4 ms·

A more optimistic (!) theory I have is that devices are getting software updates over the Internet from their manufacturers, and a government might try to induc

by schoen 4y ago

A more optimistic (!) theory I have is that devices are getting software updates over the Internet from their manufacturers, and a government might try to induce a manufacturer to remotely brick or backdoor devices in a hostile country in the future, even if the devices weren't backdoored at the time they were sold. This could happen even if the manufacturer didn't even intend for it to be a possibility, once other people realized that the manufacturer was capable of going through with it. I remember that, at the time of the Russian invasion of Ukraine, some Americans immediately got angry with Apple for not pushing software updates to disable Russians' iPhones. If people -- albeit members of the public and not actual Apple executives -- are going to strongly insist that this would be reasonable or appropriate, it's not very surprising that people in various countries would become frightened of this possibility! (The reason this theory is "more optimistic" is just that it's conceivable in principle that vendors and customers could find ways to work together to protect against it.)

trasz 4y ago
Russia is a completely different situation though - they invaded another country and are perpetrating genocide, which means that anything that hurts Russia should be a fair game. A full data leak would be even better - but sadly in this case we have Apple caring more about PR than morality. This of course ignores the strategic needs. First, it should be a priority to get as many Russians to migrate to the West, to starve the regime of manpower. Second, losing could be Putin’s eventual aim, to make sure Russia gets cut off the outside world, to make it possible for them to shape the society however they want - and in that case preserving the means of communication is even more crucial.
- omniglottal 4y ago
  The "different situation" you point out simply does not justify back doors. Having a purportedly valid use does nothing to cicumvent their undesirable nature and our need to eshew them entirely. This "difference" has no relevance over whether or not back doors should be tolerated in society because the reasons to have precisely none are so profound. "They" invaded, you say? All the Russian iPhone users, was it? Is it true that zero Russian owners of iPhones were supportive of Ukraine and using their iPhones to organize and communicate anti-Putin protests? And Apple is the enforcer to whom the (US) public should appeal? Yeah, that's a hard "nope".
  - trasz 4y ago
    I agree about backdoors not being acceptable, but we are talking about using legitimate software update mechanisms, not backdoors. As for “not everyone is an active supporter” - governments exist to represent people. From this it naturally follows that the people should bear consequences of their governments’ actions. Its not the first Russian invasion, they had plenty of time to leave the country. Again - at this point, if something can destabilize Russia, then it’s a fair game from ethical point of view. It’s just lesser evil. But then of course there’s the strategic point of view. US approaching Russia in a surprisingly merciful and humane manner, and there are reasons for this.
- funnyfacts365 4y ago
hilbert42 4y ago
"...and a government might try to induce a manufacturer to remotely brick or backdoor devices in a hostile country in the future, even if the devices weren't backdoored at the time they were sold." In my opinion any or all of these are distinct possibilities, especially so during any serious war or conflict. During war anything goes and no serious effort is ever spared (one only has to look at the enormous and successful British efforts to break Enigma during WWII to realize this). Successful hacks to critical infrastructure such as aerospace, nuclear, medical/pharmaceutical technologies, etc. pose both great security risks and a danger to life and it's clear to me that many of the existing protections in place are either inadequate and or are haphazardly applied. Thus, when it comes to the production of both software and hardware for critical systems we need a whole new set of industry-wide manufacturing and security protocols that a both consistent and as watertight as is possible to make them to ensure that hacks (including HW backdoors) are much, much more difficult or nigh on impossible to implement. Furthermore, these protocols would apply to every critical link in the manufacturing chain—CPUs, support chips, software routines, subsystems and a multitude of other componentry. Implementing any new protocols along these lines in the current political and economic climate would be nigh on impossible and I wouldn't anticipate any changes of significance in the immediate future as it would require manufacturers to be much more open about the way they do business. While once that might have been possible—as adrian_b rightly points out in his post†—that's no longer the case. Can you imagine Intel open-sourcing its CPU microcode or Elon Musk providing the embedded source for his company's Tesla vehicles? Not bloody likely! Nevertheless, I'm convinced something along these lines will eventually have to be implemented before we can reduce the breaches and threats to manageable levels. Consider physical bank robberies: they still happen but not with the frequency they one did nor on the enormous scale of present-day electronic fraud for the very reason that over the decades we've developed and evolved methods to make robbing banks a difficult and very risky business for the perpetrator. When it comes to electronic security and cyber crime, we've nothing anywhere near as effective. In effect, we've 21st Century problems and we're still applying Dark Ages solutions. Whilst I'd like to think we could find solutions comparatively soon but I'm nevertheless very doubtful—as it seems to me that nothing short of a command (war) economy (as we had in WWII) where the government mandated both standards and inter-business cooperation would solve the problems. How important is it to harden the security of critical systems further? Clearly, it's very important to do so as the consequences could be dire if we do not. Security breaches could result in electricity grids going down; a hack on the control system of a nuclear reactor could result in another Chernobyl, similarly a hack to avionics could end in a plane crash. As I'm restricted from discussing my experience I'll use a well known albeit somewhat prosaic example to illustrate the point: that being the Volkswagen emissions scam‡. (I say it's prosaic in the sense that its immediate impact isn't as devastating as bringing down a country's electricity grid or the uncontrolled opening of a dam sluice gate that could quickly kill many thousands (that said, I'm not making light of it, what VW did was extremely serious and in my opinion it wasn't sufficiently punished for its crime).) My point is that if universal safety and security standards/protocols that were open and understood by all had been in place during the development and manufacture of the "Clean Diesel" Volkswagen Golf then it would have been essentially impossible for VW to implement the fraud—as too many protections protocols would have been in place to allow it to happen. The point is that a company or any entity should not be able to hide behind a manufacturing process or any other activity whose product thereof has the potential to cause serious harm. Until such time that all such potentially dangerous process can be openly inspected and carefully examined by third parties, we will continue to experience inordinately high numbers of serious security breaches. † https://news.ycombinator.com/item?id=32396390 https://news.ycombinator.com/item?id=32396390 ‡ https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal

