4 ms·

>If they make bad things, they should be liable for them. Define 'bad'. What one person sees as "insecure and bad" another person will view as "configurable a

by _red 8y ago

>If they make bad things, they should be liable for them. Define 'bad'. What one person sees as "insecure and bad" another person will view as "configurable and open". Ultimately the consumer shares a good percentage of blame.

crankylinuxuser 8y ago
Really now? Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks. We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware. > What one person sees as "insecure and bad" another person will view as "configurable and open". Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs? Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure. > Ultimately the consumer shares a good percentage of blame. That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
- supernovae 8y ago
  that would just drive up the costs significantly on tvs... I do like that Microsoft appears to be working on its smart tv's with pluggable compute modules so people could replace the compute platform on their tv with one of their preference.
  - crankylinuxuser 8y ago
    I'd disagree. The problem with most companies that put some intelligence in dumb devices is that they: 1. Rely on their own cloud platform 2. Use lockin to their specific plan 3. Fail to quickly respond to security incidences 4. Abandon when their next incremental version comes out And most of these types of devices are the ones that end up being a member in a botnet or other bad networks. The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
    - supernovae 8y ago
      I don't see what your argument is, the more i read it the more i see it supports my argument that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
      - crankylinuxuser 8y ago
        > that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
  - s73v3r_ 8y ago
    That's like saying that inspecting your meat would drive up the price. It is an absolute nonsense argument brought up by people who would prefer to have no responsibility for anything they do, ever.
    - supernovae 8y ago
      nah, inspecting meat is a one-off deal. What is being suggested is that the meat inspector has to certify your fridge/freezer is holding right temperature and is liable if the system fails and spoils the meat. With tv's you're looking at a one-off purchase with a long-tail support contract for years to certify and patch against any/all liabilities. The only way that would be profitable was if every smart tv required a service contract to support such demands, otherwise the model is flawed.
      - crankylinuxuser 8y ago
        > The only way that would be profitable was if every smart tv required a service contract to support such demands, otherwise the model is flawed. That's the point I'm trying to make. Support your shit properly, or keep the devices dumb. I prefer dumb, so I can add my own smarts without being tied to some shitty proprietary IoT.
        supernovae 8y ago
        thats not the consumer pattern though, and to be honest, you can get dumb tvs :)
        s73v3r_ 8y ago
        If the dumb tv is poorly engineered and sets my house on fire, then I would be able to sue them for liability. I see no reason whatsoever why I should not be able to do the same thing if their software causes issues.
- _red 8y ago
  >Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. In your proposed universe, you won't have a "smart tv" because you will choose not to pay the $3500 price tag to cover the security audits and increased litigation insurance that will accompany the manufacture of such devices. Most linux distros will also be sued out of existence. Such laws are a dream for authoritarian regimes. Ultimately there will be a only a small handful of monopoly powers who have enough resources to navigate the regulatory landscape.
  - MisterTea 8y ago
    Did you accurately calculate the extra expenses needed to create a secure TV? Or did you pull $3500 out of your ass to bolster your argument?
  - crankylinuxuser 8y ago
    And you're going to the "OMG regulatory hell" argument. Its only been the last 10 years since we've had idiotic "smart features". I'm proposing excising these "smart" features out of devices that don't need it. A TV/Monitor is and will be useful for the foreseeable future. A TV/MOnitor with bit-rotted 'smart features' will turn the device into a disposable device when the maintainer/owner finally wants to get rid of it.
    - _red 8y ago
      >A TV/Monitor is and will be useful for the foreseeable future. Then just buy a TV / Monitor?
      - ethbro 8y ago
        Have you tried this recently, for a high-end device in a category for which a smart alternative exists? E.g. TVs Without liability, there is no disincentivizing including smart features for manufacturers. I agree that "Use a user-patchable / open source / replaceable stack -> shielded from some liability" or "Lock everything down -> take on legal liability for your own security" is a sane system to put in place. There's no reason 50%+ of IoT devices (especially Chinese clones) aren't built top-to-bottom open source, aside from manufacturer ignorance / laziness.
s73v3r_ 8y ago
I'm sorry, but I am rejecting that argument. "Configurable" and "Secure" are not opposite ends of the same axis. They are different axis altogether, that have very little to do with each other.
deleted 8y ago
[deleted]

by _red 8y ago

crankylinuxuser 8y ago

Really now? Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks. We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware. > What one person sees as "insecure and bad" another person will view as "configurable and open". Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs? Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure. > Ultimately the consumer shares a good percentage of blame. That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.

