7 ms·

This would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pr

This would have the wonderful effect of making the CVE yet another tool that can hold corporations hostage in exchange for money. Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse.

PhasmaFelis 10y ago
> Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.
- dwaltrip 10y ago
  People starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.
  - ItendToDisagree 10y ago
    Please point out the graph and/or story that shows current startups raising the general standard of living for citizens in the middle/lower classes? (No. They can ride in a freelancer driven taxi is not raising the standard of living.)
    - TeMPOraL 10y ago
      Well, most of the things you enjoy today were at some point created by entrepreneurs starting companies; whether VC-funded startups (or whatever we called them in the past) or regular companies. There is a strong indication that the easier it is to start a profitable business, the more people will do so, create new products and services, and thus improve standards of living. But there need to be boundaries, because not every business model is good for society. As a thought experiment for those thinking it's better to have deregulated startups in high-tech industry, imagine taking down biosafety regulations. Think of all the biotech startups blooming...
igk 10y ago
What? No. If IoT (and important software in general) doesn't get some aggressive regulation, then people will die at some point. There were already cases where the heating went out in a whole town because of some connectivity issues ...I don't remember the details, but i think it was in Sweden. Medical devices, industrial machinery, power plants and at some point god forbidden nuclear plants. I flatly don't care about a startup getting shut down because they had shitty security, there will be another one. The people don't die from that in general. But if a person dies because of lack of regulations, or a strip of land gets contaminated, that is it. And instead of thinking about corporations being "extorted" for not fixing their shit, how about society having to deal with the fallout of shitty IoT security? DDOS paradise, possibly critical infrastructure being taken over etc If your business model breaks down if you are forced to do it properly, it was shit. Find a new one. Welcome to capitalism, it's nobodies job to make sure your company succeeds
- sillysaurus3 10y ago
  Your position is very extreme. Extreme enough that I don't think it's a productive use of time to debate with you. Maybe tone it down a little, take a breath, and realize (a) that people are not in fact dying, and (b) if they do, we can deal with it then. The problem with all of these "People might die!" arguments is that everyone who makes them is always thoroughly convinced that they are right at all costs right now so just fix this!!! that it gets so tiresome. Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions.
  - igk 10y ago
    You are arguing against something I did not say. I never said we need to do it "at all costs right now so just fix this!!!". I am saying that I value the risk of human lives over the risk of some startups not being created. You didn't specify which part of my positions makes me extreme, so I will just address your a) and b), and your last sentence. b) is what I would call extreme. Yes, people die. But in the discussion "we should protect people" vs "we should't stiffle business", if one of your arguments is "we can deal with it if people dying" is pretty cold (this is me seeing the implied "but we can deal with it worse if startups fail" in this context, so you might want to correct me here) as for a) as far as I can tell, people have not died yet. But we see scenarios on how they could. I'll give examples with real life incidents as inspiration 1. Hacker wants to extort municipality, shuts of heating in winter: http://metropolitan.fi/entry/ddos-attack-halts-heating-in-finland-amidst-winter http://metropolitan.fi/entry/ddos-attack-halts-heating-in-fi... 2. Foreign interest wants to sabotage infrastructure, civilians get caught in collateral damage (also stuxnet) https://www.bloomberg.com/news/articles/2014-12-10/mysterious-08-turkey-pipeline-blast-opened-new-cyberwar https://www.bloomberg.com/news/articles/2014-12-10/mysteriou... 3. Competitor or hacker wants to extort company: https://www.wired.com/wp-content/uploads/2015/01/Lagebericht2014.pdf https://www.wired.com/wp-content/uploads/2015/01/Lagebericht... I would ask you, how many people have to die or how much damage needs to be caused before we but some basic security standards as regulation onto companies? Will one person suffice before I can make that argument? As for this: >Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions. 1. Yes we should, and then we will run out of lifetime because we cannot possibly think of everything. But I'll assume you didn't mean it literally. 2. Considering all relevant consequences I can think of(feel free to add any I forget): If we create a lower bound on security, mandate that all "consumer/industry grade" devices need to live up to that lower limit or face heavy fines, I see the following tings happening: * lots of stuff will not get created, because the margin would be gone. * there will be a new market for security middle ware, or a strengthening of the existing one * there would be a halt in the incrase of power of DDoS attacks * certifying your procuct as consumer or industry grade would need to be an efficient process and would probably add onto the cost of developing a product * GPl and open source software would have to be treated carefully. But if you start in IoT and not touch "classic" software, that can be managed. Probably the distinction between "consumer/industry grade" doesn't make sense for server software and would have to be shifted to the process, i.e. a company can use any software they want in their server AS LONG AS they make use of certain key technologies and industry best practices and have a good process in place. (yes this means no more SaaS without a security team...or a founder willing to learn that shit, or an new company providing that service. You could make an exception for revenue below 50k /year or something if you really want) That are the rough consequences I can see from regulation. Nothing too negative imo On your side, we have the status quo. With dishwashers running linux and having directory traversal vulns https://www.theregister.co.uk/2017/03/26/miele_joins_internetofst_hall_of_shame/ https://www.theregister.co.uk/2017/03/26/miele_joins_interne... companies ROUTINELY storing passwords, possibly without any good crypto and facing no consequences if stuff just stops working https://www.wired.com/2016/04/nests-hub-shutdown-proves-youre-crazy-buy-internet-things/ https://www.wired.com/2016/04/nests-hub-shutdown-proves-your... or if your data gets stolen because of their shitty practices
kazagistar 10y ago
Simple solution, fix CVEs in a timely manner.
FridgeSeal 10y ago
What? Are you serious? If some startups failing is the price we have to pay to get proper security around IoT devices then I'm all for it. Startups aren't the be-all-and-end-all of technology.
- sillysaurus3 10y ago
  Actually, in many ways they are. It's one reason the US is in a superior position today vs other countries. Some technology would not happen at all without startups, such as airbnb. You don't need to go far to find reasons why regulation can be a terrible thing. Here's an example from five hours ago: https://news.ycombinator.com/item?id=14103008 https://news.ycombinator.com/item?id=14103008 If regulation is so bad, why are there so many people stamping out any opposition to regulation, and reacting with expressions of shock and disbelief that anyone could be against them? Because in recent years, it's become fashionable to hate business. You see it everywhere, from /r/LateStageCapitalism (a subreddit whose explicit purpose is to hate rich people the same way some people hate minorities), to the PR outrage at Uber (who certainly deserved it, but now everyone is gleefully waiting for Uber to burn), to this creeping distaste for anyone who would seriously consider startups' interests over the interests of the individual.
  - dagenleg 10y ago
    I sincerely hope you belong to the class of people making money off skimming regulations and immoral business practices. You know, one of the people who benefits from US being what US is. One of the 'rich people' Because if you are not, if you are actually one of the plebs, this adoration of the corporate boot and arguing against your interests as a customer is pretty sad.
    - sillysaurus3 10y ago
      I read 1984 when I was in my teens, and I remember being let down by it. It was so outlandishly comical that it was impossible to take it seriously. Then I was incredulous that more and more people were saying 1984 was starting to match reality. Remember the "daily hate"? That's pretty much what's going on here. Not only do people thoroughly enjoy the act of hating something, but entire communities form whose explicit purpose is to do this. And of course, no one wants to admit that they're hating people, so they construct comfortable euphemisms and say they're hating systems, not people. It's a "corporate boot," not a person. It's much easier to frame anyone who interrupts your daily hate as an outsider than to face the reality of what you're doing.