by schoen 4y ago

trasz 4y ago

Russia is a completely different situation though - they invaded another country and are perpetrating genocide, which means that anything that hurts Russia should be a fair game. A full data leak would be even better - but sadly in this case we have Apple caring more about PR than morality. This of course ignores the strategic needs. First, it should be a priority to get as many Russians to migrate to the West, to starve the regime of manpower. Second, losing could be Putin’s eventual aim, to make sure Russia gets cut off the outside world, to make it possible for them to shape the society however they want - and in that case preserving the means of communication is even more crucial.

omniglottal 4y ago
The "different situation" you point out simply does not justify back doors. Having a purportedly valid use does nothing to cicumvent their undesirable nature and our need to eshew them entirely. This "difference" has no relevance over whether or not back doors should be tolerated in society because the reasons to have precisely none are so profound. "They" invaded, you say? All the Russian iPhone users, was it? Is it true that zero Russian owners of iPhones were supportive of Ukraine and using their iPhones to organize and communicate anti-Putin protests? And Apple is the enforcer to whom the (US) public should appeal? Yeah, that's a hard "nope".
- trasz 4y ago
  I agree about backdoors not being acceptable, but we are talking about using legitimate software update mechanisms, not backdoors. As for “not everyone is an active supporter” - governments exist to represent people. From this it naturally follows that the people should bear consequences of their governments’ actions. Its not the first Russian invasion, they had plenty of time to leave the country. Again - at this point, if something can destabilize Russia, then it’s a fair game from ethical point of view. It’s just lesser evil. But then of course there’s the strategic point of view. US approaching Russia in a surprisingly merciful and humane manner, and there are reasons for this.
funnyfacts365 4y ago

hilbert42 4y ago

"...and a government might try to induce a manufacturer to remotely brick or backdoor devices in a hostile country in the future, even if the devices weren't backdoored at the time they were sold." In my opinion any or all of these are distinct possibilities, especially so during any serious war or conflict. During war anything goes and no serious effort is ever spared (one only has to look at the enormous and successful British efforts to break Enigma during WWII to realize this). Successful hacks to critical infrastructure such as aerospace, nuclear, medical/pharmaceutical technologies, etc. pose both great security risks and a danger to life and it's clear to me that many of the existing protections in place are either inadequate and or are haphazardly applied. Thus, when it comes to the production of both software and hardware for critical systems we need a whole new set of industry-wide manufacturing and security protocols that a both consistent and as watertight as is possible to make them to ensure that hacks (including HW backdoors) are much, much more difficult or nigh on impossible to implement. Furthermore, these protocols would apply to every critical link in the manufacturing chain—CPUs, support chips, software routines, subsystems and a multitude of other componentry. Implementing any new protocols along these lines in the current political and economic climate would be nigh on impossible and I wouldn't anticipate any changes of significance in the immediate future as it would require manufacturers to be much more open about the way they do business. While once that might have been possible—as adrian_b rightly points out in his post†—that's no longer the case. Can you imagine Intel open-sourcing its CPU microcode or Elon Musk providing the embedded source for his company's Tesla vehicles? Not bloody likely! Nevertheless, I'm convinced something along these lines will eventually have to be implemented before we can reduce the breaches and threats to manageable levels. Consider physical bank robberies: they still happen but not with the frequency they one did nor on the enormous scale of present-day electronic fraud for the very reason that over the decades we've developed and evolved methods to make robbing banks a difficult and very risky business for the perpetrator. When it comes to electronic security and cyber crime, we've nothing anywhere near as effective. In effect, we've 21st Century problems and we're still applying Dark Ages solutions. Whilst I'd like to think we could find solutions comparatively soon but I'm nevertheless very doubtful—as it seems to me that nothing short of a command (war) economy (as we had in WWII) where the government mandated both standards and inter-business cooperation would solve the problems. How important is it to harden the security of critical systems further? Clearly, it's very important to do so as the consequences could be dire if we do not. Security breaches could result in electricity grids going down; a hack on the control system of a nuclear reactor could result in another Chernobyl, similarly a hack to avionics could end in a plane crash. As I'm restricted from discussing my experience I'll use a well known albeit somewhat prosaic example to illustrate the point: that being the Volkswagen emissions scam‡. (I say it's prosaic in the sense that its immediate impact isn't as devastating as bringing down a country's electricity grid or the uncontrolled opening of a dam sluice gate that could quickly kill many thousands (that said, I'm not making light of it, what VW did was extremely serious and in my opinion it wasn't sufficiently punished for its crime).) My point is that if universal safety and security standards/protocols that were open and understood by all had been in place during the development and manufacture of the "Clean Diesel" Volkswagen Golf then it would have been essentially impossible for VW to implement the fraud—as too many protections protocols would have been in place to allow it to happen. The point is that a company or any entity should not be able to hide behind a manufacturing process or any other activity whose product thereof has the potential to cause serious harm. Until such time that all such potentially dangerous process can be openly inspected and carefully examined by third parties, we will continue to experience inordinately high numbers of serious security breaches. † https://news.ycombinator.com/item?id=32396390 https://news.ycombinator.com/item?id=32396390 ‡ https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal