8 ms·

> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech Govs can do a lot of broad legislation r

by rapsey 10y ago

> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech Govs can do a lot of broad legislation rules that is non-specific. The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. - Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so. - Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices). - Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms. - Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine. - Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so.

sillysaurus3 10y ago
This would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse.
- PhasmaFelis 10y ago
  > Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.
  - dwaltrip 10y ago
    People starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.
    - ItendToDisagree 10y ago
      Please point out the graph and/or story that shows current startups raising the general standard of living for citizens in the middle/lower classes? (No. They can ride in a freelancer driven taxi is not raising the standard of living.)
      - TeMPOraL 10y ago
        Well, most of the things you enjoy today were at some point created by entrepreneurs starting companies; whether VC-funded startups (or whatever we called them in the past) or regular companies. There is a strong indication that the easier it is to start a profitable business, the more people will do so, create new products and services, and thus improve standards of living. But there need to be boundaries, because not every business model is good for society. As a thought experiment for those thinking it's better to have deregulated startups in high-tech industry, imagine taking down biosafety regulations. Think of all the biotech startups blooming...
- igk 10y ago
  What? No. If IoT (and important software in general) doesn't get some aggressive regulation, then people will die at some point. There were already cases where the heating went out in a whole town because of some connectivity issues ...I don't remember the details, but i think it was in Sweden. Medical devices, industrial machinery, power plants and at some point god forbidden nuclear plants. I flatly don't care about a startup getting shut down because they had shitty security, there will be another one. The people don't die from that in general. But if a person dies because of lack of regulations, or a strip of land gets contaminated, that is it. And instead of thinking about corporations being "extorted" for not fixing their shit, how about society having to deal with the fallout of shitty IoT security? DDOS paradise, possibly critical infrastructure being taken over etc If your business model breaks down if you are forced to do it properly, it was shit. Find a new one. Welcome to capitalism, it's nobodies job to make sure your company succeeds
  - sillysaurus3 10y ago
    Your position is very extreme. Extreme enough that I don't think it's a productive use of time to debate with you. Maybe tone it down a little, take a breath, and realize (a) that people are not in fact dying, and (b) if they do, we can deal with it then. The problem with all of these "People might die!" arguments is that everyone who makes them is always thoroughly convinced that they are right at all costs right now so just fix this!!! that it gets so tiresome. Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions.
    - igk 10y ago
      You are arguing against something I did not say. I never said we need to do it "at all costs right now so just fix this!!!". I am saying that I value the risk of human lives over the risk of some startups not being created. You didn't specify which part of my positions makes me extreme, so I will just address your a) and b), and your last sentence. b) is what I would call extreme. Yes, people die. But in the discussion "we should protect people" vs "we should't stiffle business", if one of your arguments is "we can deal with it if people dying" is pretty cold (this is me seeing the implied "but we can deal with it worse if startups fail" in this context, so you might want to correct me here) as for a) as far as I can tell, people have not died yet. But we see scenarios on how they could. I'll give examples with real life incidents as inspiration 1. Hacker wants to extort municipality, shuts of heating in winter: http://metropolitan.fi/entry/ddos-attack-halts-heating-in-finland-amidst-winter http://metropolitan.fi/entry/ddos-attack-halts-heating-in-fi... 2. Foreign interest wants to sabotage infrastructure, civilians get caught in collateral damage (also stuxnet) https://www.bloomberg.com/news/articles/2014-12-10/mysterious-08-turkey-pipeline-blast-opened-new-cyberwar https://www.bloomberg.com/news/articles/2014-12-10/mysteriou... 3. Competitor or hacker wants to extort company: https://www.wired.com/wp-content/uploads/2015/01/Lagebericht2014.pdf https://www.wired.com/wp-content/uploads/2015/01/Lagebericht... I would ask you, how many people have to die or how much damage needs to be caused before we but some basic security standards as regulation onto companies? Will one person suffice before I can make that argument? As for this: >Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions. 1. Yes we should, and then we will run out of lifetime because we cannot possibly think of everything. But I'll assume you didn't mean it literally. 2. Considering all relevant consequences I can think of(feel free to add any I forget): If we create a lower bound on security, mandate that all "consumer/industry grade" devices need to live up to that lower limit or face heavy fines, I see the following tings happening: * lots of stuff will not get created, because the margin would be gone. * there will be a new market for security middle ware, or a strengthening of the existing one * there would be a halt in the incrase of power of DDoS attacks * certifying your procuct as consumer or industry grade would need to be an efficient process and would probably add onto the cost of developing a product * GPl and open source software would have to be treated carefully. But if you start in IoT and not touch "classic" software, that can be managed. Probably the distinction between "consumer/industry grade" doesn't make sense for server software and would have to be shifted to the process, i.e. a company can use any software they want in their server AS LONG AS they make use of certain key technologies and industry best practices and have a good process in place. (yes this means no more SaaS without a security team...or a founder willing to learn that shit, or an new company providing that service. You could make an exception for revenue below 50k /year or something if you really want) That are the rough consequences I can see from regulation. Nothing too negative imo On your side, we have the status quo. With dishwashers running linux and having directory traversal vulns https://www.theregister.co.uk/2017/03/26/miele_joins_internetofst_hall_of_shame/ https://www.theregister.co.uk/2017/03/26/miele_joins_interne... companies ROUTINELY storing passwords, possibly without any good crypto and facing no consequences if stuff just stops working https://www.wired.com/2016/04/nests-hub-shutdown-proves-youre-crazy-buy-internet-things/ https://www.wired.com/2016/04/nests-hub-shutdown-proves-your... or if your data gets stolen because of their shitty practices
- kazagistar 10y ago
  Simple solution, fix CVEs in a timely manner.
- FridgeSeal 10y ago
  What? Are you serious? If some startups failing is the price we have to pay to get proper security around IoT devices then I'm all for it. Startups aren't the be-all-and-end-all of technology.
  - sillysaurus3 10y ago
    Actually, in many ways they are. It's one reason the US is in a superior position today vs other countries. Some technology would not happen at all without startups, such as airbnb. You don't need to go far to find reasons why regulation can be a terrible thing. Here's an example from five hours ago: https://news.ycombinator.com/item?id=14103008 https://news.ycombinator.com/item?id=14103008 If regulation is so bad, why are there so many people stamping out any opposition to regulation, and reacting with expressions of shock and disbelief that anyone could be against them? Because in recent years, it's become fashionable to hate business. You see it everywhere, from /r/LateStageCapitalism (a subreddit whose explicit purpose is to hate rich people the same way some people hate minorities), to the PR outrage at Uber (who certainly deserved it, but now everyone is gleefully waiting for Uber to burn), to this creeping distaste for anyone who would seriously consider startups' interests over the interests of the individual.
    - dagenleg 10y ago
      I sincerely hope you belong to the class of people making money off skimming regulations and immoral business practices. You know, one of the people who benefits from US being what US is. One of the 'rich people' Because if you are not, if you are actually one of the plebs, this adoration of the corporate boot and arguing against your interests as a customer is pretty sad.
      - sillysaurus3 10y ago
        I read 1984 when I was in my teens, and I remember being let down by it. It was so outlandishly comical that it was impossible to take it seriously. Then I was incredulous that more and more people were saying 1984 was starting to match reality. Remember the "daily hate"? That's pretty much what's going on here. Not only do people thoroughly enjoy the act of hating something, but entire communities form whose explicit purpose is to do this. And of course, no one wants to admit that they're hating people, so they construct comfortable euphemisms and say they're hating systems, not people. It's a "corporate boot," not a person. It's much easier to frame anyone who interrupts your daily hate as an outsider than to face the reality of what you're doing.
flukus 10y ago
Someone mentioned an idea I really want recently, a use by like label "this device will receive security updates until 1/1/2020" and "this device will receive updates 1/1/2018". We all hear how consumers don't care, but that's largely because they aren't given enough information to care.
- sametmax 10y ago
  Yeah sure. Like people are caring about Facebook so much right now because of all the informations they've been given about how dangerous this is ?
  - flukus 10y ago
    How about we do it so that I and anyone that cares can make an informed decision? Just because not everyone reads the nutritional information on food doesn't mean it's not worth having.
    - sametmax 10y ago
      Sure I don't mean we should not do it. You can't do without education. It's a mandatory condition. It's just not enough. People's priority is not to be actors in their society right now. They don't want to exercise the power they have, because that mean also taking the responsibility for it. I have no idea what the solution is to that problem though.
      - akie 10y ago
        One standard solution to the "tragedy of the commons" problem is to change the incentives such that the actors don't destroy the commons. Usually involves an external authority (i.e. government) to enforce though. Additionally, this is not a new or unique problem. Similar problems exist in the areas of car safety, flight safety or product safety. The way it's solved there is by enforcing safety standards and denying market access to products or services that don't meet those standards.
    - 10y ago
therealjumbo 10y ago
>> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech >Govs can do a lot of broad legislation rules that is non-specific. >The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. >- Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so. Just to play devil's advocate, I'll try to pick the harder cases, not the easy ones. Define unpatched. Does this include free to use websites? What about non-profits? What if a CVE does not exist? (yes you said for which patches exist, why is this an exception, how well is this exception going to hold up in the legislative session, and if it's not explicity made as a distinction, how is it going to hold up in court?) What about software I host for free and let you download, But the hosting software itself does not have CVEs? What about software I let you automatically download and automatically update, and is exposed to the internet from your machine, by default or by configuration, but is not installed by default? What if I'm the manufacturer of the device? What if I'm the manufacturer the device in the previous example I give access to