14 ms·

The 'internet of things' is sending us back to the Middle Ages

146 points by colinprince 9y ago

jwmullally 9y ago
I agree. Copy+pasting an old comment of mine from this old thread https://news.ycombinator.com/item?id=12683924 https://news.ycombinator.com/item?id=12683924 > A general solution to IoT security would be for all IoT devices to only communicate to your personally owned home gateway, which would run open-source drivers for each device to provide the networking/external communication functionality. The IoT device could even be assigned its own isolated network link to the router (i.e. sandboxed).
- ocdtrekkie 9y ago
  This is how my home works. My automation devices use Insteon, which is local only communication, and then my computer has an adapter for it that I wrote the software for.
- wepple 9y ago
  This is a great solution to the ownership problem, but now each individual is responsible for patching and updating their 25 devices? Doesn't solve the security problem.
  - pmontra 9y ago
    The home gateway could download the patches and send them to the devices. Its firewall will prevent them to phone home or somewhere else no matter what into those patches.
Crypto_Keeper 9y ago
I know some people will disagree, but I think the solution should be government regulation. Anything that connects wirelessly should have a standard security protocol. The way they make these devices now are laughably insecure. Until there's an actual law requiring manufacturer's to go the extra mile for security, they're going to continue to be lazy about it.
kogepathic 9y ago
On the whole I agree with the author, but they have glossed over some things I feel should be addressed: > The computer manufacturer Lenovo, for instance, used to sell its computers with a program called “Superfish” preinstalled. Most "serious" users reformat the machine and re-install the OS to get rid of the OEM included crapware. Not something the average user does, sure, but you're still allowed to re-install the OS on a commodity x86 system like a laptop. It's a matter of inconvenience, not impossibility. > This system means that a car company can’t stop me from painting my car a shocking shade of pink or from getting the oil changed at whatever repair shop I choose. I can even try to modify or fix my car myself. You cannot do this with a Tesla. Go look on the internet about people waiting months for Tesla to repair their cars, or people who have bought totaled Teslas and fixed them, only to be denied re-certification by Tesla. I think we will see other electric car manufacturers moving in the direction of a more closed ecosystem than what we have now with ICE cars. Reason being that electric cars have a unique drive system (even more than ICE cars) and usually a proprietary HVDC battery (>60V) and battery management system. The manufacturer risks increased liability and bad PR if they let people modify these cars and then they end up in flames. > Samsung cuts deals with lots of software providers which want to take my data for their own use. Same deal as with Lenovo, but slightly complicated by the fact that ARM is not as standardized at a platform level as x86 (yet, I think this is slowly changing). Pick a phone that comes without OEM crapware like Google Pixel, or a phone with good 3rd party ROM support like LineageOS. > What is important is that we recognize and reject what these companies are trying to do, buy accordingly, vigorously exercise our rights to use, repair and modify our smart property, and support efforts to strengthen those rights. Agree 100%, but this requires consumers to research products before they buy the cheapest one. We can encourage good behaviour by manufacturers, but it will mean educating our friends and family and collectively voting with our wallets.
- closeparen 9y ago
  > It's a matter of incovenice It's a matter of the moral bankruptcy of supporting a company that does this, and voting with your wallet that this kind of behavior ought to continue.
- userbinator 9y ago
eridius 9y ago
Wasn't the Roomba sharing maps thing already debunked?
- CharlesW 9y ago
  Yes. From http://lifehacker.com/tell-your-roomba-to-stop-sharing-a-map-of-your-home-1797238670 http://lifehacker.com/tell-your-roomba-to-stop-sharing-a-map...: > To clarify, iRobot has not formed any plans to sell data. iRobot is committed to the absolute privacy of our customer-related data, including data collected by our connected products. No data is sold to third-parties. No data will be shared with third-parties without the informed consent of our customers. If a customer had already signed up/opted in, iRobot will delete the data from our servers if a customer requests it. This is retroactive. > Clean Map Reports are not shared with third parties. If a Roomba owner does not want to share data with a third party such as Amazon (for example, to enable voice control from Amazon Alexa), the owner can simply disable the skill in the Amazon Alexa app.
zizek23 9y ago
Some technologies empower, others disempower and if iot devices and things like self driving cars are not rolled out with proper systems of user control and privacy they will disempower people. For many in the industry this is not a concern, a mere technology issue, an inevitability, an opportunity for profit. Fortunately there is growing skepticism and awareness of the intrusiveness. And self congratulatory messages on technology forums belittling user ignorance - oh they are dumb so we will take control - as if everyone should be a technology expert will be seen for the betrayal of users it is. Self preservation comes naturally to humans and given most technology folks are happy, even proud to work with deeply intrusive spyware companies, they are not going to be perceived as harmless as before. There is going to be a backlash against the so called 'nerds' involved in this one way transfer of power.
jeffdavis 9y ago
