6 ms·

California passes nation’s first IoT security bill – too little too late?

44 points by m_eiman 8y ago

jiveturkey 8y ago
good time to be in law school ...
crankylinuxuser 8y ago
You want to fix this? Get rid of/make void the fact that software and hardware companies disclaim any and all liability. If they make bad things, they should be liable for them. I would provide an exception to this, and that's if they are open sourced, able to upload firmwares, and able to revert to a safe baseband.
- _red 8y ago
  >If they make bad things, they should be liable for them. Define 'bad'. What one person sees as "insecure and bad" another person will view as "configurable and open". Ultimately the consumer shares a good percentage of blame.
  - crankylinuxuser 8y ago
    Really now? Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks. We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware. > What one person sees as "insecure and bad" another person will view as "configurable and open". Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs? Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure. > Ultimately the consumer shares a good percentage of blame. That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
    - supernovae 8y ago
      that would just drive up the costs significantly on tvs... I do like that Microsoft appears to be working on its smart tv's with pluggable compute modules so people could replace the compute platform on their tv with one of their preference.
      - crankylinuxuser 8y ago
        I'd disagree. The problem with most companies that put some intelligence in dumb devices is that they: 1. Rely on their own cloud platform 2. Use lockin to their specific plan 3. Fail to quickly respond to security incidences 4. Abandon when their next incremental version comes out And most of these types of devices are the ones that end up being a member in a botnet or other bad networks. The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
        supernovae 8y ago
        I don't see what your argument is, the more i read it the more i see it supports my argument that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
        crankylinuxuser 8y ago
        > that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
      - s73v3r_ 8y ago
        That's like saying that inspecting your meat would drive up the price. It is an absolute nonsense argument brought up by people who would prefer to have no responsibility for anything they do, ever.
  - s73v3r_ 8y ago
    I'm sorry, but I am rejecting that argument. "Configurable" and "Secure" are not opposite ends of the same axis. They are different axis altogether, that have very little to do with each other.
  - deleted 8y ago
    [deleted]
- jarfil 8y ago
  Consumers don't want that. There is already a kind of hardware and software where companies are liable: in medical equipment. Now look at what that does to the prices. Open source and consumer serviceable makes sense, but that's already being fought for with the "right to repair" movement.
  - monocasa 8y ago
    The medical field has all sorts of other market failures going on, that it's not really fair to compare their prices in that way.
    - logfromblammo 8y ago
      Look at the prices for hardware certified for permanent installation into an aircraft?
      - dsfyu404ed 8y ago
        You practically have to have every bolt be traceable back to the ore the iron for the steel was smelted from (this is only a slight exaggeration). That puts a huge additional cost on every unit shipped. Software is not subject to that. You can certify it once and amortize the cost over a million copies sold. The cost of testing is also much cheaper.
        logfromblammo 8y ago
