3 ms·

> If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice. But if you want securi

> If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice. But if you want security standards, and bob does not, why should bob be forced to want them?

_s 7y ago
Isn’t that the same argument that can be applied to health? Vaccines, clean water, fluoride etc promote your well-being, and protect you from various bacteria and viruses. Why shouldn’t you protect your “digital” self as well?
jchw 7y ago
Isn’t this the healthcare argument but for security? Because it becomes an international problem when millions of EOL’d devices have a wormable flaw and can send enormous DDoS traffic stressing networks and taking sites offline?
- jeherr 7y ago
  Wouldn’t that be more of a problem if security is standardized though? If everyone has the same security, the same flaw makes everyone vulnerable. Multiple competing security types diversify the pool and prevent one flaw from causing all devices being susceptible to the same attack.
  - jchw 7y ago
    I fail to see how standardizing how long products are supported and how vulnerability reports are processed would cause everyone to have less security.
- bigiain 7y ago
  I can see it now. Anti-vax equivalents as IoT users... “I refuse to change away from my Linux2 busybox/php based home automation devices. https gives you autism!” (Maybe we can maintain “herd immunity” by abandoning ipv4, and moving the “healthy herd” all over to an ipv6 only internet?)
harimau777 7y ago
Because Bob puts others at risk by using an insecure device.
crazygringo 7y ago
For the same reason Bob is forced to buy car insurance in case he hits someone else's car. The botnet that infects Bob's equipment will harm others. The same way his car might.
- bigiain 7y ago
  That goes both ways though. GM/Ford/Tesla aren’t allowed to sell Bob a “less safe” version of their cars to undercut their competition. I suspect the long term answer here might look a lot like the auto industry. You won’t be allowed to sell network-connecting devices that don’t meet certain minimum security standards. Manufacturers will need to commit to a minimum security update period (like car manufactures need to commit to spare parts availability - for at least 10 years after the sale here in .au), and purchasers will will be required to accept responsibility for device’s operation, some of which will be mitigateable by insuring against it, but irresponsible use will not be covered by insurance and become the owner’s responsibility. (Admin while Under Influence? Speed limits on pushing patches?) I don’t see a clear path to that kind of regulatory control over $15 devices sourced directly out of China by every vanishing retailers/manufactures though, and there’s a whole raft of genuinely useful use cases for inexpensive net connected hardware that’d be impossible or illegal if the expense of the sort of regulatory burden place of car drivers was imposed on people with smart powerpoints or dash cams...

_s 7y ago

Isn’t that the same argument that can be applied to health? Vaccines, clean water, fluoride etc promote your well-being, and protect you from various bacteria and viruses. Why shouldn’t you protect your “digital” self as well?

jchw 7y ago

Isn’t this the healthcare argument but for security? Because it becomes an international problem when millions of EOL’d devices have a wormable flaw and can send enormous DDoS traffic stressing networks and taking sites offline?

jeherr 7y ago
Wouldn’t that be more of a problem if security is standardized though? If everyone has the same security, the same flaw makes everyone vulnerable. Multiple competing security types diversify the pool and prevent one flaw from causing all devices being susceptible to the same attack.
- jchw 7y ago
  I fail to see how standardizing how long products are supported and how vulnerability reports are processed would cause everyone to have less security.
bigiain 7y ago
I can see it now. Anti-vax equivalents as IoT users... “I refuse to change away from my Linux2 busybox/php based home automation devices. https gives you autism!” (Maybe we can maintain “herd immunity” by abandoning ipv4, and moving the “healthy herd” all over to an ipv6 only internet?)

harimau777 7y ago

Because Bob puts others at risk by using an insecure device.

crazygringo 7y ago

For the same reason Bob is forced to buy car insurance in case he hits someone else's car. The botnet that infects Bob's equipment will harm others. The same way his car might.

bigiain 7y ago
That goes both ways though. GM/Ford/Tesla aren’t allowed to sell Bob a “less safe” version of their cars to undercut their competition. I suspect the long term answer here might look a lot like the auto industry. You won’t be allowed to sell network-connecting devices that don’t meet certain minimum security standards. Manufacturers will need to commit to a minimum security update period (like car manufactures need to commit to spare parts availability - for at least 10 years after the sale here in .au), and purchasers will will be required to accept responsibility for device’s operation, some of which will be mitigateable by insuring against it, but irresponsible use will not be covered by insurance and become the owner’s responsibility. (Admin while Under Influence? Speed limits on pushing patches?) I don’t see a clear path to that kind of regulatory control over $15 devices sourced directly out of China by every vanishing retailers/manufactures though, and there’s a whole raft of genuinely useful use cases for inexpensive net connected hardware that’d be impossible or illegal if the expense of the sort of regulatory burden place of car drivers was imposed on people with smart powerpoints or dash cams...