7 ms·

>Anyone, especially lawyers, have insight on best way to fix this problem? Why lawyers? This is a technical problem. Layers will come up with bad legal solutio

>Anyone, especially lawyers, have insight on best way to fix this problem? Why lawyers? This is a technical problem. Layers will come up with bad legal solutions that will already be outdated and probably too onerous when they are finally passed. I think the fix is obvious. IoT device should not have an open connection to the internet. You want to control the lights in your house with your phone, when you're at work? VPN to your home network and do it. Obviously people won't know how to configure a VPN, and you can't expect a Chinese IoT manufacturer to not have a a web-server listening on a standard port or issue weekly security updates for the lifetime of the product, but this could be automated by smart routers like Google Home/Wifi. Frankly, this is probably going to happen anyway. OS vendors have largely removed the OS as the most vulnerable component of a home network. All OSes are either locked down (Android/iOS) or have continuous security updates with sane out-of-the-box defaults. That leaves the router as a critical weak point. The cheapo $30 Staples router may work great for a household, but it isn't getting monthly security updates and is probably running on an unsupported kernel with a whole swath of zero-day vulnerabilities.

lmm 10y ago
Have you ever had to follow coding standards that are 10 years out of date? I have and it was worse than working retail. Technology moves too fast. (And for what it's worth a VPN is a non-solution to the wrong problem in this case). Legal is absolutely the right place for the problem. Put the liability in the right place and companies will figure out what works and what doesn't.
- macspoofing 10y ago
  >Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what your point is, any regulation is going to take years to develop, and years to be assimilated (if ever). >Put the liability in the right place and companies will figure out what works and what doesn't. Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. >(And for what it's worth a VPN is a non-solution to the wrong problem in this case). It's a solution. The problem with IoT devices is that they are open for anyone to compromise and you cannot expect manufacturers to support them with security updates indefinitely. You put them on a private network with a controlled end-point and you're 95% there. Instead of needing people to vet every device they buy on Amazon (or creating a regulatory body to govern and control them), you just need to convince them to get a 'smart' router. You don't need every IoT manufacturer in the world to play ball. You don't even need every consumer to play ball either. Your phone will have an app that will talk to your home router/gateway and you can access your home service via a VPN you don't even know is there. Makes a ton of sense to me. Regulation would be a mess.
  - lmm 10y ago
    > Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. I'm proposing not legislating any technical matters. Just legislate where the liability lies, make it clear who has what kind of security responsibilities and what the penalties are when they fail. Businesses are good at responding to appropriate financial incentives.
    - macspoofing 10y ago
      How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do you quantify liabilty due to a security vulnerability in some sub-component or somewhere in the software stack? How do you assign liability if thousands of different IoT devices are compromised and DDoSing the White House page? How do you deal with bankrupt or foreign suppliers? Or people using products that have been end-of-life-ed? Or how do you keep regulation up to date with current security standards? This is an incredibly hard problem.
      - lmm 10y ago
        I don't know how (I'm not a lawyer), but it seems like our legal system already deals with the same kind of issue for other things? Suppose faulty wiring in an appliance leads to an apartment building burning down - at that point you could have the same kind of issues in terms of it being a sub-component from a foreign supplier, end-of-lifed, affecting different people and so on. But somehow we deal with it.
catdog 10y ago
> Why lawyers? This is a technical problem. You need to push the industry into solving this technical problem, it's not happening on its own.
- macspoofing 10y ago
  >it's not happening on its own. How do you explain pretty much every standard that governs the web and computing in general.
Terr_ 10y ago
I disagree, the immediate problem is not developing secure code, the problem is nobody wants to pay for security, and that's because it's cheap to slap on a disclaimer. There's no point coming up with technical solutions that companies will never spend $$$ to implement.
- macspoofing 10y ago
  Disagree with what part? Like you I don't see a regulatory security mandate as a solution. Security is hard and expensive and it just isn't feasible to expect every crappy IoT toaster to go through a security review.
  - Terr_ 10y ago
    I disagree where you say that it is a "technical problem", because that's not the real bottleneck at this point. You can tell because there are many security issues (e.g. plaintext passwords) where relatively easy technical solutions have existed for a very very long time... Yet they still aren't being consistently applied. Why? Because the root-cause is a matter of incentives, rather than a matter of inventions.

lmm 10y ago

Have you ever had to follow coding standards that are 10 years out of date? I have and it was worse than working retail. Technology moves too fast. (And for what it's worth a VPN is a non-solution to the wrong problem in this case). Legal is absolutely the right place for the problem. Put the liability in the right place and companies will figure out what works and what doesn't.

macspoofing 10y ago
>Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what your point is, any regulation is going to take years to develop, and years to be assimilated (if ever). >Put the liability in the right place and companies will figure out what works and what doesn't. Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. >(And for what it's worth a VPN is a non-solution to the wrong problem in this case). It's a solution. The problem with IoT devices is that they are open for anyone to compromise and you cannot expect manufacturers to support them with security updates indefinitely. You put them on a private network with a controlled end-point and you're 95% there. Instead of needing people to vet every device they buy on Amazon (or creating a regulatory body to govern and control them), you just need to convince them to get a 'smart' router. You don't need every IoT manufacturer in the world to play ball. You don't even need every consumer to play ball either. Your phone will have an app that will talk to your home router/gateway and you can access your home service via a VPN you don't even know is there. Makes a ton of sense to me. Regulation would be a mess.
- lmm 10y ago
  > Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. I'm proposing not legislating any technical matters. Just legislate where the liability lies, make it clear who has what kind of security responsibilities and what the penalties are when they fail. Businesses are good at responding to appropriate financial incentives.
  - macspoofing 10y ago
    How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do you quantify liabilty due to a security vulnerability in some sub-component or somewhere in the software stack? How do you assign liability if thousands of different IoT devices are compromised and DDoSing the White House page? How do you deal with bankrupt or foreign suppliers? Or people using products that have been end-of-life-ed? Or how do you keep regulation up to date with current security standards? This is an incredibly hard problem.
    - lmm 10y ago
      I don't know how (I'm not a lawyer), but it seems like our legal system already deals with the same kind of issue for other things? Suppose faulty wiring in an appliance leads to an apartment building burning down - at that point you could have the same kind of issues in terms of it being a sub-component from a foreign supplier, end-of-lifed, affecting different people and so on. But somehow we deal with it.

catdog 10y ago

> Why lawyers? This is a technical problem. You need to push the industry into solving this technical problem, it's not happening on its own.

macspoofing 10y ago
>it's not happening on its own. How do you explain pretty much every standard that governs the web and computing in general.

Terr_ 10y ago

I disagree, the immediate problem is not developing secure code, the problem is nobody wants to pay for security, and that's because it's cheap to slap on a disclaimer. There's no point coming up with technical solutions that companies will never spend $$$ to implement.

macspoofing 10y ago
Disagree with what part? Like you I don't see a regulatory security mandate as a solution. Security is hard and expensive and it just isn't feasible to expect every crappy IoT toaster to go through a security review.
- Terr_ 10y ago
  I disagree where you say that it is a "technical problem", because that's not the real bottleneck at this point. You can tell because there are many security issues (e.g. plaintext passwords) where relatively easy technical solutions have existed for a very very long time... Yet they still aren't being consistently applied. Why? Because the root-cause is a matter of incentives, rather than a matter of inventions.