7 ms·

>“Prevent malicious software attacks on your TV by scanning for viruses on your TV every few weeks,” This reads like an Onion parody article but unfortunately

by jasode 7y ago

>“Prevent malicious software attacks on your TV by scanning for viruses on your TV every few weeks,” This reads like an Onion parody article but unfortunately, that security precaution is reality. To generalize the Samsung example further, this is why I don't believe it's realistic that decentralization can happen via average homeowners owning a "server appliance" that serves up webpages, social media profiles, videos, email, etc. I made a previous comment on how disciplined security practices are too tricky for non-techies.[0] Yes, a bunch of techies can run personal servers (Raspberry Pis, Freedombox, etc) to run a decentralized Q&A site to replace Stackoverflow. Or maybe run a decentralized discussion forum to replace HN. However, a bunch of grandmothers cannot be expected to maintain their own web appliances to run a decentralized cooking recipes website. [0] https://news.ycombinator.com/item?id=11861683 https://news.ycombinator.com/item?id=11861683

eudora 7y ago
If the base of their site was served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. Say it's a frontend over a Docker image that gets updated upstream for security issues, and the server has a Cron job that keeps it up to date. Why couldn't that work? I know there's some centralisation around the Docker image, but that could be open source or provided by someone like Mozilla or Apache or WordPress who we can trust. And there's no reason why the user couldn't choose from a whole ecosystem of image providers with a simple enough UI
- jasode 7y ago
  >served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. [...] Docker image that gets updated upstream for security issues [...] Why couldn't that work? The update process itself acts as an attack vector. Even the techies like programmers can get pwned with trusted repositories that suddenly became untrusted.[0][1][2] A decentralized server appliance of powerful sophistication that requires updates will require a baseline level of technical expertise. So far, even the less sophisticated hardware like wifi cameras and Nest devices are leaving unwitting homeowners exposed to criminals and unwanted spying.[3][4] [0] https://www.theregister.co.uk/2018/07/12/npm_eslint/ https://www.theregister.co.uk/2018/07/12/npm_eslint/ [1] https://www.infoworld.com/article/3184399/malware-finds-unwitting-ally-in-github.html https://www.infoworld.com/article/3184399/malware-finds-unwi... [2] https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-linux-distro-infected-with-malware/ https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-l... [3] https://www.google.com/search?q=home+wifi+cameras+hacked https://www.google.com/search?q=home+wifi+cameras+hacked [4] https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-people-through-their-smart-tvs-leaked-documents-reveal https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-p...
walterbell 7y ago
Grandmothers and everyone else already use edge routers/modems that can be centrally managed and updated. Edge servers can be locally or centrally managed. If centrally managed, they can be decoupled from the telco, i.e. competition among "edge server management services" instead of a land-bound monopoly. Techies can optionally enable local management.
- jsty 7y ago
  Is there any reason to suppose that such "centralised decentralisation" wouldn't end up with a small number of entities managing the centralised control planes thanks to economies of scale?
  - walterbell 7y ago
    Since devices can be owned by the user, a range of business relationships are possible. Some data on the user-owned device can have a different legal status than data owned by a central provider. E2E encryption and separation of ownership can exist alongside capital-fueled consolidation of data. It's not necessary for edge devices to "win" against centralization, only that they exist and are sustainably funded. Microsoft, HP and Dell/VMware have device-as-service offerings. There can be many permutations of control planes between local and central, or even regional.
  - wmf 7y ago
    It would absolutely end up that way but that's OK as long as the "rebels" can still interoperate.
- everdrive 7y ago
  I don't know a single Grandmother than keeps her WiFi router updated and well configured.
  - walterbell 7y ago
    Some telcos do this automatically, where the WiFI router is combined with telco-provided modem. Azure Sphere edge devices will have 10 years of Linux security updates from Microsoft, even if the vendor goes out of business.
komali2 7y ago
Techies that also like cooking can build it for their grandmas. I think people underestimate folks. Given time I've known tech illiterate people to figure out all kinds of hacks.
- josephg 7y ago
  The problem is that it’s not obvious when you’re behind on security patches. You can only fix what you can see. And without knowledge in security, you can’t see insecure / unpatched software. That said, maybe something like what Chrome does or what windows does would work ok. Pick a time / heuristic and install security updates automatically out of the box.
pessimizer 7y ago
> this is why I don't believe it's realistic that decentralization can happen via average homeowners owning a "server appliance" that serves up webpages, social media profiles, videos, email, etc. Which is why they should pay someone. The reason the tech should be open and decentralized is so that Samsung doesn't have control over it, the grandmothers can choose a vendor they trust. This would also create a lot of low level tech employment, a B2B market for management software, a market for physical support, etc.. I could manage servers for at least 200 grandmothers; 200 grandmothers would probably mean 5-10 calls a day, a quick check of new threats and exploits, a bit of research into new features that my grandmothers might be interested in, a check on their backup status. I might have to call a service to visit one of my grandmothers and make sure that their physical appliance is installed correctly, or to replace it. I always think that this criticism is due to a lack of imagination. I know how to take care of a home server, and I'm lazy about it. I would be entirely happy to send somebody $20/month to do it for me, as long as that person were my employee, not some massive corporation who works against my interest.
- pavel_lishin 7y ago
  > Which is why they should pay someone. What we should do is pay a small boy to go around town breaking windows, and then grandmas should pay someone to either replace their windows, or to install some sort of decentralized window-protection hardware. This would create a lot of low-level ok I can't keep typing these words anymore. What we should do is stop cramming processors and networking hardware into everything willy-nilly just so some advertising company can make 1/20th of a cent off my eyeballs. Your suggestion that the solution to the problem should be handled downstream, out of my grandma's wallet, is frankly insulting.
  - pessimizer 7y ago
    I don't even understand what this complaint means. Your grandmother doesn't take her garbage to the dump or cut her own lawn, I'm suggesting that she pay someone to handle her computer too. What I'm not suggesting is that we should pay a little boy to run around shitting on people's lawns and turning over trash cans. In fact, I'm going to be bold and suggest that we not do that. edit: as far as I can interpret, your argument seems to be that every company using advertising to make money, and making their televisions smart in order to help them to sell more advertising, should just stop. That's not a plan.
wmf 7y ago
If grandma can "maintain" an iPhone then she can maintain a server... as long as the server OS is designed for actual security instead of blame-the-user.
- deleted 7y ago
  [deleted]
dzhiurgis 7y ago
Wow a computer connected to internet can be hacked! Dear people, if you don't like smart tv's - don't connect them to internet. Everything can get hacked. Whether it's Roku, AppleTV or your local cable STB... Not saying Samsung software is any better or worse, but why we are surprised by this?

by jasode 7y ago

eudora 7y ago

If the base of their site was served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. Say it's a frontend over a Docker image that gets updated upstream for security issues, and the server has a Cron job that keeps it up to date. Why couldn't that work? I know there's some centralisation around the Docker image, but that could be open source or provided by someone like Mozilla or Apache or WordPress who we can trust. And there's no reason why the user couldn't choose from a whole ecosystem of image providers with a simple enough UI

jasode 7y ago
>served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform. [...] Docker image that gets updated upstream for security issues [...] Why couldn't that work? The update process itself acts as an attack vector. Even the techies like programmers can get pwned with trusted repositories that suddenly became untrusted.[0][1][2] A decentralized server appliance of powerful sophistication that requires updates will require a baseline level of technical expertise. So far, even the less sophisticated hardware like wifi cameras and Nest devices are leaving unwitting homeowners exposed to criminals and unwanted spying.[3][4] [0] https://www.theregister.co.uk/2018/07/12/npm_eslint/ https://www.theregister.co.uk/2018/07/12/npm_eslint/ [1] https://www.infoworld.com/article/3184399/malware-finds-unwitting-ally-in-github.html https://www.infoworld.com/article/3184399/malware-finds-unwi... [2] https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-linux-distro-infected-with-malware/ https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-l... [3] https://www.google.com/search?q=home+wifi+cameras+hacked https://www.google.com/search?q=home+wifi+cameras+hacked [4] https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-people-through-their-smart-tvs-leaked-documents-reveal https://www.vice.com/en_us/article/8qbq5x/the-cia-spied-on-p...

