4 ms·

That's a nice absolutist stance to take on the Internet, but it doesn't really work in the real world. In any security-conscious environment, allowing updates

That's a nice absolutist stance to take on the Internet, but it doesn't really work in the real world. In any security-conscious environment, allowing updates without signature is not a winning move. You have to account for unauthorized access attempts somehow, and signed updates are a pretty standard way to do that. And if you have signed updates, all the openness in the world doesn't help you with a lost key.

KennyBlanken 5y ago
There's not even a hint as to what the device actually was, but I guarantee "the right security features" were about protecting intellectual product, device lifespan control, and likely locking the customer into some completely stupid and unnecessary "cloud" management function. Not the customer's security.
MereInterest 5y ago
"Allowing updates without signature" isn't the same as forbidding the owner from applying updates. Whoever buys a device has the right to decide what updates are applied to the device. This isn't incompatible with requiring signed updates. It is incompatible with the manufacturer being the holder of the private keys, and rightly so, as having the ability to modify the running code is the true definition of hardware ownership.
- groby_b 5y ago
  "This client builds embedded devices found in offices around the world. [...] These devices are driven by firmware running on a microcontroller that delivers robust wireless communications" Roughly none of the clients buying that kind of hardware want to install their own code. Come off your high horse - turnkey solutions are desirable for a large number of devices. And "hardware ownership" is not a sufficient enough proxy to allow firmware updates. Anybody in an office standing next to the device can exert physical ownership, and that's exactly the case you want to prevent.
  - MereInterest 5y ago
    Physical access is not ownership. A turnkey solution can provide reasonable defaults, along with the information needed to assert ownership and override those defaults.
  - car_analogy 5y ago
    > Anybody in an office standing next to the device can exert physical ownership, and that's exactly the case you want to prevent. You mean like with a user/owner-set password? The kind you use to unlock your computer at startup? Why is it any time manufacturer lockdown solves a security issue, people rush to pretend that only manufacturer lockdown can solve it, even when user-freedom-respecting solutions to the same issue are not only possible, but widely used and predate the lockdown solution?
josephcsible 5y ago
I'm not advocating for "allowing updates without signature". I just want the owner of the device to be in control of which keys it will trust signed updates from, rather than only the manufacturer having that control.

KennyBlanken 5y ago

There's not even a hint as to what the device actually was, but I guarantee "the right security features" were about protecting intellectual product, device lifespan control, and likely locking the customer into some completely stupid and unnecessary "cloud" management function. Not the customer's security.

MereInterest 5y ago

"Allowing updates without signature" isn't the same as forbidding the owner from applying updates. Whoever buys a device has the right to decide what updates are applied to the device. This isn't incompatible with requiring signed updates. It is incompatible with the manufacturer being the holder of the private keys, and rightly so, as having the ability to modify the running code is the true definition of hardware ownership.

groby_b 5y ago
"This client builds embedded devices found in offices around the world. [...] These devices are driven by firmware running on a microcontroller that delivers robust wireless communications" Roughly none of the clients buying that kind of hardware want to install their own code. Come off your high horse - turnkey solutions are desirable for a large number of devices. And "hardware ownership" is not a sufficient enough proxy to allow firmware updates. Anybody in an office standing next to the device can exert physical ownership, and that's exactly the case you want to prevent.
- MereInterest 5y ago
  Physical access is not ownership. A turnkey solution can provide reasonable defaults, along with the information needed to assert ownership and override those defaults.
- car_analogy 5y ago
  > Anybody in an office standing next to the device can exert physical ownership, and that's exactly the case you want to prevent. You mean like with a user/owner-set password? The kind you use to unlock your computer at startup? Why is it any time manufacturer lockdown solves a security issue, people rush to pretend that only manufacturer lockdown can solve it, even when user-freedom-respecting solutions to the same issue are not only possible, but widely used and predate the lockdown solution?

josephcsible 5y ago

I'm not advocating for "allowing updates without signature". I just want the owner of the device to be in control of which keys it will trust signed updates from, rather than only the manufacturer having that control.