install the software through my portal, but I don't own the software, nor have the ability (because I don't have the source) or the legal rights to patch it without the owner consent (ala iOS)? In this case I do have the legal right to remove it, how does that interplay with this? What if in the above scenario, the software manufacturer is outside your jurisdiction? How is that decision going to affect the software industry in your jurisdiction? >- Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices). How does that affect the right to repair if that was passed as a law? >- Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms. Who defines the standards, both for the hw RNG and the algos? The US gov't has been shown to be more or less subversive to good crypto. If you select another org, a nation state with said resources can just neuter that org by infiltration. How are you going to verify that the standards are actually being followed? Refer to the most recent question, Snowden, Reflections on Trusting Trust, and ultimately even if the end user had the source how does he verify that's what is actually being executed? Most end users won't go through this effort, but if nobody can, then your essentially not verifying anything. How do you verify compatibility for this standard? Generally standards that succeed, do so by defining a common sense test suite. Where does that fit in? >- Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine. Does the fine increase per day? Why or why not? If yes, how much and why that much? How much is the fine, is it based on revenue, profit, units shipped etc? How do you pick the amount of time? I bring this up mainly in reference to a) The Project Zero disclosures that seemingly didn't give Microsoft enough time, and yet if you don't set a deadline... b) What about products like Android that have security patches that aren't deployed to end users due to the product org, manufacturer apathy, and carrier blockades? Is there a fine, there was a patch... Who gets the fine? How do you levy it on firms in other jurisdictions that don't let you levy fines like China? What if the devices are meant to be offline for a certain period of time? How much is acceptable before a device needs to call home? Specifically, what about industries where the devices will eventually sync, but may not for an indefinite period of time (military, mining, heavy construction, anything done in the middle of nowhere)? What if not all devices are accounted for? More generally, how are you counting devices? Referring to the previous question, how do you count devices that were discarded by the owner, but not reported to the manufacturer? >- Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so. Define vendor. Software or Hardware? Does FOSS count? Otherwise same as previous. These questions are meant to get you thinking, not to be argumentative. edit: formatting
sametmax 10y ago
Cars kill people. At worst current IoT let a pirate control your light bulbs, see your heart beat or record your sleep patterns, waste your food and listen to your music. This won't interest anyone. For this to start seriously motivating people, you'll need: - even more numerous DDOS, with more expensive consequences. Companies are affected so they act. - scandals with naked people, preferably famous ones or underage, or both. People that gets the medias talking. - money stolen. A lot, to bother insurances. - people dying. Scaring the public always work. E.G: fire started by pirated IoT device. Otherwise nobody is gona bat an eye. We don't live in a world were most companies do the right thing because it's the right right. Remember that tobacco companies use to run ads to show you how cool your life is with cigarettes while lobbying the congress to state how non dangerous for health it was. Remember that people are putting their entire life on systems with text analysis, geolocation and face recognition and they don't see the big deal out of it. Remember that the government spies on every citizen, considers it perfectly acceptable, and that the citizen let it to. So really, the fact that your connected fridge has an open telnet port is not going to move anyone. You need damage done to get a reaction. Not potential damage.
- flukus 10y ago
  > Cars kill people. At worst current IoT let a pirate control your light bulbs, see your heart beat or record your sleep patterns, waste your food and listen to your music. Once you're home network is compromised it's much easier to infect other computers on it, a lot of IT people don't even run firewalls on PC's anymore. We largely rely on a single line of defense for home cyber security. A compromised device becomes a launch pad for a bunch of other attacks, like data collection and credit card theft. Imagine how many pedophile rings would love to remotely watch kids using a built in webcam? All without the family ever knowing. Or you could simply use them to stream illegal torrents.
  - sametmax 10y ago
    I said "Cars kill people", not "cars could kill people". You are talking about potential. People don't care about that. Potential that I mentioned by the way, with "scandals with naked people, preferably famous ones or underage, or both." They will care only once pedophiles will have watched THEIR kids using their web cam. Repeatedly. With media coverage. Not before.
dom0 10y ago
> The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. When did that ever happen?
arcbyte 10y ago
No. The government should NOT be doing any of this. Yuck
- rapsey 10y ago
  Your solid arguments have swayed me /s
rebuilder 10y ago
For the CVE points, I'd expect enforcement to be difficult. Might also create perverse incentives, like if you neglect to patch, it might be better to never patch in the hopes no-one notices, since patching late would draw attention to your not having done so promptly and result in fines. As for the automatic updates, personally, I view the vendor as the biggest threat. I'd prefer they didn't have any access to my gear. Which is one reason, in addition to just never having seen anything useful, I don't have "smart" appliances.
- rapsey 10y ago
  > For the CVE points, I'd expect enforcement to be difficult. Ever used kali linux? Have an gov org that is scanning for volnurabilities and fining companies. Not difficult at all.