walterbell 7y ago

Grandmothers and everyone else already use edge routers/modems that can be centrally managed and updated. Edge servers can be locally or centrally managed. If centrally managed, they can be decoupled from the telco, i.e. competition among "edge server management services" instead of a land-bound monopoly. Techies can optionally enable local management.

jsty 7y ago
Is there any reason to suppose that such "centralised decentralisation" wouldn't end up with a small number of entities managing the centralised control planes thanks to economies of scale?
- walterbell 7y ago
  Since devices can be owned by the user, a range of business relationships are possible. Some data on the user-owned device can have a different legal status than data owned by a central provider. E2E encryption and separation of ownership can exist alongside capital-fueled consolidation of data. It's not necessary for edge devices to "win" against centralization, only that they exist and are sustainably funded. Microsoft, HP and Dell/VMware have device-as-service offerings. There can be many permutations of control planes between local and central, or even regional.
- wmf 7y ago
  It would absolutely end up that way but that's OK as long as the "rebels" can still interoperate.
everdrive 7y ago
I don't know a single Grandmother than keeps her WiFi router updated and well configured.
- walterbell 7y ago
  Some telcos do this automatically, where the WiFI router is combined with telco-provided modem. Azure Sphere edge devices will have 10 years of Linux security updates from Microsoft, even if the vendor goes out of business.

komali2 7y ago

Techies that also like cooking can build it for their grandmas. I think people underestimate folks. Given time I've known tech illiterate people to figure out all kinds of hacks.

josephg 7y ago
The problem is that it’s not obvious when you’re behind on security patches. You can only fix what you can see. And without knowledge in security, you can’t see insecure / unpatched software. That said, maybe something like what Chrome does or what windows does would work ok. Pick a time / heuristic and install security updates automatically out of the box.

pessimizer 7y ago

> this is why I don't believe it's realistic that decentralization can happen via average homeowners owning a "server appliance" that serves up webpages, social media profiles, videos, email, etc. Which is why they should pay someone. The reason the tech should be open and decentralized is so that Samsung doesn't have control over it, the grandmothers can choose a vendor they trust. This would also create a lot of low level tech employment, a B2B market for management software, a market for physical support, etc.. I could manage servers for at least 200 grandmothers; 200 grandmothers would probably mean 5-10 calls a day, a quick check of new threats and exploits, a bit of research into new features that my grandmothers might be interested in, a check on their backup status. I might have to call a service to visit one of my grandmothers and make sure that their physical appliance is installed correctly, or to replace it. I always think that this criticism is due to a lack of imagination. I know how to take care of a home server, and I'm lazy about it. I would be entirely happy to send somebody $20/month to do it for me, as long as that person were my employee, not some massive corporation who works against my interest.

pavel_lishin 7y ago
> Which is why they should pay someone. What we should do is pay a small boy to go around town breaking windows, and then grandmas should pay someone to either replace their windows, or to install some sort of decentralized window-protection hardware. This would create a lot of low-level ok I can't keep typing these words anymore. What we should do is stop cramming processors and networking hardware into everything willy-nilly just so some advertising company can make 1/20th of a cent off my eyeballs. Your suggestion that the solution to the problem should be handled downstream, out of my grandma's wallet, is frankly insulting.
- pessimizer 7y ago
  I don't even understand what this complaint means. Your grandmother doesn't take her garbage to the dump or cut her own lawn, I'm suggesting that she pay someone to handle her computer too. What I'm not suggesting is that we should pay a little boy to run around shitting on people's lawns and turning over trash cans. In fact, I'm going to be bold and suggest that we not do that. edit: as far as I can interpret, your argument seems to be that every company using advertising to make money, and making their televisions smart in order to help them to sell more advertising, should just stop. That's not a plan.

wmf 7y ago

If grandma can "maintain" an iPhone then she can maintain a server... as long as the server OS is designed for actual security instead of blame-the-user.

deleted 7y ago
[deleted]

dzhiurgis 7y ago

Wow a computer connected to internet can be hacked! Dear people, if you don't like smart tv's - don't connect them to internet. Everything can get hacked. Whether it's Roku, AppleTV or your local cable STB... Not saying Samsung software is any better or worse, but why we are surprised by this?