        It isn't just the cost of testing. The barrier to entry, no matter how modest, is not what increases the price so much. It's the pricing power acquired from the lack of competition, as the barrier prevents new entrants. If three brands of GPS mapping device dominate the consumer market, but only one of them bothers to certify for aircraft, the exact same hardware in an aircraft dash-mount will cost many times the amount for a consumer handheld. Costs only determine prices for commodity suppliers. Everyone else charges what the market will bear.
  - philipov 8y ago
- dragonwriter 8y ago
  > Get rid of/make void the fact that software and hardware companies disclaim any and all liability It already is void or at least significantly limited by law in most jurisdictions. It might be better if we waived statutes of limitations and enhanced damages (e.g., 3× multiple) for damages where the basis of liability would be reasonably viewed as within the scope of a disclaimer which purported to disclaim liability that could not legally be disclaimed, so that there was a significant disincentive for the currently-routine overly-broad disclaimers.
  - deleted 8y ago
    [deleted]
- gnulinux 8y ago
  How would this affect FLOSS where pretty much all licenses reject liability? I personally believe an engineer has an implicit liability on everything they built, no matter what the license says, but that's the status quo.
ccnafr 8y ago
This is incorrect. The bill has not been signed into law. It can still get rejected by Gov. Brown, who has a habit of rejecting bills that come under criticism, and this one has received some criticism for its vague lingo.
- Bucephalus355 8y ago
  Quick thing on “vague lingo”. Vague lingo is currently accepted, among white-collar crime academics, as absolutely the best path forward for reining in corporate behavior. When you have very specific lingo, it’s extremely easy to circumvent the law. You want to keep the law vague and open so you have lots of maneuver room to prosecute. This assumes you trust the government, which when compared with companies I 97% do. Bruce Schneier’s latest book, “Click Here to Kill”, makes the same point [1]. [1] https://www.amazon.com/Click-Here-Kill-Everybody-Hyper-connected/dp/0393608883 https://www.amazon.com/Click-Here-Kill-Everybody-Hyper-conne...
  - trendia 8y ago
    Counter argument: Vague language is the best way to enable selective enforcement. Large companies who can afford the best lawyers will be able to find interpretations that are in their favor. Smaller companies would be unable to do this and thus more likely to lose. And this only gets worse if large companies spend more effort on lobbying — they can get vague wording that makes the public feel good (like something is happening!) but which requires no effort on the company to comply.
  - PurpleBoxDragon 8y ago
    >When you have very specific lingo, it’s extremely easy to circumvent the law. You want to keep the law vague and open so you have lots of maneuver room to prosecute. This assumes you trust the government, which when compared with companies I 97% do. Bruce Schneier’s latest book, “Click Here to Kill”, makes the same point [1]. Companies don't have a monopoly on force that the government does. This greatly changes how you calculate who the law should favor. I much prefer specific laws instead of laws that are selectively applied to whomever the government decides to target, because there is a long history of showing a very evil nature in how they pick targets.
olliej 8y ago
I’m not sure how good this law is. For example “best practice” is often interpreted as “includes a virus scanner”, yet as Travis Ormandy has shown over and over again virus scanners add huge attack vectors. Added to that the very nature of what virus scanners want to do means that the entire OS must allow exactly the type of code injection that malicious software wants. Yet there are places that will only purchase things that can run antivirus (because there are rules or regulations that require them to run antivirus).

