3 ms·

Sounds sort of like Richard Stallman's boundary on what software is required to be free: >The case of the toaster is very clear: we can't tell, except by takin

Sounds sort of like Richard Stallman's boundary on what software is required to be free: >The case of the toaster is very clear: we can't tell, except by taking it apart, whether it has a processor and software or a special-purpose chip. Since that we can't tell the difference, it makes no difference: therefore, a program that will never be changed is equivalent to a circuit. I don't care whether a toaster or microwave oven contains software. https://interviews.slashdot.org/story/14/05/05/2012218/richard-stallman-answers-your-questions https://interviews.slashdot.org/story/14/05/05/2012218/richa...

Syonyk 4y ago
Thanks - I'd not seen that before, and I think it generally covers the principle well. I don't care if a fixed function device that does its job well can be updated, but I do care if something like a fridge that talks to Google Calendar ends up obsolete with nothing but a warning message on screen because it's out of date. Though why a fridge needs a screen anyway is beyond me...
derefr 4y ago
My point wasn't so much about "fixed function" devices like toasters, but rather about higher-level industrial IoT devices like commercial security-monitoring control systems, or electricity meters (the kinds of things that have embedded 5G radios); and also about complex, flexible-purpose, networked "embedded" systems like SAN hardware appliances or network switches. These types of devices do receive regular firmware updates. And (certain models of them) are required to operate in high-security environments, where the end-to-end logistical security of update delivery is part of what the customers of those systems are paying for by buying them. Also, in general, these systems have "no user-modifiable parts"; all the useful configuration for them is exposed on the outside, where nothing you'd want to do with them would require hacking them — because much of the point of these devices is to be a hermetic environment isolating the data they evaluate or carry from interference by third parties. Maybe the best example in this category would be an Intrusion Detection System. It's definitely a full computer! But if you're the sort of company that needs one of those, then you certainly don't want the IDS itself to have any exploit surface whatsoever — including at the firmware level. And you'd rather lose out on ability to install custom firmware on your own IDS, if that means that an APT loses the ability to rootkit your IDS.
- Thorrez 4y ago
  Hmm, I'm not sure what the answer is. One idea is to regular devices for consumers differently than devices for businesses. That's not a full solution though, because there's lots of news about farmers having to hack their tractors to get them to work, which is evidence that even businesses want to be able to modify their firmware sometimes.

Syonyk 4y ago

Thanks - I'd not seen that before, and I think it generally covers the principle well. I don't care if a fixed function device that does its job well can be updated, but I do care if something like a fridge that talks to Google Calendar ends up obsolete with nothing but a warning message on screen because it's out of date. Though why a fridge needs a screen anyway is beyond me...

derefr 4y ago

My point wasn't so much about "fixed function" devices like toasters, but rather about higher-level industrial IoT devices like commercial security-monitoring control systems, or electricity meters (the kinds of things that have embedded 5G radios); and also about complex, flexible-purpose, networked "embedded" systems like SAN hardware appliances or network switches. These types of devices do receive regular firmware updates. And (certain models of them) are required to operate in high-security environments, where the end-to-end logistical security of update delivery is part of what the customers of those systems are paying for by buying them. Also, in general, these systems have "no user-modifiable parts"; all the useful configuration for them is exposed on the outside, where nothing you'd want to do with them would require hacking them — because much of the point of these devices is to be a hermetic environment isolating the data they evaluate or carry from interference by third parties. Maybe the best example in this category would be an Intrusion Detection System. It's definitely a full computer! But if you're the sort of company that needs one of those, then you certainly don't want the IDS itself to have any exploit surface whatsoever — including at the firmware level. And you'd rather lose out on ability to install custom firmware on your own IDS, if that means that an APT loses the ability to rootkit your IDS.

Thorrez 4y ago
Hmm, I'm not sure what the answer is. One idea is to regular devices for consumers differently than devices for businesses. That's not a full solution though, because there's lots of news about farmers having to hack their tractors to get them to work, which is evidence that even businesses want to be able to modify their firmware sometimes.