4 ms·

Now if only ISPs could start notifying/disconnecting compromised users until they fix their shit.

willholloway 10y ago
I think that this is the layer where this problem should be dealt with at. What we are in for right now is burdensome, expensive and vague regulation that amounts to security theater.
wmf 10y ago
So the customer throws away every networked device in their home (because they have no idea which one got them banned) and buys new ones from different vendors... which are also insecure and result in their ISP banning them again? And ISP bills go up to cover the massive security scanning infrastructure needed?
- justinsaccount 10y ago
  > So the customer throws away every networked device in their home (because they have no idea which one got them banned) If a breaker in your kitchen trips do you throw out every single appliance? If your water bill is high do you replace every single sink and toilet? > and buys new ones from different vendors... which are also insecure Maybe after getting burned by purchasing insecure unsupported devices they find out what vendors support their products and don't ship devices with unfixable backdoors before buying new ones? > And ISP bills go up to cover the massive security scanning infrastructure needed? A bunch of $30 cameras can scan and infect the entire internet, what makes you think the infrastructure needed to find these devices is massive? ISPs already have everything they need to find out which of their customers are compromised, they just don't give a shit.
- rasz_pl 10y ago
  and where is the downside?
hackuser 10y ago
I'm thinking of an elderly couple I know; they have no hope of fixing these problems and it's not reasonable to expect otherwise. They shouldn't have to fix them; the people who make the products should do it.
- justinsaccount 10y ago
  And the people who have these devices are not going to even care about fixing their devices until their ISP disconnects them for spewing crap onto the internet. I've been saying for 10+ years that there needs to be something like the DMCA for accountability for security issues. A copyright owner can send a takedown notice to an ISP alleging infringement and have action taken, but I can't do anything about the 1,000,000 hosts that scan the shit out of us every day.
  - hackuser 10y ago
    > the people who have these devices are not going to even care about fixing their devices until their ISP disconnects them for spewing crap onto the internet It's not a matter of caring; there is nothing they can do about it. They don't know what "device" is causing a problem, how that could even happen, which electronics are even connected to the Internet, how something could be connected to the Internet, or even what "Internet" or "electronics" mean. They don't know what a web browser is and do not understand what a webpage is. Abusing innocent people doesn't solve the problem and, more importantly, is unjust.
  - Dylan16807 10y ago
    Why do you care about being scanned, though?

I think that this is the layer where this problem should be dealt with at. What we are in for right now is burdensome, expensive and vague regulation that amounts to security theater.

wmf 10y ago

So the customer throws away every networked device in their home (because they have no idea which one got them banned) and buys new ones from different vendors... which are also insecure and result in their ISP banning them again? And ISP bills go up to cover the massive security scanning infrastructure needed?

justinsaccount 10y ago
> So the customer throws away every networked device in their home (because they have no idea which one got them banned) If a breaker in your kitchen trips do you throw out every single appliance? If your water bill is high do you replace every single sink and toilet? > and buys new ones from different vendors... which are also insecure Maybe after getting burned by purchasing insecure unsupported devices they find out what vendors support their products and don't ship devices with unfixable backdoors before buying new ones? > And ISP bills go up to cover the massive security scanning infrastructure needed? A bunch of $30 cameras can scan and infect the entire internet, what makes you think the infrastructure needed to find these devices is massive? ISPs already have everything they need to find out which of their customers are compromised, they just don't give a shit.
rasz_pl 10y ago
and where is the downside?

hackuser 10y ago

I'm thinking of an elderly couple I know; they have no hope of fixing these problems and it's not reasonable to expect otherwise. They shouldn't have to fix them; the people who make the products should do it.

justinsaccount 10y ago
And the people who have these devices are not going to even care about fixing their devices until their ISP disconnects them for spewing crap onto the internet. I've been saying for 10+ years that there needs to be something like the DMCA for accountability for security issues. A copyright owner can send a takedown notice to an ISP alleging infringement and have action taken, but I can't do anything about the 1,000,000 hosts that scan the shit out of us every day.
- hackuser 10y ago
  > the people who have these devices are not going to even care about fixing their devices until their ISP disconnects them for spewing crap onto the internet It's not a matter of caring; there is nothing they can do about it. They don't know what "device" is causing a problem, how that could even happen, which electronics are even connected to the Internet, how something could be connected to the Internet, or even what "Internet" or "electronics" mean. They don't know what a web browser is and do not understand what a webpage is. Abusing innocent people doesn't solve the problem and, more importantly, is unjust.
- Dylan16807 10y ago
  Why do you care about being scanned, though?