The problem is software complexity. You can't really own anything you don't understand, and you can't be free in a world you don't understand. And we don't understand software. Imagine a naive young king who doesn't understand how to do anything for himself. He will easily be controlled by those around him that do understand the world. Of course, nobody before ever understood everything about the world. But different people understood different aspects in depth, and education gave literacy so people could share expertise. Software is so complex that nobody really understands it. Nobody understands how a car works, nobody understands how a phone works, because they are both controlled by hopelessly complex software. Governments can't regulate emissions because the software changes the emissions controls based on arbitrary unknown factors. Security problems are just a small subset of the surprising ways complex software behaves -- surprising even to the software engineers who build it. And the key is that this is all new complexity that didn't exist before. Physics and biology were developed to understand pre-existing complexity, so we always made forward progress. But we are moving backwards now because we are introducing complexity faster than we are understanding it -- much faster. Therefore this is actually worse than the naive king mentioned above. In that example, it's just an asymmetry of information, and that can be resolved through education. Software is so complex education can't hope to keep up.
- digi_owl 9y ago
  and much of that complexity, at least on personal computers, gets added in the name of "user friendliness"...
  - zeep 9y ago
    also in the name of saving money/time (by using large libraries/frameworks and such)
    - jeffdavis 9y ago
      And it does! That's what's maddening about it. The complexity always seems to justify itself, but the end results are probably not where we want to be.
woodandsteel 9y ago
The problem is that hardware manufacturers want to keep collecting income after they have sold the product. Imagine if when you bought a car and paid it off, you still had to pay a fee to the manufacturer for every mile you drove. And ditto anyone you sold you car to. That is what is basically doing on today. Rent-seeking anyone?
feelin_googley 9y ago
Authored by a law professor. It is Apple who pioneered this concept of the device that the user really does not own or control - the "smartphone". The computer that remains tethered to the manfacturer continually feeding back user data. Manufacturer makes replacing the OS difficult. Manufacturer gets root. Manufacturer gets right to modify OS remotely. And no surprise, manuacturer gets plenty of data about users. Manufacturer did not ask for these privileges. They just took them. It was not always this way. But users accepted it. And so other companies followed Apple's lead. I find the company's official statements about how they protect privacy to be offensive to common sense. Want to protect privacy? Stop forcibly collecting any and all data. (Not just "less than so-and-so".) If users really believe that sending data to Apple will help Apple create the "best experience" then let them opt-in to collection and send it voluntarily. The users own the device. If they wish untether from Apple's "ecosystem", then that is their right. There exists at least one user who does not want a company to collect their data, put it on a networked computer and then purport to "protect" it. They want the company to stop collecting their data. Why? Because they have weighed the risks and decided it is not worth it. IMO the "smartphone" is part of the IoT and was the first "thing". Because it was a thing where software was used to take away some of the control from the owner (control that owners had previously); owners only get partial control. Going forward, if one is opposed to internet connected things one does not fully control, the solution is not to select the things that collect the least data or that offer the most control. ("I trust Company X because they collect less data than the other companies.") The solution is to choose things that are not internet connected.
- zimzam 9y ago
  Apple collects very little user data. Developers have complained about the limits Apple puts on collecting data and Apple News partners have been quite frustrated. Even the people who originally developed Siri were frustrated by not having access to more user data. There are plenty of companies like Facebook and Google that have no regard for user privacy but I wouldn't include Apple in that bucket.
- jodrellblank 9y ago
  it is Apple who has pioneered this concept of the device the user really does not own or control - the "smartphone". Users controlled the Super-NES? Users controlled the Sony Playstation? Users controlled Blackberries with their perma-connection back to RIM servers? Symbian S60 users got a choice of the OS? Internet connections come with choices of user-controlled routers? Early internet connections with AOL-Compuserve-software was user-controlled and didn't talk back to one company? Devices where the user has any control at all are the rarity of device makes/models/types, even if they are a majority of sales due to the PC-compatible hardware.
justonepost 9y ago
Just wait for full on AI, then you'll see some real digital serf action.
jgalt212 9y ago
Fun twitter feed: https://twitter.com/internetofshit https://twitter.com/internetofshit
rajandatta 9y ago
This is in part why supporting the FSF and other bodies that seek to ensure that choice and transparency are promoted. The only real way to compel companies to comply is to support viable alternatives to the dominance of a vendor controlled market.
sapote 9y ago
Credit where I think it's due -- Bruce Schneier was one of the first to introduce the metaphor of feudalism in this context: https://www.schneier.com/blog/archives/2012/12/feudal_sec.html https://www.schneier.com/blog/archives/2012/12/feudal_sec.ht...