by rapsey 10y ago

sillysaurus3 10y ago

This would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse.

PhasmaFelis 10y ago
> Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.
- dwaltrip 10y ago
  People starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.
  - ItendToDisagree 10y ago
    Please point out the graph and/or story that shows current startups raising the general standard of living for citizens in the middle/lower classes? (No. They can ride in a freelancer driven taxi is not raising the standard of living.)
    - TeMPOraL 10y ago
      Well, most of the things you enjoy today were at some point created by entrepreneurs starting companies; whether VC-funded startups (or whatever we called them in the past) or regular companies. There is a strong indication that the easier it is to start a profitable business, the more people will do so, create new products and services, and thus improve standards of living. But there need to be boundaries, because not every business model is good for society. As a thought experiment for those thinking it's better to have deregulated startups in high-tech industry, imagine taking down biosafety regulations. Think of all the biotech startups blooming...
igk 10y ago
What? No. If IoT (and important software in general) doesn't get some aggressive regulation, then people will die at some point. There were already cases where the heating went out in a whole town because of some connectivity issues ...I don't remember the details, but i think it was in Sweden. Medical devices, industrial machinery, power plants and at some point god forbidden nuclear plants. I flatly don't care about a startup getting shut down because they had shitty security, there will be another one. The people don't die from that in general. But if a person dies because of lack of regulations, or a strip of land gets contaminated, that is it. And instead of thinking about corporations being "extorted" for not fixing their shit, how about society having to deal with the fallout of shitty IoT security? DDOS paradise, possibly critical infrastructure being taken over etc If your business model breaks down if you are forced to do it properly, it was shit. Find a new one. Welcome to capitalism, it's nobodies job to make sure your company succeeds
- sillysaurus3 10y ago
  Your position is very extreme. Extreme enough that I don't think it's a productive use of time to debate with you. Maybe tone it down a little, take a breath, and realize (a) that people are not in fact dying, and (b) if they do, we can deal with it then. The problem with all of these "People might die!" arguments is that everyone who makes them is always thoroughly convinced that they are right at all costs right now so just fix this!!! that it gets so tiresome. Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions.
  - igk 10y ago
    You are arguing against something I did not say. I never said we need to do it "at all costs right now so just fix this!!!". I am saying that I value the risk of human lives over the risk of some startups not being created. You didn't specify which part of my positions makes me extreme, so I will just address your a) and b), and your last sentence. b) is what I would call extreme. Yes, people die. But in the discussion "we should protect people" vs "we should't stiffle business", if one of your arguments is "we can deal with it if people dying" is pretty cold (this is me seeing the implied "but we can deal with it worse if startups fail" in this context, so you might want to correct me here) as for a) as far as I can tell, people have not died yet. But we see scenarios on how they could. I'll give examples with real life incidents as inspiration 1. Hacker wants to extort municipality, shuts of heating in winter: http://metropolitan.fi/entry/ddos-attack-halts-heating-in-finland-amidst-winter http://metropolitan.fi/entry/ddos-attack-halts-heating-in-fi... 2. Foreign interest wants to sabotage infrastructure, civilians get caught in collateral damage (also stuxnet) https://www.bloomberg.com/news/articles/2014-12-10/mysterious-08-turkey-pipeline-blast-opened-new-cyberwar https://www.bloomberg.com/news/articles/2014-12-10/mysteriou... 3. Competitor or hacker wants to extort company: https://www.wired.com/wp-content/uploads/2015/01/Lagebericht2014.pdf https://www.wired.com/wp-content/uploads/2015/01/Lagebericht... I would ask you, how many people have to die or how much damage needs to be caused before we but some basic security standards as regulation onto companies? Will one person suffice before I can make that argument? As for this: >Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions. 1. Yes we should, and then we will run out of lifetime because we cannot possibly think of everything. But I'll assume you didn't mean it literally. 