2 ms·

look, it is shocking how you run covering the holes forgetting about security, who needs automatic device update if it can be hacked by a child??? In most cases

by d4r114 9y ago

look, it is shocking how you run covering the holes forgetting about security, who needs automatic device update if it can be hacked by a child??? In most cases, like the door bell, a RTOS is not only unnecessary but also risky less reliable and unefficient!!! Use an unhackable ATmega without the neeed of any OS instead

jaboutboul 9y ago
I hadn't covered security because at the time, it wasn't a major point of comment in the discussions. However, now that several people brought it up, it's useful to discuss. I'll refer you to this page on the site, https://mongoose-os.com/docs/overview/security.html https://mongoose-os.com/docs/overview/security.html. It'll give you a pretty good overview of where the teams head is at. Mongoose is using ARM mbedTLS with a few patches to optimize for small memory constraints. Theres support for quite a few of the most common crypto chips which are used. All the supported cloud platforms (AWS, GCP and Adafruit I/O) as well as the mqtt support and local http/ws support all have the options to turn enable tls. The greatest think, imho is that its possible to fully encrypt the flash on the espressif chips. For those who don't know, those chips are pretty prolific in IoT and AFAIK mongoose is the only platform (aside from the Espressif SDK itself) which can do that. So pretty keen on security. Your point about automatic device update being hacked is just FUD. There are can be multiple attack vectors on any given device, and thats why great security doesn't just happen, it has to be a pervasive part of the underlying philosophy of the platform. All the sound bases are kind of covered here, encryption on almost every level, from the application level to the transport level to the flash itself.
- d4r114 9y ago
  If mongoose plus espressif hardware are pretty keen on security I am Batman and Russian winter of IOT is not coming.

by d4r114 9y ago

jaboutboul 9y ago

I hadn't covered security because at the time, it wasn't a major point of comment in the discussions. However, now that several people brought it up, it's useful to discuss. I'll refer you to this page on the site, https://mongoose-os.com/docs/overview/security.html https://mongoose-os.com/docs/overview/security.html. It'll give you a pretty good overview of where the teams head is at. Mongoose is using ARM mbedTLS with a few patches to optimize for small memory constraints. Theres support for quite a few of the most common crypto chips which are used. All the supported cloud platforms (AWS, GCP and Adafruit I/O) as well as the mqtt support and local http/ws support all have the options to turn enable tls. The greatest think, imho is that its possible to fully encrypt the flash on the espressif chips. For those who don't know, those chips are pretty prolific in IoT and AFAIK mongoose is the only platform (aside from the Espressif SDK itself) which can do that. So pretty keen on security. Your point about automatic device update being hacked is just FUD. There are can be multiple attack vectors on any given device, and thats why great security doesn't just happen, it has to be a pervasive part of the underlying philosophy of the platform. All the sound bases are kind of covered here, encryption on almost every level, from the application level to the transport level to the flash itself.

d4r114 9y ago
If mongoose plus espressif hardware are pretty keen on security I am Batman and Russian winter of IOT is not coming.