11 ms·

Why are new devices dependent on the Internet but made with little forethought?

• chadlavi 6y ago
  Spoiler alert: the answer is that it's more profitable that way.
  • pas 6y ago
    Especially on the short term. It's much easier/cheaper to make something that's not even planned to last long. And people don't care about the long term. :(
    • ASalazarMX 6y ago
      - Move Fast! Break things! - Sir, that was for software, not hardware.
      • pas 6y ago
        SpaceX has entered the chat
        • ASalazarMX 6y ago
          At least they're breaking the things they paid for, not the ones I paid for.
          • pas 6y ago
            TP-Link has 2 years of warranty, 5 years for their "business" product line. The terms seem clear. Probably iRobot has similar terms and conditions when they sell their robots, right? I mean, eventually someone has to pay for R&D. (Sure, I'm not saying this is the best way, but apparently people really don't like paying for R&D - see how the Ubuntu phone, OpenMoko and similar projects basically flopped.) It turns out to really get money (financial capital) for research, the best way is to be in the market. Just research things tend to move very slowly.
• ddingus 6y ago
  This is pretty much why I have yet to buy into any internet of things devices and look really hard at what something can do, will do offline. Maybe one day when all this is actual infrastructure and all that goes with the idea, standards, service entities who will be there, are regulated, etc. Maybe then, I will reconsider. And let's be clear. I have no problem with pioneers pioneering. Have fun! I just have different priorities.
• bwanab 6y ago
  Why are new devices dependent on the internet but made without a thought to the security of the user?
  • pas 6y ago
    Consumers in general have no internal model of security. It's enough that there's a sticker on the box saying that "even more secure than last year" or "2021-ready security". It's cheap, it works for a year or two. It's apparently more than enough.
  • vkou 6y ago
    Because the demonstrable[1] security risks for most people of their vacuum cleaner or thermostat getting pwned are non-existent. [1] I'm not talking about theoretical geek-fantasy concerns about how the Mossad, or some other sufficiently sinister and all-powerful organization[2], can stop your heart by varying the power setting on your internet-connected Roomba, or map out the internal layout of your apartment and fly a poison-dart-tipped AI-controlled drone into it. I'm talking about actual, demonstrable harm to the typical end user. People grousing on the internet about security have done an incredibly poor job of this. [2] That for some reason is futzing around with thermostat zero-days, instead of just taping a bomb to the underside of your car, or scrubbing your teapot with polonium, or jabbing you with a poison-tipped umbrella.
• nijave 6y ago
  I wonder--if some years ago--people were asking the same question about electricity
  • mcguire 6y ago
    Probably. On the other hand, electricity replaced many things that were either more dangerous in themselves (like gas lighting) or more physical work (like laundry). And the only significant downside (I'm ignoring the dangers electricity posed) was that it sometimes stopped working, although in those cases you probably had your manual fall-back (candles and a wash-tub).
  • ASalazarMX 6y ago
    I hope someday we reach on IOT the same safety electricity has today.
• stickfigure 6y ago
  I stopped reading at Try to recall a time back when the Internet didn't exist... Where things like cars and phones functioned on their own in a much more reliable manner. I grew up in the 80s and have owned several cars from that era. They were significantly less reliable than cars of today. Carburetors were still present (though being phased out) and there were always vacuum hoses that, when they leaked, caused your car to run like crap. Also, phones: Cellphones were extremely expensive and unreliable. Landlines were extremely unreliable at reaching other humans because as often as not, the recipient wasn't home. Also, I remember all kinds of problems with landline wiring leading to noisy connections. Also, unless you were calling a close neighbor, you paid high per-minute charges. It's really hard to find something that was better in the pre-internet era. Cars and phones aren't it.
  • ohazi 6y ago
    The internet didn't fix these things, fuel injection, electronic ignition, and digital signal processing / denser silicon integration did.
    • stickfigure 6y ago
      Irrespective of why, cars and phones did not function in a more reliable manner back then. The statement is false.
      • denimnerd42 6y ago
        While it's true that cars are way more reliable nowadays. There are still engineer tradeoffs being made against reliability. Lightweight (fuel efficient) oils are being used, gas tank emissions capture (a system of rubber hoses and solenoids which fail easily), EGR systems, etc all are a detriment to reliability even if they have other positive uses. Today's cars could be far more reliable if that was a bigger design goal.
      • ardy42 6y ago
        > Irrespective of why, cars and phones did not function in a more reliable manner back then. The statement is false. You're missing the point, and misinterpreting that statement to mean something far broader than it actually says. The article is about unnecessary internet dependency, not about the mechanical reliability of cars, and it's a derail to make it about that. Also, you're interpreting "a time back when the Internet didn't exist" as the 80s. For most people, the internet didn't exist as late as 1995, and I've driven some pretty reliable cars from that era.
