3 ms·

Another step in the silly device manufacturer / device owner arms-race. As long as people keep rewarding device manufacturers who treat owners as tenants it wil

Another step in the silly device manufacturer / device owner arms-race. As long as people keep rewarding device manufacturers who treat owners as tenants it will progress. I wish people would just stop buying this garbage. They won't, though-- they see the features but not the down-side. The next step will be hard-coded DoH server IPs. Sly owners will NAT those to a transparent MiTM proxy. Then device manufacturers will counter with certificate pinning for DoH. That will be "game over", and the device manufacturers win. (It'll be a double-win, actually. It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires.) I believe the owner of a device has right to control the device's network traffic (and, more generally, control of the code running on the device). Business models that rely on taking away an owner's control of their rightfully-purchased general purpose computing devices are really rental models and should be handled as such. I eschew these kinds of devices, use or create self-hosted solutions where I can, and just do without when I can't. It does make me a little sad that I can't get some of these cool "living in the future"-type devices, but I'd be sadder to have my home festooned with manufacturer-controlled surveillance and advertising delivery devices. I wish there was a way to convince the average non-technical person of the merits of owner control. Given the enthusiastic responses in favor of allowing device manufacturers to mistreat owners I see from the Hacker News community, though, even convincing technical people is a lost cause. It feels like most people really want to be subjugated. It doesn't seem ratioinal. I do recognize that the Hacker News community also includes some of the people who profit from subjugation of device owners. Their motivation seems rational (if not sociopathic).

black3r 6y ago
> It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires. If you're certificate pinning an IP address for use with your own software, you can just create a self-signed cert with expiration date set to 2999 or some commonly ridiculous date you don't expect your devices will live to.
- wang_li 6y ago
  Why would they do that when they can force you to update your firmware by setting the expiration to a year or even less. This way you are guaranteed to be communicating with the mothership and the devices will incorporate any new malfeatures the manufacturer conceives.
zo1 6y ago
I think that "privacy" is being used as a trojan-horse in this regard. Technical-minded people are especially reactionary to any criticism of HTTPs and the other related things that will inevitably arise from giving entities effectively an end-to-end untamperable and non-user-controlled pipe straight into your TV/Monitor from their server. In an alternate universe, "ability to control/mitm data going through your network" could have been argued to be a fundamental right such as "right to repair" and "right to be forgotten". Where is the EFF on this? Where is Stallman when you need him again? Why is Mozilla not fighting this instead of pushing DoH?! EU regulators? Anyone?
- ivanivanovich 6y ago
  if the software running in all this IoT crap was free software users could control the data that goes thru their network, right?
JohnBooty 6y ago
As long as people keep rewarding device manufacturers who treat owners as tenants it will progress. I wish people would just stop buying this garbage. They won't, though-- they see the features but not the down-side. I hope that folks who blindly espouse free markets above all else realize that this sort of thing is the inevitable consequence. Consumers nearly always shop with price as a primary concern, and almost never have the sort of detailed domain knowledge to understand pitfalls like the ones discussed here. We certainly do not want the government to control too many things and should err on the side of freedom, but the result of too little consumer protection by the government means that situations like this are an absolutely guaranteed outcome. Educated consumers are a good and necessary thing to have, but that falls far short of correcting the issue. It is impossible for a single person to have expert domain knowledge in every single product category. I've been a software developer for 20 years, so (relative to the general population, not HN) I am an "expert" of sorts in this field, but I am assuredly not also an expert in automobiles, food safety, home appliance safety, airline maintenance, medicine, or any of the other things upon which I might spend money.
judge2020 6y ago
> The next step will be hard-coded DoH server IPs. 1^4 exposes an endpoint on the regular IPs (1.1.1.1/dns-query) and dns.google is just pointing to the 2 IPs, so you could hardcode those as well. Not that you can redirect it: > Sly owners will NAT those to a transparent MiTM proxy. And do what about the pinned certificate/CA?

black3r 6y ago

> It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires. If you're certificate pinning an IP address for use with your own software, you can just create a self-signed cert with expiration date set to 2999 or some commonly ridiculous date you don't expect your devices will live to.

wang_li 6y ago
Why would they do that when they can force you to update your firmware by setting the expiration to a year or even less. This way you are guaranteed to be communicating with the mothership and the devices will incorporate any new malfeatures the manufacturer conceives.

zo1 6y ago

I think that "privacy" is being used as a trojan-horse in this regard. Technical-minded people are especially reactionary to any criticism of HTTPs and the other related things that will inevitably arise from giving entities effectively an end-to-end untamperable and non-user-controlled pipe straight into your TV/Monitor from their server. In an alternate universe, "ability to control/mitm data going through your network" could have been argued to be a fundamental right such as "right to repair" and "right to be forgotten". Where is the EFF on this? Where is Stallman when you need him again? Why is Mozilla not fighting this instead of pushing DoH?! EU regulators? Anyone?

ivanivanovich 6y ago
if the software running in all this IoT crap was free software users could control the data that goes thru their network, right?

JohnBooty 6y ago

As long as people keep rewarding device manufacturers who treat owners as tenants it will progress. I wish people would just stop buying this garbage. They won't, though-- they see the features but not the down-side. I hope that folks who blindly espouse free markets above all else realize that this sort of thing is the inevitable consequence. Consumers nearly always shop with price as a primary concern, and almost never have the sort of detailed domain knowledge to understand pitfalls like the ones discussed here. We certainly do not want the government to control too many things and should err on the side of freedom, but the result of too little consumer protection by the government means that situations like this are an absolutely guaranteed outcome. Educated consumers are a good and necessary thing to have, but that falls far short of correcting the issue. It is impossible for a single person to have expert domain knowledge in every single product category. I've been a software developer for 20 years, so (relative to the general population, not HN) I am an "expert" of sorts in this field, but I am assuredly not also an expert in automobiles, food safety, home appliance safety, airline maintenance, medicine, or any of the other things upon which I might spend money.

judge2020 6y ago

> The next step will be hard-coded DoH server IPs. 1^4 exposes an endpoint on the regular IPs (1.1.1.1/dns-query) and dns.google is just pointing to the 2 IPs, so you could hardcode those as well. Not that you can redirect it: > Sly owners will NAT those to a transparent MiTM proxy. And do what about the pinned certificate/CA?