices.
  - silpol 10y ago
    CA regulation did not stop VolksWagen to do what they did. And they did it for many years.
xupybd 10y ago
This might mean a change in the programming industry. A move to a more regulated industry, where programmers must have some sort of certification to practice. Much like other professions, such as accountants, lawyers and doctors. This will be a hurdle but it might mean better pay and less having to clean up after cowboy programmers pumping out rubbish.
- UweSchmidt 10y ago
  And no more "check out my new Javascript framework".
  - xupybd 10y ago
    I dream of a world where JavaScript frameworks mature and last.
- krmboya 10y ago
  Something similar was proposed in Kenya a few months ago. Some kind of certification for "ICT Practitioners". There was a huge backlash against it.
  - xupybd 10y ago
    Yeah it won't be a pretty transition if it does happen.
cm2187 10y ago
Well the current statu quo is just unacceptable. A major data breach every week, and that's what is being discovered. I suspect most data breaches are not advertised or even spotted. We are discussing how to best store passwords for when they will be stolen, taking that it will be the case pretty much for granted. And the big players are being hit as much as small fly by night shops. I just don't see what technological change is coming that will change that. Not only that, but because of the big data buzz, even privacy concerned companies feel the urge to collect and store ever more personal data. How is that going to end well? I mean the only reason lawmakers and regulators are not all over this issue is because they don't realise how bad things are.
- nickpsecurity 10y ago
  They realize it. Impenetrable systems are also impenetrable to FBI and NSA which advise against the good stuff being mandated. The bribes they take from COTS vendors also brought in a preference for insecure solutions from samd vendors. Everyone paying them wants to maximize profit, too. Costly rewrites will cut into that. So, they're willingly covering their ears while sitting on their asses. At least those on major committees.
syshum 10y ago
The problem can only be made worse by involving government. Sad that Bruce Schneier does not understand that reality
- Spakman 10y ago
  I'm not saying that you're right or wrong, but why do you think that?
  - syshum 10y ago
    History. What you will end up with is likely something that is LESS secure but now mandated for anything made/sold legally in the US. The rest of world will be free to do better things You will also end up with mandated Backdoors, weakened encryption, and a variety of other NSA/FBI wish list items that will be included in any "Cyber Security" bill I have no interest in the US congress regulating IoT devices, that will not be good for liberty, or security
    - Daishiman 10y ago
      So you're saying that things like the Clean Air Act, the EPA, and pollution regulations don't work? Because I look around and it's been working remarkably well.
    - nickpsecurity 10y ago
      History under the last mandate was actually a pile of products and research projects that were more secure than anything today. That included Boeing SNS server, BAE XTS-400, Aesec GEMSOS, esp KeyKOS, a secure VMM, an embedded OS in Ada, GUI's immune to keylogging/spoofing, databases immune to external leaks, and so on. All that disappeared in favor of Windows NT and UNIX w/out security the second they eliminated the regulations. There's just enough of a niche market for a few suppliers to be left, esp defense contracts. Most are gone, though, because private markets dont produce strong security if incentives are turning costs into profits.
      - 10y ago
smoyer 10y ago
In the '80s K. Eric Drexler warned of the danger of nanotechnology in his book "Engines of Creation". The terrors of the "gray goo" haven't materialized, perhaps in part because of his warnings. I believe that the IoT does need to be more secure, but I was also part of a start-up in the '90s that had an Internet connection for years without a corporate firewall. I think we'll continue to learn and adopt improved security as we go. As a systems architect that spends a lot of time thinking about scaling, redundancy and resiliency, it's also my opinion that we need to do some work on DNS ... it's probably the most vulnerable part of the "Internet stack".
- TeMPOraL 10y ago
  I read Drexler's book and I was under the impression he was way too optimistic - he spent a lot of space trying to convince readers that there can be a balance between attacker and defender. I honestly don't see it. Whether on the Internet or with nanotech, attackers always have an advantage - because they choose when to attack, and they can strike when they're sure current defences won't hold them. Patching that would IMO require defenders to have exclusive access to a smarter-than-human AI.
bryanrasmussen 10y ago
I guess I would think something like if several major markets have reasonably interoperable - and non-contradictory - security requirements then probably the strongest will be implemented by default. Not sure if it isn't possible to have reasonably interoperable security encompassing U.S and EU, although recent events sure do make me more pessimistic.
AndyMcConachie 10y ago
He addresses this in his testimony when he talked about emissions standards in California affecting emissions standards across the US. I believe his words were, "We don't need two versions." Often times regulations in one jurisdiction will impact behavior and equipment sold in other jurisdictions. This is especially true when the regulations are not particularly onerous, the jurisdiction with the regulations represents a large market relative to the total market, and the number of suppliers forced to comply with the regulations is limited. I worked for a long time in the embedded networking equipment hardware business and was involved in the rollout of ROHS. https://en.wikipedia.org/wiki/Restriction_of_Hazardous_Substances_Directive https://en.wikipedia.org/wiki/Restriction_of_Hazardous_Subst... ROHS is a EU directive, but it had the larger effect of limiting hazardous substances in devices across the world. Manufacturers wanting to sell equipment into the EU had to get rid of stuff like lead solder and replace it with safer elements. It was simply too expensive for most hardware manufacturers to have two different manufacturing processes, one for the EU, and another for everyone else. So now in the USA you have a difficult time finding lead solder in new electronic devices, and it's because of the EU and ROHS. Hardware device manufacturing these days is incredibly concentrated. These companies will abide by whatever regulations the USA or the EU forces them to abide by because they want to sell into these markets. And it's likely not cost effective for them to create parallel assembly for smaller markets.
silpol 10y ago
the sad thing is that you're probably on lawyer's mentality and hence deliver mantra "if that does not work on country level, lets push it up". Only that international law is not law-as-we-know-it. It is countries in interaction thing. Everything there is different - scale, speed, error rate, response rate, everything. And aside from "international law" part, it has started to change in earlier 00s, about 2005-2008. Next 10 or 20 or even 30 will be mess on international level, if not worse. So expectations of security global collaboration is... well, naive. And hence Mr. Schneier is right when he skips global level before going national. He is also right in a way that it is way easier to cast leadership with existing and working legislation than jump to table on global level and try to pull it towards imaginary rules. So... Mr. Schneier was right to skip. As per his lobbyism, without seeing his material it would be premature to jump to conclusions.