PhasmaFelis 10y ago

> Yes, security failures are pretty bad, but startups not happening thanks to excessive regulation is probably worse. How so? I mean, I'd rather avoid either, but if I had to pick one, I don't get what's so special about "startups" that they're more important than data security.

dwaltrip 10y ago
People starting new businesses is usually a good way for a society to become wealthier and to also raise the standard of living. In this particular case, I have no idea whether or not the safety risks/externalities are severe enough that added regulation is needed.
- ItendToDisagree 10y ago
  Please point out the graph and/or story that shows current startups raising the general standard of living for citizens in the middle/lower classes? (No. They can ride in a freelancer driven taxi is not raising the standard of living.)
  - TeMPOraL 10y ago
    Well, most of the things you enjoy today were at some point created by entrepreneurs starting companies; whether VC-funded startups (or whatever we called them in the past) or regular companies. There is a strong indication that the easier it is to start a profitable business, the more people will do so, create new products and services, and thus improve standards of living. But there need to be boundaries, because not every business model is good for society. As a thought experiment for those thinking it's better to have deregulated startups in high-tech industry, imagine taking down biosafety regulations. Think of all the biotech startups blooming...

igk 10y ago

What? No. If IoT (and important software in general) doesn't get some aggressive regulation, then people will die at some point. There were already cases where the heating went out in a whole town because of some connectivity issues ...I don't remember the details, but i think it was in Sweden. Medical devices, industrial machinery, power plants and at some point god forbidden nuclear plants. I flatly don't care about a startup getting shut down because they had shitty security, there will be another one. The people don't die from that in general. But if a person dies because of lack of regulations, or a strip of land gets contaminated, that is it. And instead of thinking about corporations being "extorted" for not fixing their shit, how about society having to deal with the fallout of shitty IoT security? DDOS paradise, possibly critical infrastructure being taken over etc If your business model breaks down if you are forced to do it properly, it was shit. Find a new one. Welcome to capitalism, it's nobodies job to make sure your company succeeds

