5 ms·

No tool manufacturer is responsible for the outcomes of their tools (except the particular function they intended as a warantee)

pyre 8y ago
Most of these devices are insecure not because the attackers are hyper-sophisticated, but because the software is rushed and a second-thought to the hardware. There is no one (in power) at these companies that cares about crafting quality software. They just care about crafting the bare minimum to make their devices work. I wager that "security" is something fairly far from their mind when they craft this software, which I consider especially negligent for any company that is dealing in networked devices.
- rock_hard 8y ago
  It would probably be best to let the market regulate by itself but the issue here might be that it’s not visible to users that their router is infected.
  - jeremyjh 8y ago
    That is right. This malware is an externality. Externalities typically need to be mitigated through regulation.
- kelnos 8y ago
  It's even worse: most of these companies don't even write the software for the low end consumer hardware. They just license it from a third party, usually in Asia, and pay them to turn features on or off and skin the UI for their branding. It's no surprise that routers from competing manufacturers are vulnerable, since it's all the same under the hood. The companies that sell the finished product have zero insight into how secure the software is.
  - beojan 8y ago
    But there's open source software for this. Why don't they just use that?
    - pyre 8y ago
      There is no one to point the finger at (i.e. blame) when something goes wrong.
- pbhjpbhj 8y ago
  My router has the password saved in the page source ...
mikec3010 8y ago
Not true. Product liability lawsuits have been around for ages. It's just that the tech industry has been able to escape them, by and large. I think one of the greater injustices in business was Microsoft's avoidance of a lawsuit from their spate of windows malware from roughly 2003-2010. They just sat on their hands and let for-profit A/V companies and nonprofit volunteers secure their platform, while consumers lost millions of hours and billions of dollars to simply be able to use their computers again after being rooted by 4 lines of JavaScript
- vntok 8y ago
  > after being rooted by 4 lines of JavaScript Could you provide any sort of source for this extraordinary claim of yours?
  - jwalton 8y ago
    That's probably an exaggeration, but I agree with the sentiment of what they are saying. It's not crazy hard to write quality software. Most corporations don't bother because they know they don't have to, since they can escape liability laws. It's gotten to the point where most software developers somehow view this situation as "normal". Do you have a QA department? What do they do? If you're like most software companies, they do testing. This is not QA, though, it's QV. The role of QA is to assure that the quality of your product is high. By the time you're testing it, the product is "done" - all of the defects are already there in the product. There is now nothing you can do to affect the quality of the product - all you can do is test and measure the overall quality of the product. I mean, your tests will find problems, and you can fix those problems. But, if you keep track of how many problems you find, and how much test effort was involved to find those problems, you can plot a weibull regression and make a prediction about how many defects you haven't found yet. On any project I've been on where we ran this analysis, it was obvious that testing was finding almost none of the problems - barely skimming the surface. And, when you ran this analysis you could predict how many defects you will find if you spend X days testing, and on any project where I've seen this analysis run, those predictions have been highly accurate. Really good automated tests can help with this, because they can do huge amounts of test effort "for free", but really QA should be about the process you follow when you write software - making sure you have a repeatable process, and then figuring out how to improve it. Almost no one does this.
lele92n 8y ago
Car makers have been held liable for the lack of intentionally designed safety features There’s plenty of precedent I think lack of safety features that meet our current common knowledge of the potential failure scenarios should be enough to shut down a company We can refuse to enable commerce that jeopardizes or personal safety (literal or ephemeral data theft) Capitalists are just humans. They can be culturally pressured and shunned. Such behavior has been a hallmark of human society since they began Physics is a vacuum of such rules. Human society has always had them
- jnwatson 8y ago
  It took a concerted campaign by Ralph Nader to hold car companies liable. It isn’t clear how that would work with software. Would FOSS authors be held liable? That would mean the end of open source.
spaceman1331 8y ago
https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25 The idea that tool manufacturers are not responsible for misuse or hacking is quite ridiculous. We have a legal system in the USA to hold manufacturers, both for both industrial and consumer applications, responsible when a design flaw causes harm. Vulnerabilities are design flaws. They make a product unsafe to use. The idea that routers are still safe when Russian hackers abuse them is not reality. They become dangerous vectors for viruses and harassment. The cost to the USA economy could be enormous in the case of a mass attack on routers. A router is military hardware. It can be used to militate. When routers are sold to consumers, this is done with the knowledge that a router can be exploited for military applications. A router is potentially an exploit that an adversary can use for reconnaissance or subversion. If a manufacturer is selling faulty military hardware as a consumer good and making sure exploits that hackers use are not fixed, that manufacturer is a traitor. The punishment for being a traitor is summary execution.
hfdgiutdryg 8y ago
Boy is that ever not true. https://www.woodshopnews.com/.amp/news/table-saw-suit-nets-1-5-million-verdict https://www.woodshopnews.com/.amp/news/table-saw-suit-nets-1... This guy was given a table saw with the guard already removed, and was using it on the floor (a table saw should be used at table height, so that you can have a foot forward to prevent falling into the blade). He was apparently not using push-sticks. Somehow, the table saw manufacturer was found 65% liable in the case, because technology exists to reduce the likelihood of injury when flesh contacts the blade. Specifically, SawStop, which I believe senses capacitance and fires an aluminum block into the blade. Here's a rather biased and snarky rundown of the whole thing that links some important bits of the backstory: https://www.bob-easton.com/blog/is-it-your-table-saw-or-the-governments/ https://www.bob-easton.com/blog/is-it-your-table-saw-or-the-...
- DannyBee 8y ago
  One thing he misses is that PTI, et al had explored flesh sensing technology and pretty much didn't feel like doing it. They also have opposed almost all safety standards. Oh, did I mention the members have many more ridiculous patents than gass? They've sued each other over patents on worksite radios before. https://insight.rpxcorp.com/litigation_documents/3919186 https://insight.rpxcorp.com/litigation_documents/3919186 They are also multi billion dollar conglomerates, often in countries with little respect for IP, so I imagine one reason he patented so much was to protect himself. They are also a lobbying org, and he misses all the things they did, yet points out what sawstop did. PTI has done a great job of lobbying here, unfortunately. I am generally not a fan of the CPSC (what they did on magnets was beyond the pale), but here he also missed the biggest point they made: the cost of table saw injuries, to the government and insurers, is greater than the value of the table saw market! I could go on. He seems like a mostly reasonable person (moreso than most on this issue), but yeah. There really are two sides to that part. Neither side is deserving of adoration, honestly. The court case is much simpler. For defective design liability in a lot of states, it's enough to show a feasible alternative design that would not have impacted function or price in a serious way. Most of the argument was about the latter.
  - mturmon 8y ago