mej10 10y ago

DISCLAIMER: I don't necessarily think the types of regulations proposed are the answer, but at the very least there should be some responsibility on people using high-bandwidth connections. It would probably have to be legally mandated. Even if his proposal doesn't fix the rest of the world it would set an example for other countries. It would also give other countries more that they can do themselves. Like with the DNS DDoS, the traffic originated in the US -- even if the perpetrator was in another country. Getting the US locked down means that those countries can start taking responsibility (and I mean that in a positive way) for their own piece of the internet. Right now there isn't even a place for them to start.

cesarb 10y ago

> Without global collaboration, this philosophy is the beginning of national internet feifdoms - moreso than what exists today - and the beginning of the end of the global collaboration we freely enjoy today. You mean like a national network? I believe something like that existed in several countries. And the Internet of old grew over them, as a way to interconnect nodes within disparate networks (thus the name Internet). Give it enough time, and the national networks will merge into a single global network again.

Florin_Andrei 10y ago

I think we're probably transitioning into the stage where the global computing infrastructure finally resembles biologic systems. Malicious agents will be everywhere. Attacks will be carried out all the time, at various scales. Anything that wants to survive in this environment will need to have some sort of immune system. Likely there will be a hierarchy of defenses at various levels, as a matter of business as usual.

nerfhammer 10y ago
If we had other civilizations to compete with for resources we could evolve into the cogs of a single superorganism!
TeMPOraL 10y ago
Biological systems are different from our infrastructure in that it seems that no part of an organism tries to fuck over another to get more resources for itself. I assume this is a result of a local minimum (an organism that fights within itself would kill itself quick), but maybe there are some mechanisms ensuring cooperation within the organism too? E.g. something that prevents a developing brain to grow to capture more oxygen from the bloodstream than it should, starving out other organs? Maybe someone with a biology knowledge / background can chime in on this?
- mr_overalls 10y ago
  Cancer is a central example of one part of an organism seizing resources in a way that threatens the organism itself.
- Florin_Andrei 10y ago
  Well, you're looking at the Internet as a single organism. I don't think that's appropriate. There are many, many selfish entities that populate it, that would happily wreak massive destruction. Case in point - the recent IoT Dyn attacks.

drvdevd 10y ago

Security isn't easy. It remains to be seen whether regulation will actually be helpful in getting it right. Personally, I don't believe that it will, but that's just my opinion. As with most things in this field, it's one thing to talk about it, another to do it. Schneier has been talking about software liability for a long time.

