5 ms·

The trouble with your analogy is that state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could

by luma 10y ago

The trouble with your analogy is that state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time. I get that D-Link sucks, and their security practices right out of the box were "bad", but what is "bad"? In the eyes of the FTC and US law, what constitutes "good" and "bad" practice? How do I ensure that I am holding myself to those practices when a product ships? What is my responsibility for vulnerabilities found after the product shipped? Let's say for example I ship a widget with an IP address and something like Heartbleed shows up 4 years later and my device is vulnerable. Am I on the hook for patching all the systems in the field? What are my obligations here?

throwaway729 10y ago
> state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time. I'm not so sure that's true anymore. Lots of kid's toys are internet-connected these days...
oh_sigh 10y ago
Did you read the article? > the FTC says the company failed to protect its routers and cameras from widely known and reasonably foreseeable risks. It sounds like they shipped the devices with known security flaws. This is not at all related to not updating your software when new security flaws are found.
- jdmichal 10y ago
  Just a heads up, from HN guidelines: > Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." I agree here. Your first sentence can be entirely removed and your point will still stand. Except now the receiver won't have to be in a defensive position about their reading comprehension.
sigmar 10y ago
>Am I on the hook for patching all the systems in the field? What are my obligations here? This complaint seems to have nothing to do with patching. Did you check out any of the actual text? Their complaints are about disregarding security norms from 2007 (backdoors, injection flaws), using hard-coded passwords, and posting their private signing key publicly.
zardo 10y ago
>The trouble with your analogy is that state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time. Human society is continually striving to build a better idiot. Manufacturers often aren't held liable or for the first instances of idiocy, but eventually they are. For example, it was easy for engineers to believe that no one would be dumb enough to stick their hand in a running lawnmower. And for a time if you stuck your hand in a running lawnmower you would not be able to win a lawsuit over it. But once you know about the new flavor of idiocy, it is your civic responsibility to mitigate it with safety features if possible. If you don't agree, the civil suit you lose will convince you. If you build products that are vulnerable in well known ways, you are neglecting your civic repsonsbility as a manufacturer.
- noobiemcfoob 10y ago
  I see you using the phrase "civic responsibility", but I don't actually see an argument for it.
  - zardo 10y ago
    >If you don't agree, the civil suit you lose will convince you. There you go. This is how you deal with the trajedy of the commons, punish the overgrazers. Industries that neglect civic responsibility get regulated. Particularly bad actors get punished.
  - broahmed 10y ago
    I apologize if this comes across as combative: does one need an argument that mitigating well-known safety or security hazards in a product you're making is a civic responsibility?
    - noobiemcfoob 10y ago
      Yes. I don't take it as a given that a manufacturer is responsible for the product they manufacture. If they manufacturer promises certain things about that product, then yes, they should be held to those promises. Otherwise, what makes it so obvious that the manufacturer must handle anything at all?
Frondo 10y ago
No, they're not state-sponsored teams... they're children, they're far more pernicious than black hat teams, and there's a ton more of them. ;) The questions you're asking are good ones, and they're ones that we as a society need to start answering. 20 years ago, the idea of always-connected devices littering our homes would've seemed like sci-fi magic, but now it's actually coming commonplace. But this isn't the first time we've had this sort of thing happen. Like, how did electronics gadgets become safe enough that we never think twice about the fire hazard of plugging in a mystery wall wart? Or any kind of product. What we've come up with is, generally speaking, companies have to try to uphold a standard, they can be held liable, and can be put out of business for making unsafe products. Why it should be any different just because it's a "now with Internet!" product, I don't really know.
- jeffdavis 10y ago
  I think the difference is protecting something against mistakes vs malice. In other words, a better safety analogy might be the prompt when you do "rm -rf". I'm not opposed to introducing standards here; I am just saying that it's adofferent problem.
- Klathmon 10y ago
  But IMO this isn't a "safety" issue with the devices themselves that could hurt the users unintentionally, this is a 3rd party "weaponizing" the system for their own use. I'm struggling think of a good analogy, but it seems more like suing Ford because thieves can easily steal their cars for use in robberies. In essence, the device is being used by an unauthorized 3rd party to harm a 4th party. The device owner in some cases is never harmed or even inconvenienced, and neither is the manufacturer. It's a shitty situation, and I don't personally know where the line should be drawn, but IMO it should be drawn clearly.
  - baq 10y ago
    i'd compare it to freon and freon using devices which had to be properly utilized or the ozone layer got hurt, only now substitute freon for 'product with ability to connect to the internet that doesn't get security updates anymore'. such devices should be disconnected from any non-air-gapped network or they're a considerable risk for their environment (the internet).
deleted 10y ago
[deleted]
kuschku 10y ago
> Am I on the hook for patching all the systems in the field? What are my obligations here? If you sell even a single device to Europe, you have, depending on category, for 2 or 5 years to patch every single flaw that appears. In the first 6 months, if a user reports a flaw, you have to patch it anyway, no matter what it is, unless you can prove that this problem was caused by the user. After that, you are liable for the rest of your life (and this pierces the corporate veil) for any and all damage your products do, or can be abused for.