supernovae 8y ago
that would just drive up the costs significantly on tvs... I do like that Microsoft appears to be working on its smart tv's with pluggable compute modules so people could replace the compute platform on their tv with one of their preference.
- crankylinuxuser 8y ago
  I'd disagree. The problem with most companies that put some intelligence in dumb devices is that they: 1. Rely on their own cloud platform 2. Use lockin to their specific plan 3. Fail to quickly respond to security incidences 4. Abandon when their next incremental version comes out And most of these types of devices are the ones that end up being a member in a botnet or other bad networks. The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
  - supernovae 8y ago
    I don't see what your argument is, the more i read it the more i see it supports my argument that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
    - crankylinuxuser 8y ago
      > that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
- s73v3r_ 8y ago
  That's like saying that inspecting your meat would drive up the price. It is an absolute nonsense argument brought up by people who would prefer to have no responsibility for anything they do, ever.
  - supernovae 8y ago
    nah, inspecting meat is a one-off deal. What is being suggested is that the meat inspector has to certify your fridge/freezer is holding right temperature and is liable if the system fails and spoils the meat. With tv's you're looking at a one-off purchase with a long-tail support contract for years to certify and patch against any/all liabilities. The only way that would be profitable was if every smart tv required a service contract to support such demands, otherwise the model is flawed.
    - crankylinuxuser 8y ago
      > The only way that would be profitable was if every smart tv required a service contract to support such demands, otherwise the model is flawed. That's the point I'm trying to make. Support your shit properly, or keep the devices dumb. I prefer dumb, so I can add my own smarts without being tied to some shitty proprietary IoT.
      - supernovae 8y ago
        thats not the consumer pattern though, and to be honest, you can get dumb tvs :)
        s73v3r_ 8y ago
        If the dumb tv is poorly engineered and sets my house on fire, then I would be able to sue them for liability. I see no reason whatsoever why I should not be able to do the same thing if their software causes issues.
_red 8y ago
>Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. In your proposed universe, you won't have a "smart tv" because you will choose not to pay the $3500 price tag to cover the security audits and increased litigation insurance that will accompany the manufacture of such devices. Most linux distros will also be sued out of existence. Such laws are a dream for authoritarian regimes. Ultimately there will be a only a small handful of monopoly powers who have enough resources to navigate the regulatory landscape.
- MisterTea 8y ago
  Did you accurately calculate the extra expenses needed to create a secure TV? Or did you pull $3500 out of your ass to bolster your argument?
- crankylinuxuser 8y ago
  And you're going to the "OMG regulatory hell" argument. Its only been the last 10 years since we've had idiotic "smart features". I'm proposing excising these "smart" features out of devices that don't need it. A TV/Monitor is and will be useful for the foreseeable future. A TV/MOnitor with bit-rotted 'smart features' will turn the device into a disposable device when the maintainer/owner finally wants to get rid of it.
  - _red 8y ago
    >A TV/Monitor is and will be useful for the foreseeable future. Then just buy a TV / Monitor?
    - ethbro 8y ago
      Have you tried this recently, for a high-end device in a category for which a smart alternative exists? E.g. TVs Without liability, there is no disincentivizing including smart features for manufacturers. I agree that "Use a user-patchable / open source / replaceable stack -> shielded from some liability" or "Lock everything down -> take on legal liability for your own security" is a sane system to put in place. There's no reason 50%+ of IoT devices (especially Chinese clones) aren't built top-to-bottom open source, aside from manufacturer ignorance / laziness.

s73v3r_ 8y ago

I'm sorry, but I am rejecting that argument. "Configurable" and "Secure" are not opposite ends of the same axis. They are different axis altogether, that have very little to do with each other.

deleted 8y ago

[deleted]