• rossdavidh 6y ago
  So, once upon a time, nothing emitted or depended on receiving EM waves. Then, we learned how to use electricity and started putting it into everything. Then, and only then, did we start developing government regulation to make sure that your new device for sale didn't broadcast EM waves that interfered with any other devices in the vicinity. We are getting to the point where we will need an Underwriter Labs-style independent body to say, to anybody selling an internet-connected device, "your device is not secure enough to be sold; you are forbidden to sell it until you get your security house in order". This wouldn't solve every problem, but it would solve a lot of it, simply because the cost required to pay for good security would cause most IoT devices that don't really need it, to get rid of it, in order to cut cost and reduce time to market. Only if it if really added a lot of value would the maker be willing to pay for good security; that does not include most IoT today.
  • soared 6y ago
    I completely agree, and would love to see a body to audit the "if your server goes down, what behavior does your device default to?" situation. That would ensure my smart front door lock doesn't default to always-locked, or always-unlocked.
  • ohazi 6y ago
    For appliances as they're currently developed (completely locked down, firmware infrastructure owned and operated by the manufacturer), this definitely seems like a good idea. I do think there's a fine line to walk between these devices and "general purpose computer"-type devices though, and I'd worry about this at least a little bit given the trend that appliance-type devices seem to be taking over the world (especially if you include phones). Separately, I do still want to see a UEFI-style secure boot architecture for appliances. An appliance can have a default mode where it only accepts firmware signed by the manufacturer. But then if a user wants to install their own key and load their own firmware (because the manufacturer has stopped supporting the device, has gone out of business, writes shitty firmware, or just to use hardware that they own in a different way), most devices should make this possible, and it would be interesting to think about what a legal requirement would look like here. A manufacturer could gate access via a configuration menu, or by cutting a trace/jumper or with a write protect screw like on Chromebooks. And you could have entire classes of devices where open access is explicitly not allowed, like medical devices. But smart speakers? Manufacturers should not be allowed to cryptographically guarantee that they become trash after two years.
• Semaphor 6y ago
  Many or most aren’t. I have a bunch of home automation devices and I’m planning for more. Most of them don’t require any internet connectivity, the only one that does (I still have Alexa connected to Home Assistant, planning to replace her with Rhasspy but didn’t find the time yet) is purely an extra method of controlling things so nothing breaks without internet. I see people buying internet-required devices as the same people who buy the registry cleaners. They don’t know enough about computers themselves, and the advertorials/computer magazines don’t do them any favors.
  • ardy42 6y ago
    > I see people buying internet-required devices as the same people who buy the registry cleaners. They don’t know enough about computers themselves, and the advertorials/computer magazines don’t do them any favors. In some cases, you don't have a choice. As far as I know, all current Roomba models have their schedule programmed via an smartphone app. I don't have one, so I don't know if it exactly requires the internet, but it's close. Older models (like the ones I have) used buttons on the unit and had no need for any kind of network at all.
    • ryandrake 6y ago
      Actually I don’t mind things being controlled by a smartphone over the Internet. That’s nice and convenient. What I object to is things being controlled by a company’s internet service, commanded by the user’s smartphone. One just requires my smartphone, the device and an internet connection, the other adds the company as an unnecessary middleman.
      • ardy42 6y ago
        > Actually I don’t mind things being controlled by a smartphone over the Internet. That’s nice and convenient. What I object to is things being controlled by a company’s internet service, commanded by the user’s smartphone. One just requires my smartphone, the device and an internet connection, the other adds the company as an unnecessary middleman. That's not quite right. For all practical purposes, internet control also requires a server sitting on a public IP address somewhere, and that's where things start break down. 1. If you run the server yourself, then you're dealing with patching it and otherwise supporting that infrastructure. 2. If a third party tries to run a server as some kind of service, they're stuck supporting all the protocols and schemas of all kinds of internet connected devices, since AFAIK there are little to no standards. Then there's the problem of funding such a project. With both of the above situations, the device also needs to support configuring a different server. 3. If a manufacturer runs the server, then you avoid most of the problems of the above options, but then you're at their mercy, and liable to loose functionality at some indeterminate point in the future. The invisible hand of the market, PBUH, appears to have determined that 3 is the best (most profitable) option.
• disport 6y ago
  Another way to rephrase the question is: why don't networked devices require signoff from a professionally licensed engineer on its specific software implementation before it goes to market? You see "forethought" in devices offered to the public when regulation DEMANDS it: think cars, bridges, medical devices, because (or so it's been rationalized), the public needs accountability (a named, professionally licensed, buck-stops-with-them head to roll) when that product can cause harm. But software harms TOO!. Think privacy, banking, relationships. Those can be harmed. It's always felt to me like a historical accident that networked devices, really most software in general, slipped past this accountability requirement. Without a specific , named accountable person, security seems to fall into the not-my-problem phenomenon, and continues generates articles like from the OP. In the imagined future where signoff from professional engineers was required, you'd see pushback against a vendor by the engineer until the implementation was secure, because the engineer's licensure was on the line until it was secure. And the vendor couldn't just "shop" for a favorable signoff, because every engineer would be held to the same ethical standard and penalty.
