6 ms·

Users shouldn't be punished by the negligence of manufacturers. Sure the majority of HN will know to ensure they run secure products or something, but you can't

by gizdan 5y ago

Users shouldn't be punished by the negligence of manufacturers. Sure the majority of HN will know to ensure they run secure products or something, but you can't expected nana to know that. She just wants to talk to some device to help her a little.

jl6 5y ago
A good way to teach people to run secure products is to charge them more for running insecure products. The general public can’t distinguish between secure and insecure products, but they can read a list of products that are covered by the $0.99/month insurance plan, and anything not on that list you need the $1.99/month plan. DDoS victims can then make a claim against the insurance companies (who own the liability arising from each IP address; ISPs can de-NAT), a court can evaluate the evidence if necessary, and the insurance providers pay out. N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list.
- Nextgrid 5y ago
  > N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list. The "audit" can be as simple as the insurance company running automated pentests trying published exploits and passwords. That would still achieve the desired goal (the majority of botnets spread via well-known vulnerabilities and/or bruteforced credentials, custom equipment where manual effort is needed on the attacker's part are a minority) while allowing enthusiasts to run custom hardware.
- briffle 5y ago
  How can a home user protect themselves from this, when most manufactures only release a very, shockingly small number of firmware updates, and don't notify users of the updates?
  - jl6 5y ago
    The current state of affairs arises because insecurity is an externality that is not considered by consumers. As soon as security has a monetary value, consumers will start to demand it and manufacturers will start to meet that demand.

by gizdan 5y ago

jl6 5y ago

A good way to teach people to run secure products is to charge them more for running insecure products. The general public can’t distinguish between secure and insecure products, but they can read a list of products that are covered by the $0.99/month insurance plan, and anything not on that list you need the $1.99/month plan. DDoS victims can then make a claim against the insurance companies (who own the liability arising from each IP address; ISPs can de-NAT), a court can evaluate the evidence if necessary, and the insurance providers pay out. N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list.

Nextgrid 5y ago
> N.B. It’s actually experts who would be penalized most by this scheme, because if you do something like run a customized FreeBSD box, it’s unlikely to appear on the audited-device list. The "audit" can be as simple as the insurance company running automated pentests trying published exploits and passwords. That would still achieve the desired goal (the majority of botnets spread via well-known vulnerabilities and/or bruteforced credentials, custom equipment where manual effort is needed on the attacker's part are a minority) while allowing enthusiasts to run custom hardware.
briffle 5y ago
How can a home user protect themselves from this, when most manufactures only release a very, shockingly small number of firmware updates, and don't notify users of the updates?
- jl6 5y ago
  The current state of affairs arises because insecurity is an externality that is not considered by consumers. As soon as security has a monetary value, consumers will start to demand it and manufacturers will start to meet that demand.