2. Considering all relevant consequences I can think of(feel free to add any I forget): If we create a lower bound on security, mandate that all "consumer/industry grade" devices need to live up to that lower limit or face heavy fines, I see the following tings happening: * lots of stuff will not get created, because the margin would be gone. * there will be a new market for security middle ware, or a strengthening of the existing one * there would be a halt in the incrase of power of DDoS attacks * certifying your procuct as consumer or industry grade would need to be an efficient process and would probably add onto the cost of developing a product * GPl and open source software would have to be treated carefully. But if you start in IoT and not touch "classic" software, that can be managed. Probably the distinction between "consumer/industry grade" doesn't make sense for server software and would have to be shifted to the process, i.e. a company can use any software they want in their server AS LONG AS they make use of certain key technologies and industry best practices and have a good process in place. (yes this means no more SaaS without a security team...or a founder willing to learn that shit, or an new company providing that service. You could make an exception for revenue below 50k /year or something if you really want) That are the rough consequences I can see from regulation. Nothing too negative imo On your side, we have the status quo. With dishwashers running linux and having directory traversal vulns https://www.theregister.co.uk/2017/03/26/miele_joins_internetofst_hall_of_shame/ https://www.theregister.co.uk/2017/03/26/miele_joins_interne... companies ROUTINELY storing passwords, possibly without any good crypto and facing no consequences if stuff just stops working https://www.wired.com/2016/04/nests-hub-shutdown-proves-youre-crazy-buy-internet-things/ https://www.wired.com/2016/04/nests-hub-shutdown-proves-your... or if your data gets stolen because of their shitty practices
kazagistar 10y ago
Simple solution, fix CVEs in a timely manner.
FridgeSeal 10y ago
What? Are you serious? If some startups failing is the price we have to pay to get proper security around IoT devices then I'm all for it. Startups aren't the be-all-and-end-all of technology.
- sillysaurus3 10y ago
  Actually, in many ways they are. It's one reason the US is in a superior position today vs other countries. Some technology would not happen at all without startups, such as airbnb. You don't need to go far to find reasons why regulation can be a terrible thing. Here's an example from five hours ago: https://news.ycombinator.com/item?id=14103008 https://news.ycombinator.com/item?id=14103008 If regulation is so bad, why are there so many people stamping out any opposition to regulation, and reacting with expressions of shock and disbelief that anyone could be against them? Because in recent years, it's become fashionable to hate business. You see it everywhere, from /r/LateStageCapitalism (a subreddit whose explicit purpose is to hate rich people the same way some people hate minorities), to the PR outrage at Uber (who certainly deserved it, but now everyone is gleefully waiting for Uber to burn), to this creeping distaste for anyone who would seriously consider startups' interests over the interests of the individual.
  - dagenleg 10y ago
    I sincerely hope you belong to the class of people making money off skimming regulations and immoral business practices. You know, one of the people who benefits from US being what US is. One of the 'rich people' Because if you are not, if you are actually one of the plebs, this adoration of the corporate boot and arguing against your interests as a customer is pretty sad.
    - sillysaurus3 10y ago
      I read 1984 when I was in my teens, and I remember being let down by it. It was so outlandishly comical that it was impossible to take it seriously. Then I was incredulous that more and more people were saying 1984 was starting to match reality. Remember the "daily hate"? That's pretty much what's going on here. Not only do people thoroughly enjoy the act of hating something, but entire communities form whose explicit purpose is to do this. And of course, no one wants to admit that they're hating people, so they construct comfortable euphemisms and say they're hating systems, not people. It's a "corporate boot," not a person. It's much easier to frame anyone who interrupts your daily hate as an outsider than to face the reality of what you're doing.

