3 ms·

legislation is coming in Sept 2024 (RED directive) mandating a lot of security for IoT home appliance. If your device doesn't have (secure) OTA update, secure-b

legislation is coming in Sept 2024 (RED directive) mandating a lot of security for IoT home appliance. If your device doesn't have (secure) OTA update, secure-boot, among other things it won't get CE certification. In Europe vendors are scrambling because the law is there but standards are still half-baked (ETSI/EN 303 645 etc). In the US the situation is the opposite: standards are solid but the law is still not clearly defined. There is a lot to be said about throwing whole classes of users under the bus (elderly, people with disabilities) when asking them to manage technology mostly because how these things are going to be implemented (e.g. the security vs usability dilemma).

jeroenhd 4y ago
I'm a little annoyed at the requirement for secure boot on these platforms. As the device owner I want to get security updates, but I also want to be able to run my own software if I so choose. I don't think physical security is a problem that ready to be solved In legislation like this unless we're talking about a smart safe I welcome new legislation in this area but it seems to me that lobbyists are once again screwing over the general consumer by adding anti-features into these legislations. Luckily IOT-vendors are absolutely abysmal at protecting their devices so I doubt we'll see too many devices locked down that weren't already.
- DyslexicAtheist 4y ago
  I agree on secureboot :( one thing: > Luckily IOT-vendors are absolutely abysmal at protecting their devices so I doubt we'll see too many devices locked down that weren't already. it is either compliance or no CE stamp (if a product does not meet safety requirements they have to remove connectivity or take it off the shelves). And either they are already scrambling because the cost of this has already sunk in, ... or they are in for a surprise pretty soon because becoming compliant isn't a one-off activity but means restructuring their entire processes (e.g. test automation to maintain that compliance)

jeroenhd 4y ago

I'm a little annoyed at the requirement for secure boot on these platforms. As the device owner I want to get security updates, but I also want to be able to run my own software if I so choose. I don't think physical security is a problem that ready to be solved In legislation like this unless we're talking about a smart safe I welcome new legislation in this area but it seems to me that lobbyists are once again screwing over the general consumer by adding anti-features into these legislations. Luckily IOT-vendors are absolutely abysmal at protecting their devices so I doubt we'll see too many devices locked down that weren't already.

DyslexicAtheist 4y ago
I agree on secureboot :( one thing: > Luckily IOT-vendors are absolutely abysmal at protecting their devices so I doubt we'll see too many devices locked down that weren't already. it is either compliance or no CE stamp (if a product does not meet safety requirements they have to remove connectivity or take it off the shelves). And either they are already scrambling because the cost of this has already sunk in, ... or they are in for a surprise pretty soon because becoming compliant isn't a one-off activity but means restructuring their entire processes (e.g. test automation to maintain that compliance)