pyre 8y ago

Most of these devices are insecure not because the attackers are hyper-sophisticated, but because the software is rushed and a second-thought to the hardware. There is no one (in power) at these companies that cares about crafting quality software. They just care about crafting the bare minimum to make their devices work. I wager that "security" is something fairly far from their mind when they craft this software, which I consider especially negligent for any company that is dealing in networked devices.

rock_hard 8y ago
It would probably be best to let the market regulate by itself but the issue here might be that it’s not visible to users that their router is infected.
- jeremyjh 8y ago
  That is right. This malware is an externality. Externalities typically need to be mitigated through regulation.
kelnos 8y ago
It's even worse: most of these companies don't even write the software for the low end consumer hardware. They just license it from a third party, usually in Asia, and pay them to turn features on or off and skin the UI for their branding. It's no surprise that routers from competing manufacturers are vulnerable, since it's all the same under the hood. The companies that sell the finished product have zero insight into how secure the software is.
- beojan 8y ago
  But there's open source software for this. Why don't they just use that?
  - pyre 8y ago
    There is no one to point the finger at (i.e. blame) when something goes wrong.
pbhjpbhj 8y ago
My router has the password saved in the page source ...

mikec3010 8y ago

Not true. Product liability lawsuits have been around for ages. It's just that the tech industry has been able to escape them, by and large. I think one of the greater injustices in business was Microsoft's avoidance of a lawsuit from their spate of windows malware from roughly 2003-2010. They just sat on their hands and let for-profit A/V companies and nonprofit volunteers secure their platform, while consumers lost millions of hours and billions of dollars to simply be able to use their computers again after being rooted by 4 lines of JavaScript