by luma 10y ago

throwaway729 10y ago

> state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time. I'm not so sure that's true anymore. Lots of kid's toys are internet-connected these days...

oh_sigh 10y ago

Did you read the article? > the FTC says the company failed to protect its routers and cameras from widely known and reasonably foreseeable risks. It sounds like they shipped the devices with known security flaws. This is not at all related to not updating your software when new security flaws are found.

jdmichal 10y ago
Just a heads up, from HN guidelines: > Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." I agree here. Your first sentence can be entirely removed and your point will still stand. Except now the receiver won't have to be in a defensive position about their reading comprehension.

sigmar 10y ago

>Am I on the hook for patching all the systems in the field? What are my obligations here? This complaint seems to have nothing to do with patching. Did you check out any of the actual text? Their complaints are about disregarding security norms from 2007 (backdoors, injection flaws), using hard-coded passwords, and posting their private signing key publicly.

zardo 10y ago

>The trouble with your analogy is that state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time. Human society is continually striving to build a better idiot. Manufacturers often aren't held liable or for the first instances of idiocy, but eventually they are. For example, it was easy for engineers to believe that no one would be dumb enough to stick their hand in a running lawnmower. And for a time if you stuck your hand in a running lawnmower you would not be able to win a lawsuit over it. But once you know about the new flavor of idiocy, it is your civic responsibility to mitigate it with safety features if possible. If you don't agree, the civil suit you lose will convince you. If you build products that are vulnerable in well known ways, you are neglecting your civic repsonsbility as a manufacturer.

noobiemcfoob 10y ago
I see you using the phrase "civic responsibility", but I don't actually see an argument for it.
- zardo 10y ago
  >If you don't agree, the civil suit you lose will convince you. There you go. This is how you deal with the trajedy of the commons, punish the overgrazers. Industries that neglect civic responsibility get regulated. Particularly bad actors get punished.
- broahmed 10y ago
  I apologize if this comes across as combative: does one need an argument that mitigating well-known safety or security hazards in a product you're making is a civic responsibility?
  - noobiemcfoob 10y ago
    Yes. I don't take it as a given that a manufacturer is responsible for the product they manufacture. If they manufacturer promises certain things about that product, then yes, they should be held to those promises. Otherwise, what makes it so obvious that the manufacturer must handle anything at all?

Frondo 10y ago

No, they're not state-sponsored teams... they're children, they're far more pernicious than black hat teams, and there's a ton more of them. ;) The questions you're asking are good ones, and they're ones that we as a society need to start answering. 20 years ago, the idea of always-connected devices littering our homes would've seemed like sci-fi magic, but now it's actually coming commonplace. But this isn't the first time we've had this sort of thing happen. Like, how did electronics gadgets become safe enough that we never think twice about the fire hazard of plugging in a mystery wall wart? Or any kind of product. What we've come up with is, generally speaking, companies have to try to uphold a standard, they can be held liable, and can be put out of business for making unsafe products. Why it should be any different just because it's a "now with Internet!" product, I don't really know.

jeffdavis 10y ago
I think the difference is protecting something against mistakes vs malice. In other words, a better safety analogy might be the prompt when you do "rm -rf". I'm not opposed to introducing standards here; I am just saying that it's adofferent problem.
Klathmon 10y ago
But IMO this isn't a "safety" issue with the devices themselves that could hurt the users unintentionally, this is a 3rd party "weaponizing" the system for their own use. I'm struggling think of a good analogy, but it seems more like suing Ford because thieves can easily steal their cars for use in robberies. In essence, the device is being used by an unauthorized 3rd party to harm a 4th party. The device owner in some cases is never harmed or even inconvenienced, and neither is the manufacturer. It's a shitty situation, and I don't personally know where the line should be drawn, but IMO it should be drawn clearly.
- baq 10y ago
  i'd compare it to freon and freon using devices which had to be properly utilized or the ozone layer got hurt, only now substitute freon for 'product with ability to connect to the internet that doesn't get security updates anymore'. such devices should be disconnected from any non-air-gapped network or they're a considerable risk for their environment (the internet).

deleted 10y ago

[deleted]

kuschku 10y ago

> Am I on the hook for patching all the systems in the field? What are my obligations here? If you sell even a single device to Europe, you have, depending on category, for 2 or 5 years to patch every single flaw that appears. In the first 6 months, if a user reports a flaw, you have to patch it anyway, no matter what it is, unless you can prove that this problem was caused by the user. After that, you are liable for the rest of your life (and this pierces the corporate veil) for any and all damage your products do, or can be abused for.