4 ms·

The FTC is suing D-Link for "unfair or deceptive acts or practices in or affecting commerce" because they claimed their routers were secure, but then failed to

The FTC is suing D-Link for "unfair or deceptive acts or practices in or affecting commerce" because they claimed their routers were secure, but then failed to follow even the most rudimentary best practices. I imagine that if D-Link claims that their software was provided without any "warranties for fitness and damages", the FTC will argue that such a claim definitively proves that D-Link's marketing of their security features was unfair and a misrepresentation.

ChuckMcM 10y ago
I get that, but every software package I have ever bought explicitly disclaimed it would do anything in the EULA and TOS documents. So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product." Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies.
- throwaway729 10y ago
  > So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product."... Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies. They also need to prove material harm to consumers. So lawsuits will almost certainly focus on security, privacy, and outright fraud/theft. I really do not understand why this bothers people so much. Hire competent engineers. Follow best practices. It's really not that hard, and it's in your company's best interest anyways. (Also, since its come up in other sub-threads, the name of the FTC is the Federal TRADE Commission, and they regulate commerce. OSS projects that don't engage in commerce aren't subject to these regulations.)
  - ryao 10y ago
    The commoditization of this equipment means that any company doing things well would quickly be outmanuevered by those who do not care enough to do the same.
    - throwaway729 10y ago
      If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets. That's a strong motivator for regulatory intervention. But also, the sorts of minimum safeguards that are being requested by the FTC don't actually cost these companies anything more to implement. Requiring credential changes on first login? That's maybe 100 LoC. A basic once-over to catch any super obvious command injections in a relatively simple web UI? Maybe a day or two of engineering effort. Not posting private keys on a public website? Properly train one set of people and make them gatekeepers -- a bit of overhead, but again, extremely minimal when measured against overall product lifecycle costs. FTC isn't asking for formally verified secure kernels with locally sourced state-of-the-art crypto and in-depth end-user training by top psychologists. They're asking for very simple, easy to implement safeguards that a novice developer could implement in a few days. These companies surely spend more than the entire cost of compliance on executive retreats and office holiday parties... Device manufacturers do have to hire one or maybe two engineers who are competent at security. But it's not like those people necessarily cost more than whoever they have on payroll ATM. And in fact, it's likely that those people already are on payroll at these companies -- in which case, all they have to do is start prioritizing and listening to security-minded voices already in their organization.
cardiffspaceman 10y ago
I think, in support of this point you are making, the key is that the FTC is not in charge of the Internet, and doesn't have to be trying to protect the Internet with this action. Large-scale consumer frauds are more the thing the FTC goes after.

ChuckMcM 10y ago

I get that, but every software package I have ever bought explicitly disclaimed it would do anything in the EULA and TOS documents. So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product." Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies.

throwaway729 10y ago
> So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product."... Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies. They also need to prove material harm to consumers. So lawsuits will almost certainly focus on security, privacy, and outright fraud/theft. I really do not understand why this bothers people so much. Hire competent engineers. Follow best practices. It's really not that hard, and it's in your company's best interest anyways. (Also, since its come up in other sub-threads, the name of the FTC is the Federal TRADE Commission, and they regulate commerce. OSS projects that don't engage in commerce aren't subject to these regulations.)
- ryao 10y ago
  The commoditization of this equipment means that any company doing things well would quickly be outmanuevered by those who do not care enough to do the same.
  - throwaway729 10y ago
    If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets. That's a strong motivator for regulatory intervention. But also, the sorts of minimum safeguards that are being requested by the FTC don't actually cost these companies anything more to implement. Requiring credential changes on first login? That's maybe 100 LoC. A basic once-over to catch any super obvious command injections in a relatively simple web UI? Maybe a day or two of engineering effort. Not posting private keys on a public website? Properly train one set of people and make them gatekeepers -- a bit of overhead, but again, extremely minimal when measured against overall product lifecycle costs. FTC isn't asking for formally verified secure kernels with locally sourced state-of-the-art crypto and in-depth end-user training by top psychologists. They're asking for very simple, easy to implement safeguards that a novice developer could implement in a few days. These companies surely spend more than the entire cost of compliance on executive retreats and office holiday parties... Device manufacturers do have to hire one or maybe two engineers who are competent at security. But it's not like those people necessarily cost more than whoever they have on payroll ATM. And in fact, it's likely that those people already are on payroll at these companies -- in which case, all they have to do is start prioritizing and listening to security-minded voices already in their organization.

cardiffspaceman 10y ago

I think, in support of this point you are making, the key is that the FTC is not in charge of the Internet, and doesn't have to be trying to protect the Internet with this action. Large-scale consumer frauds are more the thing the FTC goes after.