3 ms·

> Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. While this sounds like a wonderful

> Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. While this sounds like a wonderful idea (and one I would subscribe to), it doesn't address the fundamental problem with IoT security. Most operating systems have updates made available on a monthly, weekly, or even daily basis, in order to keep them secure. Mostly, we know how to do this, the operating system generally auto-updates, and the people producing the OS keep up to date. This is necessary because the time from discovery of a bug to exploitation of a bug can be very short. IoT devices rarely have this. A Meile washing machine should last 20 years, but there is no way I'm leaving a computer with a 20-year old OS on the internet. That's just asking for trouble. There's also the point that OS makers generally have a clue about computing security, but IoT makers generally do not. A computer with no way of updating the OS for security (i.e. an IoT device) has a usable lifespan of maybe a couple of months. If you're lucky.

TeMPOraL 9y ago
Well, but that's the point: don't connect it to the Internet. 99% of the IoT stuff should never ever have to work outside of your local network (including VPNing to your phone if you're outside).
Silhouette 9y ago
This is all good stuff, but actually raises another important question for our new wave of technologies: how do/should we regulate products where some form of after-sale updates is necessary to maintain proper function? For example, in my country, it is typically the merchant who sells you a physical product who will be on the hook under consumer protection legislation if the product fails to meet acceptable standards somehow. It's implicit that they would in turn try to recover any losses from their own suppliers later, but that's not the end customer's problem, and the merchant is the one who loses out if they don't have such a recovery mechanism available. However, that's hardly fair if there's a third party involved (the developer of some software component within the product) who can update it in whatever good or bad ways they want without any knowledge or consent on the part of the merchant. It is particularly unfair if that third party is also a relatively large or even monopoly supplier and can dictate more-or-less arbitrary terms to merchants selling their products, who typically do not benefit from a baseline of legal protections against exploitation in the same way that end customers do. In short, our entire framework of consumer protection and product liability laws has been built around the model of a linear supply chain resulting in a single point and time of sale, but that model simply doesn't apply any more in many cases.

TeMPOraL 9y ago

Well, but that's the point: don't connect it to the Internet. 99% of the IoT stuff should never ever have to work outside of your local network (including VPNing to your phone if you're outside).

Silhouette 9y ago

This is all good stuff, but actually raises another important question for our new wave of technologies: how do/should we regulate products where some form of after-sale updates is necessary to maintain proper function? For example, in my country, it is typically the merchant who sells you a physical product who will be on the hook under consumer protection legislation if the product fails to meet acceptable standards somehow. It's implicit that they would in turn try to recover any losses from their own suppliers later, but that's not the end customer's problem, and the merchant is the one who loses out if they don't have such a recovery mechanism available. However, that's hardly fair if there's a third party involved (the developer of some software component within the product) who can update it in whatever good or bad ways they want without any knowledge or consent on the part of the merchant. It is particularly unfair if that third party is also a relatively large or even monopoly supplier and can dictate more-or-less arbitrary terms to merchants selling their products, who typically do not benefit from a baseline of legal protections against exploitation in the same way that end customers do. In short, our entire framework of consumer protection and product liability laws has been built around the model of a linear supply chain resulting in a single point and time of sale, but that model simply doesn't apply any more in many cases.