4 ms·

> So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it

> So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product."... Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies. They also need to prove material harm to consumers. So lawsuits will almost certainly focus on security, privacy, and outright fraud/theft. I really do not understand why this bothers people so much. Hire competent engineers. Follow best practices. It's really not that hard, and it's in your company's best interest anyways. (Also, since its come up in other sub-threads, the name of the FTC is the Federal TRADE Commission, and they regulate commerce. OSS projects that don't engage in commerce aren't subject to these regulations.)

ryao 10y ago
The commoditization of this equipment means that any company doing things well would quickly be outmanuevered by those who do not care enough to do the same.
- throwaway729 10y ago
  If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets. That's a strong motivator for regulatory intervention. But also, the sorts of minimum safeguards that are being requested by the FTC don't actually cost these companies anything more to implement. Requiring credential changes on first login? That's maybe 100 LoC. A basic once-over to catch any super obvious command injections in a relatively simple web UI? Maybe a day or two of engineering effort. Not posting private keys on a public website? Properly train one set of people and make them gatekeepers -- a bit of overhead, but again, extremely minimal when measured against overall product lifecycle costs. FTC isn't asking for formally verified secure kernels with locally sourced state-of-the-art crypto and in-depth end-user training by top psychologists. They're asking for very simple, easy to implement safeguards that a novice developer could implement in a few days. These companies surely spend more than the entire cost of compliance on executive retreats and office holiday parties... Device manufacturers do have to hire one or maybe two engineers who are competent at security. But it's not like those people necessarily cost more than whoever they have on payroll ATM. And in fact, it's likely that those people already are on payroll at these companies -- in which case, all they have to do is start prioritizing and listening to security-minded voices already in their organization.

ryao 10y ago

The commoditization of this equipment means that any company doing things well would quickly be outmanuevered by those who do not care enough to do the same.

throwaway729 10y ago
If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets. That's a strong motivator for regulatory intervention. But also, the sorts of minimum safeguards that are being requested by the FTC don't actually cost these companies anything more to implement. Requiring credential changes on first login? That's maybe 100 LoC. A basic once-over to catch any super obvious command injections in a relatively simple web UI? Maybe a day or two of engineering effort. Not posting private keys on a public website? Properly train one set of people and make them gatekeepers -- a bit of overhead, but again, extremely minimal when measured against overall product lifecycle costs. FTC isn't asking for formally verified secure kernels with locally sourced state-of-the-art crypto and in-depth end-user training by top psychologists. They're asking for very simple, easy to implement safeguards that a novice developer could implement in a few days. These companies surely spend more than the entire cost of compliance on executive retreats and office holiday parties... Device manufacturers do have to hire one or maybe two engineers who are competent at security. But it's not like those people necessarily cost more than whoever they have on payroll ATM. And in fact, it's likely that those people already are on payroll at these companies -- in which case, all they have to do is start prioritizing and listening to security-minded voices already in their organization.