4 ms·

Can you clarify what you mean by "type of computer"? I hope you don't mean we should see regulation that say ARM 32 bit devices are fine for IoT, but TI 8 bit d

by zild3d 9y ago

Can you clarify what you mean by "type of computer"? I hope you don't mean we should see regulation that say ARM 32 bit devices are fine for IoT, but TI 8 bit devices cannot be used. This vulnerability doesn't seem dependent on any particular type of computer. It's mostly due to default router passwords and open ports, which I agree points to the need for guidance and regulation on how systems are secured and updated

kijin 9y ago
I think GP is talking more about software than hardware. Most of today's IoT devices are intentionally crippled general-purpose computers. The only thing that's preventing them from doing everything a general-purpose computer can do, like running a different OS or attacking random websites, is the pre-installed software (often called firmware). In this case, we might say that the manufacturer has a much stronger responsibility to keep their devices under control than in the case of, say, a typical PC where the user assumes more of that responsibility. The less freedom you give your users, the more power you reserve for yourself. That power should come with corresponding responsibilities. For example: - Mandatory security auditing of all pre-installed software - Mandatory security updates for X years - Mandatory insurance for damages caused by vulnerabilities in your products Allow some of these requirements to be met by reusing previously audited and/or independently maintained software, giving manufacturers an incentive to stick with well-tested standard components. Waive some or all of the requirements if the device is allowed to be used as a general-purpose computer and/or all the software is freely available. Best case scenario: we get routers and TVs labeled "Red Hat Embedded Linux inside: security updates guaranteed for 10 years."
- noobiemcfoob 9y ago
  > Best case scenario: we get routers and TVs labeled "Red Hat Embedded Linux inside: security updates guaranteed for 10 years." As long as the industry is allowed to come to these SLA-like stamps on their own, on a per product basis, without government regulation breathing down their neck, this is exactly the way to go. IoT is so wide, there is no such thing as a "one size fits all". Any talk about across the board rules stinks of missing this obvious reality.
- neom 9y ago
  But also, there is no need to put a computer with a huge amount of resource in say, a baby bottle that can tell an app what temperature the milk is. In theory you could do a lot more (or at least different) damage with a P5 than a 486. The IoT stuff is usually cobbled together components, so we'll see things like a 500gig HD on a device (such as an environmental sensor for a city intersection) that passes off data and at most needs a couple gigs for OS and cache stuff. It's harder to start installing stuff on devices that are at the minimum specs for what they are designed to do. I'm not sure if that makes sense but I'm pretty sure there is some logic in there somewhere, but correct me if I'm wrong.
  - kijin 9y ago
    Custom designs used to make sense when general-purpose computers were expensive. Nowadays, it's cheaper to stick a generic ARM SoC in your product and install a LAMP stack on it. It's also easier to find cheap developers that way. My router is just a bunch of CGI scripts running on an outdated Linux distro.

by zild3d 9y ago

kijin 9y ago

I think GP is talking more about software than hardware. Most of today's IoT devices are intentionally crippled general-purpose computers. The only thing that's preventing them from doing everything a general-purpose computer can do, like running a different OS or attacking random websites, is the pre-installed software (often called firmware). In this case, we might say that the manufacturer has a much stronger responsibility to keep their devices under control than in the case of, say, a typical PC where the user assumes more of that responsibility. The less freedom you give your users, the more power you reserve for yourself. That power should come with corresponding responsibilities. For example: - Mandatory security auditing of all pre-installed software - Mandatory security updates for X years - Mandatory insurance for damages caused by vulnerabilities in your products Allow some of these requirements to be met by reusing previously audited and/or independently maintained software, giving manufacturers an incentive to stick with well-tested standard components. Waive some or all of the requirements if the device is allowed to be used as a general-purpose computer and/or all the software is freely available. Best case scenario: we get routers and TVs labeled "Red Hat Embedded Linux inside: security updates guaranteed for 10 years."

noobiemcfoob 9y ago
> Best case scenario: we get routers and TVs labeled "Red Hat Embedded Linux inside: security updates guaranteed for 10 years." As long as the industry is allowed to come to these SLA-like stamps on their own, on a per product basis, without government regulation breathing down their neck, this is exactly the way to go. IoT is so wide, there is no such thing as a "one size fits all". Any talk about across the board rules stinks of missing this obvious reality.
neom 9y ago
But also, there is no need to put a computer with a huge amount of resource in say, a baby bottle that can tell an app what temperature the milk is. In theory you could do a lot more (or at least different) damage with a P5 than a 486. The IoT stuff is usually cobbled together components, so we'll see things like a 500gig HD on a device (such as an environmental sensor for a city intersection) that passes off data and at most needs a couple gigs for OS and cache stuff. It's harder to start installing stuff on devices that are at the minimum specs for what they are designed to do. I'm not sure if that makes sense but I'm pretty sure there is some logic in there somewhere, but correct me if I'm wrong.
- kijin 9y ago
  Custom designs used to make sense when general-purpose computers were expensive. Nowadays, it's cheaper to stick a generic ARM SoC in your product and install a LAMP stack on it. It's also easier to find cheap developers that way. My router is just a bunch of CGI scripts running on an outdated Linux distro.