flukus 10y ago

Someone mentioned an idea I really want recently, a use by like label "this device will receive security updates until 1/1/2020" and "this device will receive updates 1/1/2018". We all hear how consumers don't care, but that's largely because they aren't given enough information to care.

sametmax 10y ago
Yeah sure. Like people are caring about Facebook so much right now because of all the informations they've been given about how dangerous this is ?
- flukus 10y ago
  How about we do it so that I and anyone that cares can make an informed decision? Just because not everyone reads the nutritional information on food doesn't mean it's not worth having.
  - sametmax 10y ago
    Sure I don't mean we should not do it. You can't do without education. It's a mandatory condition. It's just not enough. People's priority is not to be actors in their society right now. They don't want to exercise the power they have, because that mean also taking the responsibility for it. I have no idea what the solution is to that problem though.
    - akie 10y ago
      One standard solution to the "tragedy of the commons" problem is to change the incentives such that the actors don't destroy the commons. Usually involves an external authority (i.e. government) to enforce though. Additionally, this is not a new or unique problem. Similar problems exist in the areas of car safety, flight safety or product safety. The way it's solved there is by enforcing safety standards and denying market access to products or services that don't meet those standards.
  - 10y ago

therealjumbo 10y ago

>> It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech >Govs can do a lot of broad legislation rules that is non-specific. >The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. >- Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so. Just to play devil's advocate, I'll try to pick the harder cases, not the easy ones. Define unpatched. Does this include free to use websites? What about non-profits? What if a CVE does not exist? (yes you said for which patches exist, why is this an exception, how well is this exception going to hold up in the legislative session, and if it's not explicity made as a distinction, how is it going to hold up in court?) What about software I host for free and let you download, But the hosting software itself does not have CVEs? What about software I let you automatically download and automatically update, and is exposed to the internet from your machine, by default or by configuration, but is not installed by default? What if I'm the manufacturer of the device? What if I'm the manufacturer the device in the previous example I give access to install the software through my portal, but I don't own the software, nor have the ability (because I don't have the source) or the legal rights to patch it without the owner consent (ala iOS)? In this case I do have the legal right to remove it, how does that interplay with this? What if in the above scenario, the software manufacturer is outside your jurisdiction? How is that decision going to affect the software industry in your jurisdiction? >- Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices). How does that affect the right to repair if that was passed as a law? >- Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms. Who defines the standards, both for the hw RNG and the algos? The US gov't has been shown to be more or less subversive to good crypto. If you select another org, a nation state with said resources can just neuter that org by infiltration. How are you going to verify that the standards are actually being followed? Refer to the most recent question, Snowden, Reflections on Trusting Trust, and ultimately even if the end user had the source how does he verify that's what is actually being executed? Most end users won't go through this effort, but if nobody can, then your essentially not verifying anything. How do you verify compatibility for this standard? Generally standards that succeed, do so by defining a common sense test suite. Where does that fit in? >- Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine. Does the fine increase per day? Why or why not? If yes, how much and why that much? How much is the fine, is it based on revenue, profit, units shipped etc? How do you pick the amount of time? I bring this up mainly in reference to a) The Project Zero disclosures that seemingly didn't give Microsoft enough time, and yet if you don't set a deadline... b) What about products like Android that have security patches that aren't deployed to end users due to the product org, manufacturer apathy, and carrier blockades? Is there a fine, there was a patch... Who gets the fine? How do you levy it on firms in other jurisdictions that don't let you levy fines like China? What if the devices are meant to be offline for a certain period of time? How much is acceptable before a device needs to call home? Specifically, what about industries where the devices will eventually sync, but may not for an indefinite period of time (military, mining, heavy construction, anything done in the middle of nowhere)? What if not all devices are accounted for? More generally, how are you counting devices? Referring to the previous question, how do you count devices that were discarded by the owner, but not reported to the manufacturer? >- Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so. Define vendor. Software or Hardware? Does FOSS count? Otherwise same as previous. These questions are meant to get you thinking, not to be argumentative. edit: formatting

