3 ms·

Vendors have no incentive to provide any security updates after original purchase. Even assuming the original code was solid and had no known security flaws (t

Vendors have no incentive to provide any security updates after original purchase. Even assuming the original code was solid and had no known security flaws (this isn't the case, hardware vendors wrote godawful code full of holes), anything in the future makes it an easily exploitable vector into my home network. These apps often require ridiculous invasions of privacy - refusing to work if you don't give them full access to location, running in the background, etc. - and work poorly at best. In 30+ years of using computers, I thought that printer companies were my go-to standard for truly hideous software, but appliances are pushing the bar even lower. If my company interviewed a candidate from one of them who didn't proactively state that they formally protested the shipping of their software, I would in most cases refuse to hire them.

kennu 4y ago
In my view the level of home network security should be based on actual risk level, eg focusing on automated attacks rather than targeted attacks, and based on an evaluation of what data you may actually lose and could you back it up offline. Aiming for some kind of perceived 100% security will just make you give up a lot of convenience to mitigate risks that probably never realize or that don't actually matter that much.
- Arainach 4y ago
  Automated attacks like scanning for devices with known bugs that love to poke holes in your firewall to talk to their servers?
timthorn 4y ago
The UK PSTI legislation currently going through Parliament includes penalties of up to 4% of worldwide revenue if manufacturers don't live up to their product security obligations. That should be a reasonable incentive. https://www.gov.uk/guidance/the-product-security-and-telecommunications-infrastructure-psti-bill-product-security-factsheet https://www.gov.uk/guidance/the-product-security-and-telecom...
avar 4y ago
> These apps often require ridiculous invasions of privacy - refusing to work if you don't give them full access to location, running in the background[...] The "full access to location" to that is likely because of Android's broken security model, which made asking for location the only way various apps had to bind to some physical device. It's apparently being fixed[1]. As for running in the background: Isn't that because it needs to poll for and receive the notification? 1. https://www.androidpolice.com/2021/05/19/android-12-apps-wont-ask-for-location-permissions-when-all-they-want-is-bluetooth-scanning-which-yes-was-a-thing/ https://www.androidpolice.com/2021/05/19/android-12-apps-won...
- Arainach 4y ago
  You can do notifications without polling in the background. Even Facebook Messenger doesn't require the "run in the background" permission, and yet all sorts of cheapest Chinese bidder IoT and Appliance garbage apps check for it and refuse to run if you don't grant it - such as the app for Thinkware dashcams.

kennu 4y ago

In my view the level of home network security should be based on actual risk level, eg focusing on automated attacks rather than targeted attacks, and based on an evaluation of what data you may actually lose and could you back it up offline. Aiming for some kind of perceived 100% security will just make you give up a lot of convenience to mitigate risks that probably never realize or that don't actually matter that much.

Arainach 4y ago
Automated attacks like scanning for devices with known bugs that love to poke holes in your firewall to talk to their servers?

timthorn 4y ago

The UK PSTI legislation currently going through Parliament includes penalties of up to 4% of worldwide revenue if manufacturers don't live up to their product security obligations. That should be a reasonable incentive. https://www.gov.uk/guidance/the-product-security-and-telecommunications-infrastructure-psti-bill-product-security-factsheet https://www.gov.uk/guidance/the-product-security-and-telecom...

avar 4y ago

> These apps often require ridiculous invasions of privacy - refusing to work if you don't give them full access to location, running in the background[...] The "full access to location" to that is likely because of Android's broken security model, which made asking for location the only way various apps had to bind to some physical device. It's apparently being fixed[1]. As for running in the background: Isn't that because it needs to poll for and receive the notification? 1. https://www.androidpolice.com/2021/05/19/android-12-apps-wont-ask-for-location-permissions-when-all-they-want-is-bluetooth-scanning-which-yes-was-a-thing/ https://www.androidpolice.com/2021/05/19/android-12-apps-won...

Arainach 4y ago
You can do notifications without polling in the background. Even Facebook Messenger doesn't require the "run in the background" permission, and yet all sorts of cheapest Chinese bidder IoT and Appliance garbage apps check for it and refuse to run if you don't grant it - such as the app for Thinkware dashcams.