146 points by colinprince 9y ago

I agree. Copy+pasting an old comment of mine from this old thread https://news.ycombinator.com/item?id=12683924 https://news.ycombinator.com/item?id=12683924 > A general solution to IoT security would be for all IoT devices to only communicate to your personally owned home gateway, which would run open-source drivers for each device to provide the networking/external communication functionality. The IoT device could even be assigned its own isolated network link to the router (i.e. sandboxed).

ocdtrekkie 9y ago
This is how my home works. My automation devices use Insteon, which is local only communication, and then my computer has an adapter for it that I wrote the software for.
wepple 9y ago
This is a great solution to the ownership problem, but now each individual is responsible for patching and updating their 25 devices? Doesn't solve the security problem.
- pmontra 9y ago
  The home gateway could download the patches and send them to the devices. Its firewall will prevent them to phone home or somewhere else no matter what into those patches.

Crypto_Keeper 9y ago

I know some people will disagree, but I think the solution should be government regulation. Anything that connects wirelessly should have a standard security protocol. The way they make these devices now are laughably insecure. Until there's an actual law requiring manufacturer's to go the extra mile for security, they're going to continue to be lazy about it.

kogepathic 9y ago

On the whole I agree with the author, but they have glossed over some things I feel should be addressed: > The computer manufacturer Lenovo, for instance, used to sell its computers with a program called “Superfish” preinstalled. Most "serious" users reformat the machine and re-install the OS to get rid of the OEM included crapware. Not something the average user does, sure, but you're still allowed to re-install the OS on a commodity x86 system like a laptop. It's a matter of inconvenience, not impossibility. > This system means that a car company can’t stop me from painting my car a shocking shade of pink or from getting the oil changed at whatever repair shop I choose. I can even try to modify or fix my car myself. You cannot do this with a Tesla. Go look on the internet about people waiting months for Tesla to repair their cars, or people who have bought totaled Teslas and fixed them, only to be denied re-certification by Tesla. I think we will see other electric car manufacturers moving in the direction of a more closed ecosystem than what we have now with ICE cars. Reason being that electric cars have a unique drive system (even more than ICE cars) and usually a proprietary HVDC battery (>60V) and battery management system. The manufacturer risks increased liability and bad PR if they let people modify these cars and then they end up in flames. > Samsung cuts deals with lots of software providers which want to take my data for their own use. Same deal as with Lenovo, but slightly complicated by the fact that ARM is not as standardized at a platform level as x86 (yet, I think this is slowly changing). Pick a phone that comes without OEM crapware like Google Pixel, or a phone with good 3rd party ROM support like LineageOS. > What is important is that we recognize and reject what these companies are trying to do, buy accordingly, vigorously exercise our rights to use, repair and modify our smart property, and support efforts to strengthen those rights. Agree 100%, but this requires consumers to research products before they buy the cheapest one. We can encourage good behaviour by manufacturers, but it will mean educating our friends and family and collectively voting with our wallets.

closeparen 9y ago
> It's a matter of incovenice It's a matter of the moral bankruptcy of supporting a company that does this, and voting with your wallet that this kind of behavior ought to continue.
userbinator 9y ago

eridius 9y ago

Wasn't the Roomba sharing maps thing already debunked?

CharlesW 9y ago
Yes. From http://lifehacker.com/tell-your-roomba-to-stop-sharing-a-map-of-your-home-1797238670 http://lifehacker.com/tell-your-roomba-to-stop-sharing-a-map...: > To clarify, iRobot has not formed any plans to sell data. iRobot is committed to the absolute privacy of our customer-related data, including data collected by our connected products. No data is sold to third-parties. No data will be shared with third-parties without the informed consent of our customers. If a customer had already signed up/opted in, iRobot will delete the data from our servers if a customer requests it. This is retroactive. > Clean Map Reports are not shared with third parties. If a Roomba owner does not want to share data with a third party such as Amazon (for example, to enable voice control from Amazon Alexa), the owner can simply disable the skill in the Amazon Alexa app.

zizek23 9y ago

Some technologies empower, others disempower and if iot devices and things like self driving cars are not rolled out with proper systems of user control and privacy they will disempower people. For many in the industry this is not a concern, a mere technology issue, an inevitability, an opportunity for profit. Fortunately there is growing skepticism and awareness of the intrusiveness. And self congratulatory messages on technology forums belittling user ignorance - oh they are dumb so we will take control - as if everyone should be a technology expert will be seen for the betrayal of users it is. Self preservation comes naturally to humans and given most technology folks are happy, even proud to work with deeply intrusive spyware companies, they are not going to be perceived as harmless as before. There is going to be a backlash against the so called 'nerds' involved in this one way transfer of power.