  • Buttons840 6y ago
    Software engineering licensure is an old debate. To say the least, I can easily imagine it making things worse, where let's say, all software has to be written in Java and get a rubber stamp by someone who hasn't actually built anything for years, and then still nobody gets held accountable when security breaches happen. Meanwhile, a bunch of college dropouts build something that's actually good using bulb, and then just have users sign away their rights in a contract instead of getting their software certified. And most of the world still runs on the Linux kernel which also had no interest in getting certified. It's a hard problem.
  • pas 6y ago
    Ah, yeah. Well. Finance and accounting is a very regulated space, yet there are auditors that don't sign off on stuff, and miraculously the same stuff gets signed by a different one a bit later. Also - and I'm not saying requiring sign off is a bad idea - , but it's not a coincidence that secure walled gardens look like a manicured Black Mirror dystopia.
  • 6y ago
• weejewel 6y ago
  Because it’s easier to control them outside of your home WiFi, which is what customers expect nowadays. Also because Google Assistant and Alexa require cloud to cloud communication. Which customers also want. And cheap WiFi devices such as the esp8266 are very optimized for a single tcp socket.
• boznz 6y ago
  Just a thought but I have no internet connected devices apart from PC's and laptops older than 5 years that still work as advertised. OTA Updates only work if someone at the other end is writing them.
• comeonseriously 6y ago
  Money. If it's cheaper to not think about it and just do it, that is what companies are going to do. Why do we still ask these questions?
• outworlder 6y ago
  I don't have any problems with devices being connected to the internet, per se. Some issues may arise for devices with sensors like cameras that could be abused. I have 3 robot vacuums (one is technically a mop). Two are internet connected, one is not. The two internet connected ones are kept up-to-date and get new capabilities from time to time. And one of these is also accessible from the local network too. This is great. At least I know that, should the company decide to support the product, I'll retain some of the capabilities. Which is something that happened to my Pebble. The community did step in and provide some missing functionality, but it wasn't a seamless transition. The biggest issue is the amount of e-waste we are creating by having - otherwise perfectly functional devices - being thrown away because their command and control servers were shutdown. There should be some mandate that companies are required to support the internet connected product for X number of years, just like cars. If they go out of business they should be required to release the control software.
• darepublic 6y ago
  why do humans exercise so little forethought. Especially in big hierarchical groups
• oneplane 6y ago
  Without reading the article you can pretty much answer that question-headline with: because money. Edit: I read the post and it's as guessed. (money)
• ddingus 6y ago
  I see all this connectivity and the back end needed to make it work a lot like basic electricity. Early on we had competing visions, best practices were being learned the hard way and regulation was in its infancy. Later on, with a lot settled, electricity became utilitarian, but not a given still. My camp trailer fridge works on 110v or propane. The table radio in it works on 110V, 12V or batteries inside the device. I have (dangerous) gas lighting in that unit as well as electric. Power isn't a given and the devices from the era are designed to operate under that state of things. This all seems very early. We lack foresight because people are pioneering. Users of this tech are also pioneering. Someone is gonna do it. Let's hope they do it increasingly well and sooner. One day, this will all be real infrastructure, with all the girls along with: regulation standards the usual. Until then it's kind of a wild west. Play hard, but play eyes wide open too. Or pass and watch as it all forms to be more robust just like people did with electricity.
• flyfishnjake 6y ago
  I have to agree with the OP on this one. I recently have been looking at some different home security hardware to add to my home. In particular, trying to find a video/intercom doorbell that I can hookup to my self-hosted Home Assistant server without it reaching out to the internet is a very difficult task. Even if you know what you want, and you know it's possible, it's difficult or impossible sometimes (without building it yourself) to find hardware that doesn't rely on internet connectivity and some user account.
• api 6y ago
  Laziness, deadlines, and lack of developer experience building things that aren't cloud or web centric. A lot of current developers literally don't know how to build software that runs at the endpoint and can run offline.
• lutorm 6y ago
  Because (enough) people are buying them anyway?
• turtlebits 6y ago
  Customer onboarding experience is a big one. The internet is a reliable way to communicate with/setup a device. I wish there was a better way, as companies keep having to reinvent the wheel. (Creating ad-hoc wireless networks, weird strings to input, transmitting audio/images to your phone). I'm pretty sure the onboarding experience contributes to poor reviews, so the goal is to make it as easy as possible. I remember the days where all devices came with a CD/floppy with software you had to install. (I had a device once that had to port scan my home network to find what it needed to connect to.)
• mti27 6y ago
  In the author's specific example, the answer is everybody wants one of those cool security cameras, but no one wants to invest the time to learn some simple networking skills, such as using a router UI to find/assign an IP address... You can create a very nice system using a software package like Blue Iris so that your security cameras function with or without Internet access.