4 ms·

I wonder how the right to repair intersects with security. On one extreme, full right to repair is full access to all source code, schematics and documents rela

I wonder how the right to repair intersects with security. On one extreme, full right to repair is full access to all source code, schematics and documents related to the phone and all of its hardware and software. It would necessarily also give you the ability to arbitrarily flash firmware and install software without limitation. Clearly this can't be good for security. However the other extreme, no access to anything is tantamount to no access at all, which is clearly secure, but isn't useful nor practical. Is the government really capable of properly defining the line?

rank0 6y ago
> On one extreme, full right to repair is full access to all source code, schematics and documents related to the phone and all of its hardware and software. It would necessarily also give you the ability to arbitrarily flash firmware and install software without limitation. Clearly this can't be good for security. Open source code and device schematics shouldn't be a significant security threat. If device security is reliant on obscurity, you have improper security controls. Frankly, that should be on the device manufacturer, and not the consumer. As for the second point, I should be able to install whatever software I want on my device...as its mine.
- endisneigh 6y ago
  > Open source code and device schematics shouldn't be a significant security threat. You don't see how a completely open device could be insecure? > As for the second point, I should be able to install whatever software I want on my device...as its mine. This is a valid opinion, but the whole point of contention is whether you can do anything with a device simply because you've purchased it, as opposed to what has been exposed for you to do.
  - rank0 6y ago
    No an open device does not automatically mean insecure. Proper security controls should work even if the schematics are open. If they don’t, that is a security defect whose ownership falls under the manufacturer.
pwg 6y ago
> no access at all, which is clearly secure Not "clearly secure" -- rather it would be 'security by obscurity': https://en.wikipedia.org/wiki/Security_by_obscurity https://en.wikipedia.org/wiki/Security_by_obscurity Quote: Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Security experts have rejected this view as far back as 1851, and advise that obscurity should never be the only security mechanism.
- endisneigh 6y ago
  No, my point was that the most secure device is a device that cannot do anything - I'm familiar with security by obscurity. The point of the example was to give extremes, everything v. nothing.
rasz 6y ago
I can arbitrarily flash firmware and install software on my laptop without access to source code.

rank0 6y ago

> On one extreme, full right to repair is full access to all source code, schematics and documents related to the phone and all of its hardware and software. It would necessarily also give you the ability to arbitrarily flash firmware and install software without limitation. Clearly this can't be good for security. Open source code and device schematics shouldn't be a significant security threat. If device security is reliant on obscurity, you have improper security controls. Frankly, that should be on the device manufacturer, and not the consumer. As for the second point, I should be able to install whatever software I want on my device...as its mine.

endisneigh 6y ago
> Open source code and device schematics shouldn't be a significant security threat. You don't see how a completely open device could be insecure? > As for the second point, I should be able to install whatever software I want on my device...as its mine. This is a valid opinion, but the whole point of contention is whether you can do anything with a device simply because you've purchased it, as opposed to what has been exposed for you to do.
- rank0 6y ago
  No an open device does not automatically mean insecure. Proper security controls should work even if the schematics are open. If they don’t, that is a security defect whose ownership falls under the manufacturer.

pwg 6y ago

> no access at all, which is clearly secure Not "clearly secure" -- rather it would be 'security by obscurity': https://en.wikipedia.org/wiki/Security_by_obscurity https://en.wikipedia.org/wiki/Security_by_obscurity Quote: Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Security experts have rejected this view as far back as 1851, and advise that obscurity should never be the only security mechanism.

endisneigh 6y ago
No, my point was that the most secure device is a device that cannot do anything - I'm familiar with security by obscurity. The point of the example was to give extremes, everything v. nothing.

rasz 6y ago

I can arbitrarily flash firmware and install software on my laptop without access to source code.