jeffdavis 9y ago

The problem is software complexity. You can't really own anything you don't understand, and you can't be free in a world you don't understand. And we don't understand software. Imagine a naive young king who doesn't understand how to do anything for himself. He will easily be controlled by those around him that do understand the world. Of course, nobody before ever understood everything about the world. But different people understood different aspects in depth, and education gave literacy so people could share expertise. Software is so complex that nobody really understands it. Nobody understands how a car works, nobody understands how a phone works, because they are both controlled by hopelessly complex software. Governments can't regulate emissions because the software changes the emissions controls based on arbitrary unknown factors. Security problems are just a small subset of the surprising ways complex software behaves -- surprising even to the software engineers who build it. And the key is that this is all new complexity that didn't exist before. Physics and biology were developed to understand pre-existing complexity, so we always made forward progress. But we are moving backwards now because we are introducing complexity faster than we are understanding it -- much faster. Therefore this is actually worse than the naive king mentioned above. In that example, it's just an asymmetry of information, and that can be resolved through education. Software is so complex education can't hope to keep up.

digi_owl 9y ago
and much of that complexity, at least on personal computers, gets added in the name of "user friendliness"...
- zeep 9y ago
  also in the name of saving money/time (by using large libraries/frameworks and such)
  - jeffdavis 9y ago
    And it does! That's what's maddening about it. The complexity always seems to justify itself, but the end results are probably not where we want to be.

woodandsteel 9y ago

The problem is that hardware manufacturers want to keep collecting income after they have sold the product. Imagine if when you bought a car and paid it off, you still had to pay a fee to the manufacturer for every mile you drove. And ditto anyone you sold you car to. That is what is basically doing on today. Rent-seeking anyone?

feelin_googley 9y ago

Authored by a law professor. It is Apple who pioneered this concept of the device that the user really does not own or control - the "smartphone". The computer that remains tethered to the manfacturer continually feeding back user data. Manufacturer makes replacing the OS difficult. Manufacturer gets root. Manufacturer gets right to modify OS remotely. And no surprise, manuacturer gets plenty of data about users. Manufacturer did not ask for these privileges. They just took them. It was not always this way. But users accepted it. And so other companies followed Apple's lead. I find the company's official statements about how they protect privacy to be offensive to common sense. Want to protect privacy? Stop forcibly collecting any and all data. (Not just "less than so-and-so".) If users really believe that sending data to Apple will help Apple create the "best experience" then let them opt-in to collection and send it voluntarily. The users own the device. If they wish untether from Apple's "ecosystem", then that is their right. There exists at least one user who does not want a company to collect their data, put it on a networked computer and then purport to "protect" it. They want the company to stop collecting their data. Why? Because they have weighed the risks and decided it is not worth it. IMO the "smartphone" is part of the IoT and was the first "thing". Because it was a thing where software was used to take away some of the control from the owner (control that owners had previously); owners only get partial control. Going forward, if one is opposed to internet connected things one does not fully control, the solution is not to select the things that collect the least data or that offer the most control. ("I trust Company X because they collect less data than the other companies.") The solution is to choose things that are not internet connected.

zimzam 9y ago
Apple collects very little user data. Developers have complained about the limits Apple puts on collecting data and Apple News partners have been quite frustrated. Even the people who originally developed Siri were frustrated by not having access to more user data. There are plenty of companies like Facebook and Google that have no regard for user privacy but I wouldn't include Apple in that bucket.
jodrellblank 9y ago
it is Apple who has pioneered this concept of the device the user really does not own or control - the "smartphone". Users controlled the Super-NES? Users controlled the Sony Playstation? Users controlled Blackberries with their perma-connection back to RIM servers? Symbian S60 users got a choice of the OS? Internet connections come with choices of user-controlled routers? Early internet connections with AOL-Compuserve-software was user-controlled and didn't talk back to one company? Devices where the user has any control at all are the rarity of device makes/models/types, even if they are a majority of sales due to the PC-compatible hardware.

justonepost 9y ago

Just wait for full on AI, then you'll see some real digital serf action.

jgalt212 9y ago

Fun twitter feed: https://twitter.com/internetofshit https://twitter.com/internetofshit

rajandatta 9y ago

This is in part why supporting the FSF and other bodies that seek to ensure that choice and transparency are promoted. The only real way to compel companies to comply is to support viable alternatives to the dominance of a vendor controlled market.

sapote 9y ago

Credit where I think it's due -- Bruce Schneier was one of the first to introduce the metaphor of feudalism in this context: https://www.schneier.com/blog/archives/2012/12/feudal_sec.html https://www.schneier.com/blog/archives/2012/12/feudal_sec.ht...