sametmax 10y ago

Cars kill people. At worst current IoT let a pirate control your light bulbs, see your heart beat or record your sleep patterns, waste your food and listen to your music. This won't interest anyone. For this to start seriously motivating people, you'll need: - even more numerous DDOS, with more expensive consequences. Companies are affected so they act. - scandals with naked people, preferably famous ones or underage, or both. People that gets the medias talking. - money stolen. A lot, to bother insurances. - people dying. Scaring the public always work. E.G: fire started by pirated IoT device. Otherwise nobody is gona bat an eye. We don't live in a world were most companies do the right thing because it's the right right. Remember that tobacco companies use to run ads to show you how cool your life is with cigarettes while lobbying the congress to state how non dangerous for health it was. Remember that people are putting their entire life on systems with text analysis, geolocation and face recognition and they don't see the big deal out of it. Remember that the government spies on every citizen, considers it perfectly acceptable, and that the citizen let it to. So really, the fact that your connected fridge has an open telnet port is not going to move anyone. You need damage done to get a reaction. Not potential damage.

flukus 10y ago
> Cars kill people. At worst current IoT let a pirate control your light bulbs, see your heart beat or record your sleep patterns, waste your food and listen to your music. Once you're home network is compromised it's much easier to infect other computers on it, a lot of IT people don't even run firewalls on PC's anymore. We largely rely on a single line of defense for home cyber security. A compromised device becomes a launch pad for a bunch of other attacks, like data collection and credit card theft. Imagine how many pedophile rings would love to remotely watch kids using a built in webcam? All without the family ever knowing. Or you could simply use them to stream illegal torrents.
- sametmax 10y ago
  I said "Cars kill people", not "cars could kill people". You are talking about potential. People don't care about that. Potential that I mentioned by the way, with "scandals with naked people, preferably famous ones or underage, or both." They will care only once pedophiles will have watched THEIR kids using their web cam. Repeatedly. With media coverage. Not before.

dom0 10y ago

> The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better. When did that ever happen?

arcbyte 10y ago

No. The government should NOT be doing any of this. Yuck

rapsey 10y ago
Your solid arguments have swayed me /s

rebuilder 10y ago

For the CVE points, I'd expect enforcement to be difficult. Might also create perverse incentives, like if you neglect to patch, it might be better to never patch in the hopes no-one notices, since patching late would draw attention to your not having done so promptly and result in fines. As for the automatic updates, personally, I view the vendor as the biggest threat. I'd prefer they didn't have any access to my gear. Which is one reason, in addition to just never having seen anything useful, I don't have "smart" appliances.

rapsey 10y ago
> For the CVE points, I'd expect enforcement to be difficult. Ever used kali linux? Have an gov org that is scanning for volnurabilities and fining companies. Not difficult at all.