4 ms·

Hold on. This is a hardware device we are talking about here. You put it on your desk, physically interact with it, and plug it into your computer. Do you reali

Hold on. This is a hardware device we are talking about here. You put it on your desk, physically interact with it, and plug it into your computer. Do you realize all the ways the manufacturer could harm you if they were malicious, cut corners, were coerced by a state to compromise the device, or failed to comply with regulations? And you’re worried about their data handling policy? A short and very incomplete list of the things a purchaser of a Wacom tablet is trusting to be true: - That the tablet is safe to use - it will not fail in a way that exposes the user to electric shock hazards, sharp edges, dangerous chemicals, etc. - that the EM emissions used to communicate between the pen and tablet don’t interfere with other systems in ways that could compromise safety - that the device complies with usb standards and won’t damage electronics you interface it to - that there are no hidden surveillance devices in the tablet or pen - that, as an input device with access to your usb bus it doesn’t have the ability to be remotely induced to control your computer Then you’re installing a piece of driver software, giving it sufficient permissions that it can read what application is currently running, and you are worried about it exfiltrating that information, rather than - say - the fact that as an input driver, again, it has complete control over your computer; it can record input - what if you use your Wacom to sign a pdf? Now it knows your signature. Or you tap out your banking password using an on screen keyboard. Who knows what else it can do - acting at the user input level presumably it can do anything you the user can do. So sure, be concerned about what happens to the data it sends to Wacom, but if you don’t trust Wacom, your problems started much sooner than when you accepted the data sharing agreement.

tedunangst 7y ago
People were also upset about superfish.
- jameshart 7y ago
  This is all just another example software devs' parochial belief that because software is eating the world, any problem in software is terrible, while ignoring the whole stack of hardware in meatspace that supports the software in the first place. Like the whole 'internet-connected-cars' panic that occasionally grips developers. You know what's more dangerous than putting a car on the internet? putting a car on the road. There are other drivers out there who could kill you. Thousands of people actually die in accidents. And you want to worry about the infotainment system containing a remote execution vulnerability?
  - breischl 7y ago
    I think it's not that software devs don't care about hardware/meatspace issues, they're just not as well qualified to evaluate them. So they tend to focus on what they know. It's not bad to do that - you can't focus on everything. Also, wouldn't your argument equally imply that mechanical engineers should drop their parochial belief that hardware issues are terrible while ignoring software problems? (Presuming they do that, which seems not unlikely)
jmccorm 7y ago
I see that you've worked to raise some good points here and that you're not simply reducing this to whataboutism, right? I find it acceptable that a person focuses on their area of interest and expertise and reports what they find. I don't expect or want him to get into a 360 degree product review. Let's save "electric shock hazards, sharp edges" for someone else, and if they find nothing, that does not diminish his own findings, yes? After reading his analysis, I'm not sure how much I can trust Wacom's behavior when it comes to data collection. My concerns don't then jump to sharp edges and electrical shocks. I think about data retention. How well do they protect that data? I think about what Wacom might do with that detail of personal behavioral information if approached by a data broker with cash in hand and ready to make a purchase.
- jameshart 7y ago
  Right. So your point is that you don't trust Wacom. So why are you plugging their device into your USB port, logging in to your computer, and letting it operate your computer for you?
  - jmccorm 7y ago
    Negative, sir. Actually, I was responding to the points you had made. I still trust his investigation and I find it to be significant even if he didn't address all the concerns you raised (which are outside of the area of software engineering). He doesn't need to address outside issues (like the physical safety of the device) to validate his findings or concerns. Still, since you invited, I'll talk more about my own concerns. Do I trust Wacom as a company, as a whole? I think it depends on how they respond to this, right? Do I still trust them to make a tablet that doesn't have the problems you raised with "electric shock hazards, sharp edges"? Yes. At this moment, do I trust Wacom in the area of data collection? No, that seems to me like a questionable decision. I want to know more. I don't think I want an accessory manufacturer to compile a dossier of what programs I use at what time and from what (partially masked) IP address. More so when they're not being up-front about it (certainly from a layperson's perspective). I'm also not very confident right now that the behavioral data will stay within Wacom's walls and go no further. In fact, I'm forwarding this to my CISO's office for further evaluation. Is that bad in some way?
gmd63 7y ago
What prevents a small peripheral company from being a vector for hardware attacks via a foreign state? Is there an impartial inspection process that checks devices? It seems like it would be extremely lucrative for a person to facilitate that operation if they don't value the integrity of their nation.
- mzs 7y ago
  not much https://news.ycombinator.com/item?id=22251384 https://news.ycombinator.com/item?id=22251384

tedunangst 7y ago

People were also upset about superfish.

jameshart 7y ago
This is all just another example software devs' parochial belief that because software is eating the world, any problem in software is terrible, while ignoring the whole stack of hardware in meatspace that supports the software in the first place. Like the whole 'internet-connected-cars' panic that occasionally grips developers. You know what's more dangerous than putting a car on the internet? putting a car on the road. There are other drivers out there who could kill you. Thousands of people actually die in accidents. And you want to worry about the infotainment system containing a remote execution vulnerability?
- breischl 7y ago
  I think it's not that software devs don't care about hardware/meatspace issues, they're just not as well qualified to evaluate them. So they tend to focus on what they know. It's not bad to do that - you can't focus on everything. Also, wouldn't your argument equally imply that mechanical engineers should drop their parochial belief that hardware issues are terrible while ignoring software problems? (Presuming they do that, which seems not unlikely)

jmccorm 7y ago

I see that you've worked to raise some good points here and that you're not simply reducing this to whataboutism, right? I find it acceptable that a person focuses on their area of interest and expertise and reports what they find. I don't expect or want him to get into a 360 degree product review. Let's save "electric shock hazards, sharp edges" for someone else, and if they find nothing, that does not diminish his own findings, yes? After reading his analysis, I'm not sure how much I can trust Wacom's behavior when it comes to data collection. My concerns don't then jump to sharp edges and electrical shocks. I think about data retention. How well do they protect that data? I think about what Wacom might do with that detail of personal behavioral information if approached by a data broker with cash in hand and ready to make a purchase.

jameshart 7y ago
Right. So your point is that you don't trust Wacom. So why are you plugging their device into your USB port, logging in to your computer, and letting it operate your computer for you?
- jmccorm 7y ago
  Negative, sir. Actually, I was responding to the points you had made. I still trust his investigation and I find it to be significant even if he didn't address all the concerns you raised (which are outside of the area of software engineering). He doesn't need to address outside issues (like the physical safety of the device) to validate his findings or concerns. Still, since you invited, I'll talk more about my own concerns. Do I trust Wacom as a company, as a whole? I think it depends on how they respond to this, right? Do I still trust them to make a tablet that doesn't have the problems you raised with "electric shock hazards, sharp edges"? Yes. At this moment, do I trust Wacom in the area of data collection? No, that seems to me like a questionable decision. I want to know more. I don't think I want an accessory manufacturer to compile a dossier of what programs I use at what time and from what (partially masked) IP address. More so when they're not being up-front about it (certainly from a layperson's perspective). I'm also not very confident right now that the behavioral data will stay within Wacom's walls and go no further. In fact, I'm forwarding this to my CISO's office for further evaluation. Is that bad in some way?

gmd63 7y ago

What prevents a small peripheral company from being a vector for hardware attacks via a foreign state? Is there an impartial inspection process that checks devices? It seems like it would be extremely lucrative for a person to facilitate that operation if they don't value the integrity of their nation.

mzs 7y ago
not much https://news.ycombinator.com/item?id=22251384 https://news.ycombinator.com/item?id=22251384