9 ms·

How long is the company that provides the product on the hook for for post-sale support and security updates? If I sell an internet-connected device which has

by luma 10y ago

How long is the company that provides the product on the hook for for post-sale support and security updates? If I sell an internet-connected device which has a flaw discovered 5 years after the sale, am I still liable for patching that? Nowhere in this article nor in the complaint do I find any guidelines as to what they consider to be reasonable after-sale support. They list similar action taken against Asus and TRENDnet, which are all large international companies. I'm a dude in my workshop and placing an after-sale support and warranty requirement on anything I make for a period of n-years is onerous.

walrus01 10y ago
At this time it appears the FTC is only going after the most egregiously shoddy practices, stuff that is basically new current generation stuff (consumer grade 802.11ac routers, etc) that goes unpatched after the vendor is notified. I would be really surprised if they started going after 3+ year old equipment after the fact, or small manufacturers. edit: D-Link has been famously shitty for a long time. At least among everyone I know who runs a 'serious' network, D-Link is seen as the exact polar opposite of a proper carrier grade switch or router... D-Link is to home routers as the Trabant is to automobiles.
- patcheudor 10y ago
  >edit: D-Link has been famously shitty for a long time. Some would say they took it to an entirely new level. Check out this disclosure from October of 2011: https://www.kb.cert.org/vuls/id/924307 https://www.kb.cert.org/vuls/id/924307 Summary: after receiving a burst of traffic it disabled WPA/2 and failed wide open. Apparently it was possible to trigger this fault with auth attempts so an attacker didn't even need to wait for someone on the WiFi to send a lot of data before it failed open. I don't even know how something fails like this. Brain hurts.
  - r00fus 10y ago
    Gray's law applies - industrial-grade stupidity/incompetence is indistinguishable from evil. I'm glad D-Link are being slapped down.
    - patcheudor 10y ago
      And by indistinguishable from evil in this case you must wonder if it was some ill architected back door.
- kosma 10y ago
  > D-Link is to home routers as the Trabant is to automobiles Trabant was actually a very ingenious design that solved a real problem. D-Link is an analogy of a large car company producing, over decades, model after model of Trabant - each laden with the same old problems - while the rest of the industry moved forward.
freehunter 10y ago
I agree that there should be some kind of guideline on how long product support should be expected. As long as those guidelines are reasonable (90 days? 2 years? 5 years?) I don't think it should be considered onerous for anyone who is selling security-conscious products like networking equipment.
tantalor 10y ago
the company failed to protect its routers and cameras from widely known and reasonably foreseeable risks That's foreseeable, as in, before the sale.
repiret 10y ago
If I'm a dude in my workshop making children's toys, I'm on the hook for strict product liability the rest of my life in I made dangerous toys. If I'm a one man contractor building a house, certain categories of mistakes I'm on the hook for for the rest of my life. I don't think it would be unprecedented for IoT device makers to be on the hook forever for certain categories of security flaws. It is not like security flaws grow spontaneously like rust a car. They are all in there from the beginning, whether they are known or not. Most of the IOT security flaws that I have heard about could have been easily prevented with security conscious design and development practices. If we want to have secure IOT devices, then we need to hold people accountable for making insecure ones.
- paulddraper 10y ago
  Another example would be automobiles. Manufacturers do recalls and provide replaces more many, many years. Ford isn't on the hook for the Model T, but it does do recalls for decades-old Saturns.
  - repiret 10y ago
    Although it is irrelevant to the point you're making, I feel I should point out that Saturn was a General Motors subsidiary, so it is not Ford that is making Saturn recalls.
    - paulddraper 10y ago
      Dammit, you're right. Gah. Well, yeah, in any case, even a defunct subsidiary (of GM, not Ford) is getting recalls decades later. High-tech has different standards than the rest of the world.
- lostlogin 10y ago
  One slight difference is that people actively try to do bad on a large scale with software while toys, cars and houses can be used nefariously but short of ramming your truck into a Christmas market, the scope for large scale damage is usually more limited.
sbov 10y ago
As a consumer, I would like for my devices to not be security nightmares for, at least, the useful life of what I'm buying. Unless you plaster a giant warning on the product, ~5 years from the time of sale seems reasonable to me for many tech related things.
- bisby 10y ago
  standard product lifetime seems reasonable. If IE6 has a security bug, the answer is "maybe use newer windows + edge". If xbox360 has a security bug, the answer might be "use xbox one". This could expand to a question of "what is the expected lifetime of a product"... is it when the replacement is released (dont like the security bugs? get camera 2.0!)?, is it when the new camera becomes standard (there are 1000000 camera 2.0s out there, and 100 camera 1.0... maybe you should get on board)? Or is it when the failure rate of the product is above a threshold (Your camera 1.0 is even still working? most of them had their CPUs burn out by now, dont expect an update, in fact you should be grateful/amazed its still running) Aging hardware is one thing ("modern security practices use a new cryptography algorithm that literally wont run on this device") but aging software is another ("we just dont want to update the software, buy our new product")
sigmar 10y ago
>“hard-coded” login credentials integrated into D-Link camera software -- such as the username “guest” and the password “guest” -- that could allow unauthorized access to the cameras’ live feed; This doesn't seem to be a complaint about future support, but security at the time it was sold.
- throwaway729 10y ago
  I think the rub is that all security bugs are bugs at the time of sale/update. Discovered or otherwise. But I agree with you here because at the time of sale, this feature was widely agreed upon to be a bad practice and was also a known feature. So it's not like someone discovered a clever 0-day DLink didn't know about. DLink knew what it was doing, knew that best practices said not to do the thing it was doing, and did that thing anyways.
Floegipoky 10y ago
I don't think the FTC is asserting that companies can't discontinue support for old products.
notheguyouthink 10y ago
This is all the more reason that we need standardized software/OSs for these IoThings. Not only do the companies not want to be on the line forever, but if they allow users to modify it in sane ways the users can do the work. Eg, if it's just small linux installations with a very basic http api in open source libs, it can probably be patched with relative ease. Instead, everyone is doing weird crap, everything is complex. I hate it as a user.
skybrian 10y ago
It seems like companies should be on the hook for recalls, but they should be able to outsource this, by buying some kind of insurance to cover the recall. Then it becomes the insurance company's job to assess the risk and price accordingly.
- andrei_says_ 10y ago
  In which case the cost of recalls would include the profit of insurance companies.
diggernet 10y ago
I think this is what I'd like to see... The manufacturer of the device is responsible for security updates forever. If at any time a security flaw is discovered in the device, they have two options: 1. Develop and deploy a fix at their own expense, and make it freely available to all owners of the device. 2. Publicly release all source code and documentation necessary for any third party to independently develop and deploy a fix. This way, any company which still cares about their customers, devices, patents, copyrights, etc which are involved will pay the expense of fixing the problem, as the cost of keeping that which they value. And any company which does NOT care about those things can simply walk away from it all at no cost to themselves. So, as a dude in your workshop, after n-years have passed and you feel the responsibility is too onerous, you opt for #2 and wash your hands of the mess. As an interesting side-effect, this opens up a business opportunity for source and documentation escrow services. Because if you've somehow managed to lose some or all of your source and documentation, you've also lost the ability to choose door #2.
sowbug 10y ago
It would be interesting if companies had the legal obligation to fully open-source any software associated with hardware that they'd EOLed or abandoned. Not only could interested parties take up the cause of continuing support, but because the OEM would know that its hack-ridden source code would eventually be published, it might have an incentive to write better software to begin with. This might not be practical because the OEM couldn't include source to third-party components that aren't EOLed. But it would be a start.
swiley 10y ago
The user should be responsible for updating the firmware.