sixothree 10y ago
I'm not sure regulation in this country is capable of making it easier to provide better security.
- nickpsecurity 10y ago
  It was done successfully before. Resulted in most secure products ever to exist. A few still use such methods with excellent results during pentests. Also preempted major vulnerabilities in popular stuff. Bell, of Bell-LaPadula security model, describes it here: http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back-Addendum.pdf http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B...

deleted 10y ago

[deleted]

cobbzilla 10y ago

I generally agree with this, but with respect to IoT, let's be honest: these are things, and they are connecting to the Internet from some country. Would it be so bad if the law required "any connected device sold in the US must permit firmware updates, at least for security patches?" If the devices are on a US network, it seems reasonable to require them to meet certain standards. Other countries can set their own standards, just like we have FCC standards for wifi/spectrum usage in the US, and in the EU the CE sets the standards. This has not balkanized wifi; if properly done, I don't think it would balkanize IoT.

taeric 10y ago
The problem with "permitting firmware updates, at least for security updates", is there are no vendors that only do security updates. Our industry is guilty of using security updates as the proverbial carrot. :(
- TeMPOraL 10y ago
  Indeed; since I first had a cable connection, I remember the software industry using automated updates as a continuous delivery platform. That's why I always hated updates and often disabled them in the past (back when I could feel the impact on my Internet connection and processing power).

skybrian 10y ago

It's not like regulating devices is unprecedented. New devices already have to be approved by the FCC before being sold in the U.S. Suppose that the FCC also checked that Internet-capable devices are safe to be connected to the Internet? This would have global impact because most companies want to sell their devices in the U.S. (And even more so if other countries with big markets cooperated with similar standards.) Another possible model would be something like having Underwriters Laboratories and other independent organizations check the devices. This is never going to be perfect, but it doesn't need to be. The goal is to make sure that devices people buy at the store are reasonably secure. In previous eras, the goal of new regulation was to make sure that you can still listen to the radio and watch TV, and that people don't often get electrocuted by their appliances. By and large it seems to have worked. For more: https://en.wikipedia.org/wiki/Nationally_Recognized_Testing_Laboratories https://en.wikipedia.org/wiki/Nationally_Recognized_Testing_...

imglorp 10y ago
The FCC worked because the devices they regulate are mostly local in range, but this stuff is global. Even if you do get some regulation in the First World internet devices, there are still going to be millions of legacy devices, millions more unregulated in the Third World, plus how many illegal ones and even more with latent flaws. All of them are going to be targets in the next DDOS botnet wakeup. So what do you do there, put up national firewalls? How? There's around 9,000 CVE's this year so far. Should devices be checked against all of them? How about next week, does the vendor have to go back and check your fridge? Do they have to patch it? For how long? Who pays for all that? A $20 webcam suddenly needs $500/year just in ongoing maintenance and updates. I don't have any answers, only questions.
- wwwigham 10y ago
  And, not to be prudish, but the lack of regulation is part of what has allowed the industry to explode. It's more unlikely I can succeed at a kickstarter for a neat computer dongle if it needs an extra few thousand dollars for regulatory approval before I can ship it. While I have no personal experience with the FDA approval process, my father worked for a company in the healthcare industry - I'd hear stories of multi-month long FDA audits of their hardware after a 'statistically significant' number of failures in the field. That kind of pressure is not amenable to single-man operations, as is frequent in our field - nor should a dev be on the hook for lifetime tech support for a silly lightbulb or other trinket. Yea, the infrastructure as it currently stands has issues, but while regulatory pressure will whip the big players into line, it could also easily choke out smaller players and startups. On the subject of answers, rather than questions... I have a funny story. So the XBox one has this neat feature where you can control your console via an app on your local area network PC or phone. The default setting was that any device on the network the Xbox was connected to could control it. Imagine this, in a college dorm. I saw a lot of xboxes available to control. So, after testing with a friend (yep, I could easily interfere with whatever), I developed a key combo that I could rapidly input from any console state which would open the settings menu and disable the remote control feature, locking out my own access (And I'd know it had worked because I'd be disconnected). That's right, I effectively developed a virus which patched the vulnerability. If attackers have the advantage in this field, then maybe we should put more effort into thinking about friendly counter-attackers. If the silly IoT device can be pwned, then it can be pwned for good, as it were. Does anyone know of any groups working in this area, or any research done towards it? Pen-testing and other white hat hacking activities I know about, but does anyone officially do this kind of guerilla-patching?

hash-set 10y ago

So when did he get bought? Leglislation? He's getting old or something. The Bruce Schneier I remember was a lot more rebellious.

wheelerwj 10y ago
We just voted Donald Trump into the white house. Sanity IS rebelious.