sillysaurus3 10y ago
Your position is very extreme. Extreme enough that I don't think it's a productive use of time to debate with you. Maybe tone it down a little, take a breath, and realize (a) that people are not in fact dying, and (b) if they do, we can deal with it then. The problem with all of these "People might die!" arguments is that everyone who makes them is always thoroughly convinced that they are right at all costs right now so just fix this!!! that it gets so tiresome. Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions.
- igk 10y ago
  You are arguing against something I did not say. I never said we need to do it "at all costs right now so just fix this!!!". I am saying that I value the risk of human lives over the risk of some startups not being created. You didn't specify which part of my positions makes me extreme, so I will just address your a) and b), and your last sentence. b) is what I would call extreme. Yes, people die. But in the discussion "we should protect people" vs "we should't stiffle business", if one of your arguments is "we can deal with it if people dying" is pretty cold (this is me seeing the implied "but we can deal with it worse if startups fail" in this context, so you might want to correct me here) as for a) as far as I can tell, people have not died yet. But we see scenarios on how they could. I'll give examples with real life incidents as inspiration 1. Hacker wants to extort municipality, shuts of heating in winter: http://metropolitan.fi/entry/ddos-attack-halts-heating-in-finland-amidst-winter http://metropolitan.fi/entry/ddos-attack-halts-heating-in-fi... 2. Foreign interest wants to sabotage infrastructure, civilians get caught in collateral damage (also stuxnet) https://www.bloomberg.com/news/articles/2014-12-10/mysterious-08-turkey-pipeline-blast-opened-new-cyberwar https://www.bloomberg.com/news/articles/2014-12-10/mysteriou... 3. Competitor or hacker wants to extort company: https://www.wired.com/wp-content/uploads/2015/01/Lagebericht2014.pdf https://www.wired.com/wp-content/uploads/2015/01/Lagebericht... I would ask you, how many people have to die or how much damage needs to be caused before we but some basic security standards as regulation onto companies? Will one person suffice before I can make that argument? As for this: >Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions. 1. Yes we should, and then we will run out of lifetime because we cannot possibly think of everything. But I'll assume you didn't mean it literally. 2. Considering all relevant consequences I can think of(feel free to add any I forget): If we create a lower bound on security, mandate that all "consumer/industry grade" devices need to live up to that lower limit or face heavy fines, I see the following tings happening: * lots of stuff will not get created, because the margin would be gone. * there will be a new market for security middle ware, or a strengthening of the existing one * there would be a halt in the incrase of power of DDoS attacks * certifying your procuct as consumer or industry grade would need to be an efficient process and would probably add onto the cost of developing a product * GPl and open source software would have to be treated carefully. But if you start in IoT and not touch "classic" software, that can be managed. Probably the distinction between "consumer/industry grade" doesn't make sense for server software and would have to be shifted to the process, i.e. a company can use any software they want in their server AS LONG AS they make use of certain key technologies and industry best practices and have a good process in place. (yes this means no more SaaS without a security team...or a founder willing to learn that shit, or an new company providing that service. You could make an exception for revenue below 50k /year or something if you really want) That are the rough consequences I can see from regulation. Nothing too negative imo On your side, we have the status quo. With dishwashers running linux and having directory traversal vulns https://www.theregister.co.uk/2017/03/26/miele_joins_internetofst_hall_of_shame/ https://www.theregister.co.uk/2017/03/26/miele_joins_interne... companies ROUTINELY storing passwords, possibly without any good crypto and facing no consequences if stuff just stops working https://www.wired.com/2016/04/nests-hub-shutdown-proves-youre-crazy-buy-internet-things/ https://www.wired.com/2016/04/nests-hub-shutdown-proves-your... or if your data gets stolen because of their shitty practices

kazagistar 10y ago

Simple solution, fix CVEs in a timely manner.

FridgeSeal 10y ago

What? Are you serious? If some startups failing is the price we have to pay to get proper security around IoT devices then I'm all for it. Startups aren't the be-all-and-end-all of technology.

sillysaurus3 10y ago
Actually, in many ways they are. It's one reason the US is in a superior position today vs other countries. Some technology would not happen at all without startups, such as airbnb. You don't need to go far to find reasons why regulation can be a terrible thing. Here's an example from five hours ago: https://news.ycombinator.com/item?id=14103008 https://news.ycombinator.com/item?id=14103008 If regulation is so bad, why are there so many people stamping out any opposition to regulation, and reacting with expressions of shock and disbelief that anyone could be against them? Because in recent years, it's become fashionable to hate business. You see it everywhere, from /r/LateStageCapitalism (a subreddit whose explicit purpose is to hate rich people the same way some people hate minorities), to the PR outrage at Uber (who certainly deserved it, but now everyone is gleefully waiting for Uber to burn), to this creeping distaste for anyone who would seriously consider startups' interests over the interests of the individual.
- dagenleg 10y ago
  I sincerely hope you belong to the class of people making money off skimming regulations and immoral business practices. You know, one of the people who benefits from US being what US is. One of the 'rich people' Because if you are not, if you are actually one of the plebs, this adoration of the corporate boot and arguing against your interests as a customer is pretty sad.
  - sillysaurus3 10y ago
    I read 1984 when I was in my teens, and I remember being let down by it. It was so outlandishly comical that it was impossible to take it seriously. Then I was incredulous that more and more people were saying 1984 was starting to match reality. Remember the "daily hate"? That's pretty much what's going on here. Not only do people thoroughly enjoy the act of hating something, but entire communities form whose explicit purpose is to do this. And of course, no one wants to admit that they're hating people, so they construct comfortable euphemisms and say they're hating systems, not people. It's a "corporate boot," not a person. It's much easier to frame anyone who interrupts your daily hate as an outsider than to face the reality of what you're doing.