by luma 10y ago

walrus01 10y ago

At this time it appears the FTC is only going after the most egregiously shoddy practices, stuff that is basically new current generation stuff (consumer grade 802.11ac routers, etc) that goes unpatched after the vendor is notified. I would be really surprised if they started going after 3+ year old equipment after the fact, or small manufacturers. edit: D-Link has been famously shitty for a long time. At least among everyone I know who runs a 'serious' network, D-Link is seen as the exact polar opposite of a proper carrier grade switch or router... D-Link is to home routers as the Trabant is to automobiles.

patcheudor 10y ago
>edit: D-Link has been famously shitty for a long time. Some would say they took it to an entirely new level. Check out this disclosure from October of 2011: https://www.kb.cert.org/vuls/id/924307 https://www.kb.cert.org/vuls/id/924307 Summary: after receiving a burst of traffic it disabled WPA/2 and failed wide open. Apparently it was possible to trigger this fault with auth attempts so an attacker didn't even need to wait for someone on the WiFi to send a lot of data before it failed open. I don't even know how something fails like this. Brain hurts.
- r00fus 10y ago
  Gray's law applies - industrial-grade stupidity/incompetence is indistinguishable from evil. I'm glad D-Link are being slapped down.
  - patcheudor 10y ago
    And by indistinguishable from evil in this case you must wonder if it was some ill architected back door.
kosma 10y ago
> D-Link is to home routers as the Trabant is to automobiles Trabant was actually a very ingenious design that solved a real problem. D-Link is an analogy of a large car company producing, over decades, model after model of Trabant - each laden with the same old problems - while the rest of the industry moved forward.

freehunter 10y ago

I agree that there should be some kind of guideline on how long product support should be expected. As long as those guidelines are reasonable (90 days? 2 years? 5 years?) I don't think it should be considered onerous for anyone who is selling security-conscious products like networking equipment.

tantalor 10y ago

the company failed to protect its routers and cameras from widely known and reasonably foreseeable risks That's foreseeable, as in, before the sale.

