5 ms·

I’m not overly bothered about this. Their access vectors are more likely to get noticed in bulk and patched so the entire idea is self defeating in the long run

by setquk 8y ago

I’m not overly bothered about this. Their access vectors are more likely to get noticed in bulk and patched so the entire idea is self defeating in the long run. Which is beneficial for all of us.

Xylakant 8y ago
Given that many many many devices are not patched despite known vulnerabilities, I'd not be overly optimistic about this. Vendors do not provide patches for devices, Vendors go out of business, Users don't patch even when patches are available. This affects everything, routers, phones, IP cameras, you name it. I'd rather expect that the access vectors get noticed and applied by criminals en masse.
- mirimir 8y ago
  Sure, but the key point is that the access vectors will get noticed, and publicized. And people who pay attention and care (including many criminals) will protect themselves.
- anilakar 8y ago
  Ah, the horrors of lifecycle management of consumer devices. Every networked product should come with a legally binding A4/letter-sized sheet that clearly shows the last date the product is guaranteed to receive security patches. Not fulfilling the requirements would have to result in a buyback with the sum directly proportional to whatever time of the promised lifetime is left unused. EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.
  - TomMarius 8y ago
    > EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software. That is definitely covered by the standard 2 year warranty as insecurity (when security is expected) is seen as defect. If they don't fix it you get your money back. I successfully got my money back for several phones after 1 to 1.5 years.
    - andai 8y ago
      First time I've heard of this, this is really interesting. Don't most phones release updates for the first ~2 years? Maybe this law is the reason?
      - TomMarius 8y ago
        Indeed most phones do. This law however applies to resellers of cheap chinese phones of small brands as well, which was my case.
TomMarius 8y ago
Eh, how does that make it OK in any way?
- setquk 8y ago
  It doesn’t make it ok but it makes it self defeating. We can’t win the ok battle any more as no one up top gives a shit clearly.
  - TomMarius 8y ago
    I'm absolutely sure it's self defeating only temporarily and/or when it doesn't matter. Governments can use literally any amount of money and other resources if they care, and there are many people who wouldn't even require extraordinary sums (being in army is not exactly well paid). We're going full speed into totality. It was absolutely the same when the communist regime started in my home country: People were saying they would not use their new powers against ordinary people and that seizing all farmland would be impractical and then after few years of silence KGB and gulags and executions happened (our local alternatives of course).
    - setquk 8y ago
      They can but they don’t pay people much and you have to be morally bankrupt to work there. Very few people fit that niche. After paying £27k+ in tuition fees grad priority is earning so the government chased them off too.
      - TomMarius 8y ago
        Not at all. Most people see working for their country as a good thing. They can start paying people literally any sum of money literally any minute they want. And even if UK people wouldn't work for them, mercenaries are common.
        setquk 8y ago
        Not here in the UK. Once you’ve taken a public sector position you are tainted.

by setquk 8y ago

I’m not overly bothered about this. Their access vectors are more likely to get noticed in bulk and patched so the entire idea is self defeating in the long run. Which is beneficial for all of us.

Xylakant 8y ago

Given that many many many devices are not patched despite known vulnerabilities, I'd not be overly optimistic about this. Vendors do not provide patches for devices, Vendors go out of business, Users don't patch even when patches are available. This affects everything, routers, phones, IP cameras, you name it. I'd rather expect that the access vectors get noticed and applied by criminals en masse.

mirimir 8y ago
Sure, but the key point is that the access vectors will get noticed, and publicized. And people who pay attention and care (including many criminals) will protect themselves.
anilakar 8y ago
Ah, the horrors of lifecycle management of consumer devices. Every networked product should come with a legally binding A4/letter-sized sheet that clearly shows the last date the product is guaranteed to receive security patches. Not fulfilling the requirements would have to result in a buyback with the sum directly proportional to whatever time of the promised lifetime is left unused. EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software.
- TomMarius 8y ago
  > EU countries already have rather strict consumer protection laws but they really haven't been designed for situations where a hardware product can be rendered unusable by insecure software. That is definitely covered by the standard 2 year warranty as insecurity (when security is expected) is seen as defect. If they don't fix it you get your money back. I successfully got my money back for several phones after 1 to 1.5 years.
  - andai 8y ago
    First time I've heard of this, this is really interesting. Don't most phones release updates for the first ~2 years? Maybe this law is the reason?
    - TomMarius 8y ago
      Indeed most phones do. This law however applies to resellers of cheap chinese phones of small brands as well, which was my case.

TomMarius 8y ago

Eh, how does that make it OK in any way?

setquk 8y ago
It doesn’t make it ok but it makes it self defeating. We can’t win the ok battle any more as no one up top gives a shit clearly.
- TomMarius 8y ago
  I'm absolutely sure it's self defeating only temporarily and/or when it doesn't matter. Governments can use literally any amount of money and other resources if they care, and there are many people who wouldn't even require extraordinary sums (being in army is not exactly well paid). We're going full speed into totality. It was absolutely the same when the communist regime started in my home country: People were saying they would not use their new powers against ordinary people and that seizing all farmland would be impractical and then after few years of silence KGB and gulags and executions happened (our local alternatives of course).
  - setquk 8y ago
    They can but they don’t pay people much and you have to be morally bankrupt to work there. Very few people fit that niche. After paying £27k+ in tuition fees grad priority is earning so the government chased them off too.
    - TomMarius 8y ago
      Not at all. Most people see working for their country as a good thing. They can start paying people literally any sum of money literally any minute they want. And even if UK people wouldn't work for them, mercenaries are common.
      - setquk 8y ago
        Not here in the UK. Once you’ve taken a public sector position you are tainted.