3 ms·

Cisco is a Fly By Night IOT Corporation? Linksys?

AnthonyMouse 8y ago
> Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.
- staticassertion 8y ago
  > Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
  - AnthonyMouse 8y ago
    > I didn't say they did... I was providing two examples. But Cisco (i.e. Talos) are the ones finding the vulnerabilities in routers made by other companies in this case. > Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial? They still would be companies though. That's the point. If they expect to be out of business by then regardless, or they're outside of your jurisdiction, or they know they're judgment proof, it doesn't change their behavior. It's like trying to address homelessness by allowing the victims of panhandling to sue the perpetrators. There is no blood to be had from that stone. All you do is make the problem worse, because every company you destroy is a company which is no longer around to patch their installed base of devices. Meanwhile they're immediately replaced in the market by another company which is no better. Regulation and liability only works against monopolies and other huge companies. When you actually have a competitive market like this, you need to use the carrot rather than the stick.
    - learc83 8y ago
      >Regulation and liability only works against monopolies and other huge companies. That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. >There is no blood to be had from that stone. There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors, tree removal companies etc... The regulation says it's illegal to manufacturer, sale, or distribute non-licensed routers, and part of the requirement for licensing is insurance. I'm not saying that this is necessarily the best course of action in this instance, but there are definitely time tested solutions for the problem you're describing.
      - AnthonyMouse 8y ago
        > That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. There are many industries that are very competitive and full of small companies and have regulations, but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless. > There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors, tree removal companies etc... None of those things happen at scale. When a doctor makes a mistake, it affects one patient. A single security vulnerability can affect millions of people. That's the problem with this. Typically what regulators try to do with risk is to find a deep pocket to stick it to that can absorb it with minimal consequences, but there isn't one here because the risk is large compared to the (inexpensive) cost of the device. It's also a poor thing to try to insure because the main risk factor is code quality but insurance companies are generally not equipped to evaluate that. It doesn't help anybody to triple the price of every device just so the customer can still get pwned because once the insurance is covering it the developers lose the incentive the liability was supposed to be giving them to improve their security.
        learc83 8y ago
        >There are many industries that are very competitive and full of small companies and have regulations, but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless. Again I don't think this is true at all. Some counter examples: restaurants, electricians, general contractors, engineering firms, beauty salons, and tanning salons. >None of those things happen at scale. When a doctor makes a mistake, it affects one patient. A single security vulnerability can affect millions of people. A single bridge failure can affect an entire city, and a large building collapse could cost billions in payouts--yet engineering and construction firms can and do buy insurance to cover these things. Magnitude isn't a problem here, even insurance companies buy insurance from larger insurance companies. >It's also a poor thing to try to insure because the main risk factor is code quality but insurance companies are generally not equipped to evaluate that. Insurance companies are able to evaluate risk factors for every industry--they are better able to evaluate risk than anyone else, and it's not like they wouldn't hire domain experts. There's nothing special about software in this regard--it's a complex system, but the insurance industry regularly insurances against damage resulting from far more complex systems than software--weather for instance. I'm not sure if requiring router manufacturers to buy insurance would lead to a net benefit or not, but the problems you're creating have already been solved by other industries. There's nothing magic about software that makes it impossible to insure.

> Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.

staticassertion 8y ago
> Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
- AnthonyMouse 8y ago
  > I didn't say they did... I was providing two examples. But Cisco (i.e. Talos) are the ones finding the vulnerabilities in routers made by other companies in this case. > Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial? They still would be companies though. That's the point. If they expect to be out of business by then regardless, or they're outside of your jurisdiction, or they know they're judgment proof, it doesn't change their behavior. It's like trying to address homelessness by allowing the victims of panhandling to sue the perpetrators. There is no blood to be had from that stone. All you do is make the problem worse, because every company you destroy is a company which is no longer around to patch their installed base of devices. Meanwhile they're immediately replaced in the market by another company which is no better. Regulation and liability only works against monopolies and other huge companies. When you actually have a competitive market like this, you need to use the carrot rather than the stick.
  - learc83 8y ago
    >Regulation and liability only works against monopolies and other huge companies. That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. >There is no blood to be had from that stone. There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors, tree removal companies etc... The regulation says it's illegal to manufacturer, sale, or distribute non-licensed routers, and part of the requirement for licensing is insurance. I'm not saying that this is necessarily the best course of action in this instance, but there are definitely time tested solutions for the problem you're describing.
    - AnthonyMouse 8y ago
      > That's not true at all. Many industries that are very competitive and are full of small companies are effectively regulated. There are many industries that are very competitive and full of small companies and have regulations, but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless. > There's a simple fix to this problem. You require companies to carry insurance to cover the problems you're talking about. We do it with general contractors, doctors, tree removal companies etc... None of those things happen at scale. When a doctor makes a mistake, it affects one patient. A single security vulnerability can affect millions of people. That's the problem with this. Typically what regulators try to do with risk is to find a deep pocket to stick it to that can absorb it with minimal consequences, but there isn't one here because the risk is large compared to the (inexpensive) cost of the device. It's also a poor thing to try to insure because the main risk factor is code quality but insurance companies are generally not equipped to evaluate that. It doesn't help anybody to triple the price of every device just so the customer can still get pwned because once the insurance is covering it the developers lose the incentive the liability was supposed to be giving them to improve their security.
      - learc83 8y ago
        >There are many industries that are very competitive and full of small companies and have regulations, but what most commonly happens in those cases is that the regulations are rarely enforced which nobody much minds because the competition is preventing abusive practices regardless. Again I don't think this is true at all. Some counter examples: restaurants, electricians, general contractors, engineering firms, beauty salons, and tanning salons. >None of those things happen at scale. When a doctor makes a mistake, it affects one patient. A single security vulnerability can affect millions of people. A single bridge failure can affect an entire city, and a large building collapse could cost billions in payouts--yet engineering and construction firms can and do buy insurance to cover these things. Magnitude isn't a problem here, even insurance companies buy insurance from larger insurance companies. >It's also a poor thing to try to insure because the main risk factor is code quality but insurance companies are generally not equipped to evaluate that. Insurance companies are able to evaluate risk factors for every industry--they are better able to evaluate risk than anyone else, and it's not like they wouldn't hire domain experts. There's nothing special about software in this regard--it's a complex system, but the insurance industry regularly insurances against damage resulting from far more complex systems than software--weather for instance. I'm not sure if requiring router manufacturers to buy insurance would lead to a net benefit or not, but the problems you're creating have already been solved by other industries. There's nothing magic about software that makes it impossible to insure.