repiret 10y ago

If I'm a dude in my workshop making children's toys, I'm on the hook for strict product liability the rest of my life in I made dangerous toys. If I'm a one man contractor building a house, certain categories of mistakes I'm on the hook for for the rest of my life. I don't think it would be unprecedented for IoT device makers to be on the hook forever for certain categories of security flaws. It is not like security flaws grow spontaneously like rust a car. They are all in there from the beginning, whether they are known or not. Most of the IOT security flaws that I have heard about could have been easily prevented with security conscious design and development practices. If we want to have secure IOT devices, then we need to hold people accountable for making insecure ones.

paulddraper 10y ago
Another example would be automobiles. Manufacturers do recalls and provide replaces more many, many years. Ford isn't on the hook for the Model T, but it does do recalls for decades-old Saturns.
- repiret 10y ago
  Although it is irrelevant to the point you're making, I feel I should point out that Saturn was a General Motors subsidiary, so it is not Ford that is making Saturn recalls.
  - paulddraper 10y ago
    Dammit, you're right. Gah. Well, yeah, in any case, even a defunct subsidiary (of GM, not Ford) is getting recalls decades later. High-tech has different standards than the rest of the world.
lostlogin 10y ago
One slight difference is that people actively try to do bad on a large scale with software while toys, cars and houses can be used nefariously but short of ramming your truck into a Christmas market, the scope for large scale damage is usually more limited.

sbov 10y ago

As a consumer, I would like for my devices to not be security nightmares for, at least, the useful life of what I'm buying. Unless you plaster a giant warning on the product, ~5 years from the time of sale seems reasonable to me for many tech related things.

bisby 10y ago
standard product lifetime seems reasonable. If IE6 has a security bug, the answer is "maybe use newer windows + edge". If xbox360 has a security bug, the answer might be "use xbox one". This could expand to a question of "what is the expected lifetime of a product"... is it when the replacement is released (dont like the security bugs? get camera 2.0!)?, is it when the new camera becomes standard (there are 1000000 camera 2.0s out there, and 100 camera 1.0... maybe you should get on board)? Or is it when the failure rate of the product is above a threshold (Your camera 1.0 is even still working? most of them had their CPUs burn out by now, dont expect an update, in fact you should be grateful/amazed its still running) Aging hardware is one thing ("modern security practices use a new cryptography algorithm that literally wont run on this device") but aging software is another ("we just dont want to update the software, buy our new product")

sigmar 10y ago

>“hard-coded” login credentials integrated into D-Link camera software -- such as the username “guest” and the password “guest” -- that could allow unauthorized access to the cameras’ live feed; This doesn't seem to be a complaint about future support, but security at the time it was sold.

throwaway729 10y ago
I think the rub is that all security bugs are bugs at the time of sale/update. Discovered or otherwise. But I agree with you here because at the time of sale, this feature was widely agreed upon to be a bad practice and was also a known feature. So it's not like someone discovered a clever 0-day DLink didn't know about. DLink knew what it was doing, knew that best practices said not to do the thing it was doing, and did that thing anyways.

Floegipoky 10y ago

I don't think the FTC is asserting that companies can't discontinue support for old products.

notheguyouthink 10y ago

This is all the more reason that we need standardized software/OSs for these IoThings. Not only do the companies not want to be on the line forever, but if they allow users to modify it in sane ways the users can do the work. Eg, if it's just small linux installations with a very basic http api in open source libs, it can probably be patched with relative ease. Instead, everyone is doing weird crap, everything is complex. I hate it as a user.

skybrian 10y ago

It seems like companies should be on the hook for recalls, but they should be able to outsource this, by buying some kind of insurance to cover the recall. Then it becomes the insurance company's job to assess the risk and price accordingly.

andrei_says_ 10y ago
In which case the cost of recalls would include the profit of insurance companies.

diggernet 10y ago

I think this is what I'd like to see... The manufacturer of the device is responsible for security updates forever. If at any time a security flaw is discovered in the device, they have two options: 1. Develop and deploy a fix at their own expense, and make it freely available to all owners of the device. 2. Publicly release all source code and documentation necessary for any third party to independently develop and deploy a fix. This way, any company which still cares about their customers, devices, patents, copyrights, etc which are involved will pay the expense of fixing the problem, as the cost of keeping that which they value. And any company which does NOT care about those things can simply walk away from it all at no cost to themselves. So, as a dude in your workshop, after n-years have passed and you feel the responsibility is too onerous, you opt for #2 and wash your hands of the mess. As an interesting side-effect, this opens up a business opportunity for source and documentation escrow services. Because if you've somehow managed to lose some or all of your source and documentation, you've also lost the ability to choose door #2.

sowbug 10y ago

It would be interesting if companies had the legal obligation to fully open-source any software associated with hardware that they'd EOLed or abandoned. Not only could interested parties take up the cause of continuing support, but because the OEM would know that its hack-ridden source code would eventually be published, it might have an incentive to write better software to begin with. This might not be practical because the OEM couldn't include source to third-party components that aren't EOLed. But it would be a start.

swiley 10y ago

The user should be responsible for updating the firmware.