44 points by m_eiman 8y ago

good time to be in law school ...

You want to fix this? Get rid of/make void the fact that software and hardware companies disclaim any and all liability. If they make bad things, they should be liable for them. I would provide an exception to this, and that's if they are open sourced, able to upload firmwares, and able to revert to a safe baseband.

_red 8y ago
>If they make bad things, they should be liable for them. Define 'bad'. What one person sees as "insecure and bad" another person will view as "configurable and open". Ultimately the consumer shares a good percentage of blame.
- crankylinuxuser 8y ago
  Really now? Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks. We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware. > What one person sees as "insecure and bad" another person will view as "configurable and open". Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs? Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure. > Ultimately the consumer shares a good percentage of blame. That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
  - supernovae 8y ago
    that would just drive up the costs significantly on tvs... I do like that Microsoft appears to be working on its smart tv's with pluggable compute modules so people could replace the compute platform on their tv with one of their preference.
    - crankylinuxuser 8y ago
      I'd disagree. The problem with most companies that put some intelligence in dumb devices is that they: 1. Rely on their own cloud platform 2. Use lockin to their specific plan 3. Fail to quickly respond to security incidences 4. Abandon when their next incremental version comes out And most of these types of devices are the ones that end up being a member in a botnet or other bad networks. The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
      - supernovae 8y ago
        I don't see what your argument is, the more i read it the more i see it supports my argument that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
        crankylinuxuser 8y ago
        > that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
    - s73v3r_ 8y ago
      That's like saying that inspecting your meat would drive up the price. It is an absolute nonsense argument brought up by people who would prefer to have no responsibility for anything they do, ever.
- s73v3r_ 8y ago
  I'm sorry, but I am rejecting that argument. "Configurable" and "Secure" are not opposite ends of the same axis. They are different axis altogether, that have very little to do with each other.
- deleted 8y ago
  [deleted]
jarfil 8y ago
Consumers don't want that. There is already a kind of hardware and software where companies are liable: in medical equipment. Now look at what that does to the prices. Open source and consumer serviceable makes sense, but that's already being fought for with the "right to repair" movement.
- monocasa 8y ago
  The medical field has all sorts of other market failures going on, that it's not really fair to compare their prices in that way.
  - logfromblammo 8y ago
    Look at the prices for hardware certified for permanent installation into an aircraft?
    - dsfyu404ed 8y ago
      You practically have to have every bolt be traceable back to the ore the iron for the steel was smelted from (this is only a slight exaggeration). That puts a huge additional cost on every unit shipped. Software is not subject to that. You can certify it once and amortize the cost over a million copies sold. The cost of testing is also much cheaper.
      - logfromblammo 8y ago
        It isn't just the cost of testing. The barrier to entry, no matter how modest, is not what increases the price so much. It's the pricing power acquired from the lack of competition, as the barrier prevents new entrants. If three brands of GPS mapping device dominate the consumer market, but only one of them bothers to certify for aircraft, the exact same hardware in an aircraft dash-mount will cost many times the amount for a consumer handheld. Costs only determine prices for commodity suppliers. Everyone else charges what the market will bear.
- philipov 8y ago
dragonwriter 8y ago
> Get rid of/make void the fact that software and hardware companies disclaim any and all liability It already is void or at least significantly limited by law in most jurisdictions. It might be better if we waived statutes of limitations and enhanced damages (e.g., 3× multiple) for damages where the basis of liability would be reasonably viewed as within the scope of a disclaimer which purported to disclaim liability that could not legally be disclaimed, so that there was a significant disincentive for the currently-routine overly-broad disclaimers.
- deleted 8y ago
  [deleted]
gnulinux 8y ago
How would this affect FLOSS where pretty much all licenses reject liability? I personally believe an engineer has an implicit liability on everything they built, no matter what the license says, but that's the status quo.

ccnafr 8y ago

This is incorrect. The bill has not been signed into law. It can still get rejected by Gov. Brown, who has a habit of rejecting bills that come under criticism, and this one has received some criticism for its vague lingo.

Bucephalus355 8y ago
Quick thing on “vague lingo”. Vague lingo is currently accepted, among white-collar crime academics, as absolutely the best path forward for reining in corporate behavior. When you have very specific lingo, it’s extremely easy to circumvent the law. You want to keep the law vague and open so you have lots of maneuver room to prosecute. This assumes you trust the government, which when compared with companies I 97% do. Bruce Schneier’s latest book, “Click Here to Kill”, makes the same point [1]. [1] https://www.amazon.com/Click-Here-Kill-Everybody-Hyper-connected/dp/0393608883 https://www.amazon.com/Click-Here-Kill-Everybody-Hyper-conne...
- trendia 8y ago
  Counter argument: Vague language is the best way to enable selective enforcement. Large companies who can afford the best lawyers will be able to find interpretations that are in their favor. Smaller companies would be unable to do this and thus more likely to lose. And this only gets worse if large companies spend more effort on lobbying — they can get vague wording that makes the public feel good (like something is happening!) but which requires no effort on the company to comply.
- PurpleBoxDragon 8y ago
  >When you have very specific lingo, it’s extremely easy to circumvent the law. You want to keep the law vague and open so you have lots of maneuver room to prosecute. This assumes you trust the government, which when compared with companies I 97% do. Bruce Schneier’s latest book, “Click Here to Kill”, makes the same point [1]. Companies don't have a monopoly on force that the government does. This greatly changes how you calculate who the law should favor. I much prefer specific laws instead of laws that are selectively applied to whomever the government decides to target, because there is a long history of showing a very evil nature in how they pick targets.

olliej 8y ago

I’m not sure how good this law is. For example “best practice” is often interpreted as “includes a virus scanner”, yet as Travis Ormandy has shown over and over again virus scanners add huge attack vectors. Added to that the very nature of what virus scanners want to do means that the entire OS must allow exactly the type of code injection that malicious software wants. Yet there are places that will only purchase things that can run antivirus (because there are rules or regulations that require them to run antivirus).