vntok 8y ago
> after being rooted by 4 lines of JavaScript Could you provide any sort of source for this extraordinary claim of yours?
- jwalton 8y ago
  That's probably an exaggeration, but I agree with the sentiment of what they are saying. It's not crazy hard to write quality software. Most corporations don't bother because they know they don't have to, since they can escape liability laws. It's gotten to the point where most software developers somehow view this situation as "normal". Do you have a QA department? What do they do? If you're like most software companies, they do testing. This is not QA, though, it's QV. The role of QA is to assure that the quality of your product is high. By the time you're testing it, the product is "done" - all of the defects are already there in the product. There is now nothing you can do to affect the quality of the product - all you can do is test and measure the overall quality of the product. I mean, your tests will find problems, and you can fix those problems. But, if you keep track of how many problems you find, and how much test effort was involved to find those problems, you can plot a weibull regression and make a prediction about how many defects you haven't found yet. On any project I've been on where we ran this analysis, it was obvious that testing was finding almost none of the problems - barely skimming the surface. And, when you ran this analysis you could predict how many defects you will find if you spend X days testing, and on any project where I've seen this analysis run, those predictions have been highly accurate. Really good automated tests can help with this, because they can do huge amounts of test effort "for free", but really QA should be about the process you follow when you write software - making sure you have a repeatable process, and then figuring out how to improve it. Almost no one does this.

lele92n 8y ago

Car makers have been held liable for the lack of intentionally designed safety features There’s plenty of precedent I think lack of safety features that meet our current common knowledge of the potential failure scenarios should be enough to shut down a company We can refuse to enable commerce that jeopardizes or personal safety (literal or ephemeral data theft) Capitalists are just humans. They can be culturally pressured and shunned. Such behavior has been a hallmark of human society since they began Physics is a vacuum of such rules. Human society has always had them

jnwatson 8y ago
It took a concerted campaign by Ralph Nader to hold car companies liable. It isn’t clear how that would work with software. Would FOSS authors be held liable? That would mean the end of open source.

spaceman1331 8y ago

https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25 The idea that tool manufacturers are not responsible for misuse or hacking is quite ridiculous. We have a legal system in the USA to hold manufacturers, both for both industrial and consumer applications, responsible when a design flaw causes harm. Vulnerabilities are design flaws. They make a product unsafe to use. The idea that routers are still safe when Russian hackers abuse them is not reality. They become dangerous vectors for viruses and harassment. The cost to the USA economy could be enormous in the case of a mass attack on routers. A router is military hardware. It can be used to militate. When routers are sold to consumers, this is done with the knowledge that a router can be exploited for military applications. A router is potentially an exploit that an adversary can use for reconnaissance or subversion. If a manufacturer is selling faulty military hardware as a consumer good and making sure exploits that hackers use are not fixed, that manufacturer is a traitor. The punishment for being a traitor is summary execution.

hfdgiutdryg 8y ago

Boy is that ever not true. https://www.woodshopnews.com/.amp/news/table-saw-suit-nets-1-5-million-verdict https://www.woodshopnews.com/.amp/news/table-saw-suit-nets-1... This guy was given a table saw with the guard already removed, and was using it on the floor (a table saw should be used at table height, so that you can have a foot forward to prevent falling into the blade). He was apparently not using push-sticks. Somehow, the table saw manufacturer was found 65% liable in the case, because technology exists to reduce the likelihood of injury when flesh contacts the blade. Specifically, SawStop, which I believe senses capacitance and fires an aluminum block into the blade. Here's a rather biased and snarky rundown of the whole thing that links some important bits of the backstory: https://www.bob-easton.com/blog/is-it-your-table-saw-or-the-governments/ https://www.bob-easton.com/blog/is-it-your-table-saw-or-the-...

DannyBee 8y ago
One thing he misses is that PTI, et al had explored flesh sensing technology and pretty much didn't feel like doing it. They also have opposed almost all safety standards. Oh, did I mention the members have many more ridiculous patents than gass? They've sued each other over patents on worksite radios before. https://insight.rpxcorp.com/litigation_documents/3919186 https://insight.rpxcorp.com/litigation_documents/3919186 They are also multi billion dollar conglomerates, often in countries with little respect for IP, so I imagine one reason he patented so much was to protect himself. They are also a lobbying org, and he misses all the things they did, yet points out what sawstop did. PTI has done a great job of lobbying here, unfortunately. I am generally not a fan of the CPSC (what they did on magnets was beyond the pale), but here he also missed the biggest point they made: the cost of table saw injuries, to the government and insurers, is greater than the value of the table saw market! I could go on. He seems like a mostly reasonable person (moreso than most on this issue), but yeah. There really are two sides to that part. Neither side is deserving of adoration, honestly. The court case is much simpler. For defective design liability in a lot of states, it's enough to show a feasible alternative design that would not have impacted function or price in a serious way. Most of the argument was about the latter.
- mturmon 8y ago