3 ms·

>Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what yo

>Have you ever had to follow coding standards that are 10 years out of date? I have. Our product is 10 years old. 10 years is nothing. And I'm not sure what your point is, any regulation is going to take years to develop, and years to be assimilated (if ever). >Put the liability in the right place and companies will figure out what works and what doesn't. Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. >(And for what it's worth a VPN is a non-solution to the wrong problem in this case). It's a solution. The problem with IoT devices is that they are open for anyone to compromise and you cannot expect manufacturers to support them with security updates indefinitely. You put them on a private network with a controlled end-point and you're 95% there. Instead of needing people to vet every device they buy on Amazon (or creating a regulatory body to govern and control them), you just need to convince them to get a 'smart' router. You don't need every IoT manufacturer in the world to play ball. You don't even need every consumer to play ball either. Your phone will have an app that will talk to your home router/gateway and you can access your home service via a VPN you don't even know is there. Makes a ton of sense to me. Regulation would be a mess.

lmm 10y ago
> Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. I'm proposing not legislating any technical matters. Just legislate where the liability lies, make it clear who has what kind of security responsibilities and what the penalties are when they fail. Businesses are good at responding to appropriate financial incentives.
- macspoofing 10y ago
  How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do you quantify liabilty due to a security vulnerability in some sub-component or somewhere in the software stack? How do you assign liability if thousands of different IoT devices are compromised and DDoSing the White House page? How do you deal with bankrupt or foreign suppliers? Or people using products that have been end-of-life-ed? Or how do you keep regulation up to date with current security standards? This is an incredibly hard problem.
  - lmm 10y ago
    I don't know how (I'm not a lawyer), but it seems like our legal system already deals with the same kind of issue for other things? Suppose faulty wiring in an appliance leads to an apartment building burning down - at that point you could have the same kind of issues in terms of it being a sub-component from a foreign supplier, end-of-lifed, affecting different people and so on. But somehow we deal with it.

lmm 10y ago

> Uh huh. You're proposing creating regulation to govern thousands (or hundreds of thousands) of products globally, and you think that's easier? The closest example of a regulatory solution to a real technical problem is the EU mandate of cookie notification ... which was disruptive for everyone and insanely stupid and pointless. I'm proposing not legislating any technical matters. Just legislate where the liability lies, make it clear who has what kind of security responsibilities and what the penalties are when they fail. Businesses are good at responding to appropriate financial incentives.

macspoofing 10y ago
How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do you quantify liabilty due to a security vulnerability in some sub-component or somewhere in the software stack? How do you assign liability if thousands of different IoT devices are compromised and DDoSing the White House page? How do you deal with bankrupt or foreign suppliers? Or people using products that have been end-of-life-ed? Or how do you keep regulation up to date with current security standards? This is an incredibly hard problem.
- lmm 10y ago
  I don't know how (I'm not a lawyer), but it seems like our legal system already deals with the same kind of issue for other things? Suppose faulty wiring in an appliance leads to an apartment building burning down - at that point you could have the same kind of issues in terms of it being a sub-component from a foreign supplier, end-of-lifed, affecting different people and so on. But somehow we deal with it.