hackuser 10y ago

What better solution to the problem do you have?

patkai 10y ago
Don't connect cars to the Internet? I can't believe companies like GM do it. They recently had huge problems with ignition keys, but I guess they are confident that putting cars online will be OK without hiccups.
- wheelerwj 10y ago
  Hahaha, right? You know what inspires confidence? Built in 4g connections during a 5 million vehicle safety recall. /s.

nine_k 10y ago

One positive thing that might result is FCC or another agency's requirement to open the source of the critical parts of the system. An analogy: if you produce a soda, you can keep the recipe secret. If you produce a potent regulated medicine, you publish detailed formulas and include them in every box of the drug.

syshum 10y ago
FCC is openly hostile to Open Source, so I doubt they would require anything to be Open Source
- TeMPOraL 10y ago
  Is it? I never knew that. Could you provide some examples of that (besides the whole OpenWRT / patching your router debacle)? I'm curious.
nickpsecurity 10y ago
I like your analogy between drug formulas and FOSS. I might use that talking to decision-makers in the future.

kbart 10y ago

"I asked him a pointed question about how this scaled to the _international_ level, which he decided mostly not to answer (focus on domestic policy first, and such)" He did answer that on his blog however: "It's true that this is a domestic solution to an international problem and that there's no U.S. regulation that will affect, say, an Asian-made product sold in South America, even though that product could still be used to take down U.S. websites. But the main costs in making software come from development. If the United States and perhaps a few other major markets implement strong Internet-security regulations on IoT devices, manufacturers will be forced to upgrade their security if they want to sell to those markets. And any improvements they make in their software will be available in their products wherever they are sold, simply because it makes no sense to maintain two different versions of the software. This is truly an area where the actions of a few countries can drive worldwide change."[0] And I mostly agree with him. If major markets start require certification of security (maybe something like FCC and CE), the rest of the world will follow as they want to trade in these premium markets. Sure, it will not solve the problem overnight, but at least it could be made less severe. 0. https://www.schneier.com/blog/archives/2016/11/regulation_of_t.html https://www.schneier.com/blog/archives/2016/11/regulation_of...

evgen 10y ago
If you want to see a simple example of this in action, consider the impact that the California Air Resources Board has had on vehicle emissions globally. If you want to sell a car in CA it has to meet CARB standards. This effectively means that if you want to see a car in the US it has to meet CARB standards. As a consequence one of the largest car markets requires a specific minimum level in terms of emissions and almost all cars built for an export market can meet these standards or be easily modified to do so. One state moved the needle here just by virtue of being the largest component of what was the largest market. There is no reason the same could not be done for internet-connected devices.
- silpol 10y ago
  CA regulation did not stop VolksWagen to do what they did. And they did it for many years.

xupybd 10y ago

This might mean a change in the programming industry. A move to a more regulated industry, where programmers must have some sort of certification to practice. Much like other professions, such as accountants, lawyers and doctors. This will be a hurdle but it might mean better pay and less having to clean up after cowboy programmers pumping out rubbish.

UweSchmidt 10y ago
And no more "check out my new Javascript framework".
- xupybd 10y ago
  I dream of a world where JavaScript frameworks mature and last.
krmboya 10y ago
Something similar was proposed in Kenya a few months ago. Some kind of certification for "ICT Practitioners". There was a huge backlash against it.
- xupybd 10y ago
  Yeah it won't be a pretty transition if it does happen.

cm2187 10y ago

Well the current statu quo is just unacceptable. A major data breach every week, and that's what is being discovered. I suspect most data breaches are not advertised or even spotted. We are discussing how to best store passwords for when they will be stolen, taking that it will be the case pretty much for granted. And the big players are being hit as much as small fly by night shops. I just don't see what technological change is coming that will change that. Not only that, but because of the big data buzz, even privacy concerned companies feel the urge to collect and store ever more personal data. How is that going to end well? I mean the only reason lawmakers and regulators are not all over this issue is because they don't realise how bad things are.

nickpsecurity 10y ago
They realize it. Impenetrable systems are also impenetrable to FBI and NSA which advise against the good stuff being mandated. The bribes they take from COTS vendors also brought in a preference for insecure solutions from samd vendors. Everyone paying them wants to maximize profit, too. Costly rewrites will cut into that. So, they're willingly covering their ears while sitting on their asses. At least those on major committees.

syshum 10y ago

The problem can only be made worse by involving government. Sad that Bruce Schneier does not understand that reality

