3 ms·

I once asked the author of “Magical Objects” - a book proselytizing about the future of IoT - about security. He blew it off, saying something along the lines o

I once asked the author of “Magical Objects” - a book proselytizing about the future of IoT - about security. He blew it off, saying something along the lines of “Security isn’t really necessary for these devices, but I’m sure someone’s working on it.” And thus we are here. When the evangelists don’t care about security, the industry won’t care about security. Well, maybe it’s the other way around. In either case, nobody in the industry cares about security.

save_ferris 6y ago
Just curious, what year did that conversation take place?
- falcolas 6y ago
  Around 2015. Enchanted Objects by David Rose
mcguire 6y ago
Frequently presented arguments: Worrying about things like security would adversely impact your time-to-market. Security isn't a feature---it has to be baked in from the ground floor and isn't apparent to the end user except as a annoyance. Security is a difficult problem that requires at least some minimum of knowledge and experience---knowledge and experience that are unrelated to the device or the development of its new features. There is no financial or professional upside to paying for security, and no financial downside to not doing so. Security is always regarded as a magic-bullet topic; there must be some magic pixie dust to sprinkle on the device to make security problems disappear. Like firewalls, VPNs, and encryption. Security problems have two advantages. First, they are rather rare and something that happens to other people. Second, they are easy to push off onto the end user: "Well, har, har, you wouldn't have this problem if you had just..." The devices themselves are regarded in black-or-white terms: either a coffeemaker with multiple processors is the best thing since Attila the Hun invented the pillage, or the whole idea is more idiotic than selling a fish a bicycle. No one is interested in a middleground, cost-benefit analysis. Yes, many of these put the responsibility for the (lack of) security of devices on the engineers and developers. That's why we get paid the big bucks.

save_ferris 6y ago

Just curious, what year did that conversation take place?

falcolas 6y ago
Around 2015. Enchanted Objects by David Rose

mcguire 6y ago

Frequently presented arguments: Worrying about things like security would adversely impact your time-to-market. Security isn't a feature---it has to be baked in from the ground floor and isn't apparent to the end user except as a annoyance. Security is a difficult problem that requires at least some minimum of knowledge and experience---knowledge and experience that are unrelated to the device or the development of its new features. There is no financial or professional upside to paying for security, and no financial downside to not doing so. Security is always regarded as a magic-bullet topic; there must be some magic pixie dust to sprinkle on the device to make security problems disappear. Like firewalls, VPNs, and encryption. Security problems have two advantages. First, they are rather rare and something that happens to other people. Second, they are easy to push off onto the end user: "Well, har, har, you wouldn't have this problem if you had just..." The devices themselves are regarded in black-or-white terms: either a coffeemaker with multiple processors is the best thing since Attila the Hun invented the pillage, or the whole idea is more idiotic than selling a fish a bicycle. No one is interested in a middleground, cost-benefit analysis. Yes, many of these put the responsibility for the (lack of) security of devices on the engineers and developers. That's why we get paid the big bucks.