Spakman 10y ago
I'm not saying that you're right or wrong, but why do you think that?
- syshum 10y ago
  History. What you will end up with is likely something that is LESS secure but now mandated for anything made/sold legally in the US. The rest of world will be free to do better things You will also end up with mandated Backdoors, weakened encryption, and a variety of other NSA/FBI wish list items that will be included in any "Cyber Security" bill I have no interest in the US congress regulating IoT devices, that will not be good for liberty, or security
  - Daishiman 10y ago
    So you're saying that things like the Clean Air Act, the EPA, and pollution regulations don't work? Because I look around and it's been working remarkably well.
  - nickpsecurity 10y ago
    History under the last mandate was actually a pile of products and research projects that were more secure than anything today. That included Boeing SNS server, BAE XTS-400, Aesec GEMSOS, esp KeyKOS, a secure VMM, an embedded OS in Ada, GUI's immune to keylogging/spoofing, databases immune to external leaks, and so on. All that disappeared in favor of Windows NT and UNIX w/out security the second they eliminated the regulations. There's just enough of a niche market for a few suppliers to be left, esp defense contracts. Most are gone, though, because private markets dont produce strong security if incentives are turning costs into profits.
    - 10y ago

smoyer 10y ago

In the '80s K. Eric Drexler warned of the danger of nanotechnology in his book "Engines of Creation". The terrors of the "gray goo" haven't materialized, perhaps in part because of his warnings. I believe that the IoT does need to be more secure, but I was also part of a start-up in the '90s that had an Internet connection for years without a corporate firewall. I think we'll continue to learn and adopt improved security as we go. As a systems architect that spends a lot of time thinking about scaling, redundancy and resiliency, it's also my opinion that we need to do some work on DNS ... it's probably the most vulnerable part of the "Internet stack".

TeMPOraL 10y ago
I read Drexler's book and I was under the impression he was way too optimistic - he spent a lot of space trying to convince readers that there can be a balance between attacker and defender. I honestly don't see it. Whether on the Internet or with nanotech, attackers always have an advantage - because they choose when to attack, and they can strike when they're sure current defences won't hold them. Patching that would IMO require defenders to have exclusive access to a smarter-than-human AI.

bryanrasmussen 10y ago

I guess I would think something like if several major markets have reasonably interoperable - and non-contradictory - security requirements then probably the strongest will be implemented by default. Not sure if it isn't possible to have reasonably interoperable security encompassing U.S and EU, although recent events sure do make me more pessimistic.

AndyMcConachie 10y ago

He addresses this in his testimony when he talked about emissions standards in California affecting emissions standards across the US. I believe his words were, "We don't need two versions." Often times regulations in one jurisdiction will impact behavior and equipment sold in other jurisdictions. This is especially true when the regulations are not particularly onerous, the jurisdiction with the regulations represents a large market relative to the total market, and the number of suppliers forced to comply with the regulations is limited. I worked for a long time in the embedded networking equipment hardware business and was involved in the rollout of ROHS. https://en.wikipedia.org/wiki/Restriction_of_Hazardous_Substances_Directive https://en.wikipedia.org/wiki/Restriction_of_Hazardous_Subst... ROHS is a EU directive, but it had the larger effect of limiting hazardous substances in devices across the world. Manufacturers wanting to sell equipment into the EU had to get rid of stuff like lead solder and replace it with safer elements. It was simply too expensive for most hardware manufacturers to have two different manufacturing processes, one for the EU, and another for everyone else. So now in the USA you have a difficult time finding lead solder in new electronic devices, and it's because of the EU and ROHS. Hardware device manufacturing these days is incredibly concentrated. These companies will abide by whatever regulations the USA or the EU forces them to abide by because they want to sell into these markets. And it's likely not cost effective for them to create parallel assembly for smaller markets.

silpol 10y ago

the sad thing is that you're probably on lawyer's mentality and hence deliver mantra "if that does not work on country level, lets push it up". Only that international law is not law-as-we-know-it. It is countries in interaction thing. Everything there is different - scale, speed, error rate, response rate, everything. And aside from "international law" part, it has started to change in earlier 00s, about 2005-2008. Next 10 or 20 or even 30 will be mess on international level, if not worse. So expectations of security global collaboration is... well, naive. And hence Mr. Schneier is right when he skips global level before going national. He is also right in a way that it is way easier to cast leadership with existing and working legislation than jump to table on global level and try to pull it towards imaginary rules. So... Mr. Schneier was right to skip. As per his lobbyism, without seeing his material it would be premature to jump to conclusions.