3 ms·

> Disabling software locks that prevent repair has no bearing on the cybersecurity of covered devices. This is presented without adequate proof. It is plainly

> Disabling software locks that prevent repair has no bearing on the cybersecurity of covered devices. This is presented without adequate proof. It is plainly not true for hardware locks and physical security. For example, a car with a sealed, inaccessible engine would be hard to repair and maintain, but also harder to tamper with or sabotage, and it would be harder for thieves to steal the catalytic converter. But what if the engine compartment door is controlled by software that only permits access by authorized repair providers? The same argument applies. Similarly, a device or OS that refuses to run unsigned or unauthorized device drivers might interfere with repairs such as replacing component devices with new ones that required new drivers, but would likely interfere with the operation of unauthorized, driver-based malware. There are clear counterexamples disproving the claim that disabling software locks that prevent repair has no bearing on security ("cyber" or otherwise.) On the contrary, software locks that make benevolent repair harder can also make malicious tampering (to hardware and/or software) more difficult as well.

kris_wayton 4y ago
Assuming the catalytic converter is underneath the car, making that particular area inaccessible would be a lot less headache than the engine bay.
- musicale 4y ago
  Indeed. There may be an interesting analogy there about primary and secondary purposes and effects. ;-) However, the same basic argument applies: harder to repair/replace, but also harder to steal or tamper with.
6510 4y ago
Bluntly put: Making it harder is not security. Security is not a pile of obfuscation and hoping it will make things difficult enough. Lets forget your analogy with stealing car parts. We can just do that :) Lets have the realistic or real world settings where we are all purchasing incredibly cheap IoT devices that bring us all kinds of wonderful functionality. Businesses, factories or brands making incredibly cheap stuff are not very stable. They make a popular widget for a while then dissolve and everyone moves on. They can also move on to the next version of their product abolishing support for previous version. If build reasonably well and used rarely or carefully such devices can last for many decades. It thus is guaranteed for a large percentage of the devices to not have a single authorized repair provider for the longest period of their usage. Real security holes will be found, bugs will be exploited, they will be easy to find online and come with a life time guarantee to work. The analogy would be a catalytic converter that might explode. You shouldn't drive this car in your drive way. You should buy a brand new one from the same brand! But doesn't that have the same catalytic converter? Maybe! But as long as you don't know about it you are safe! Their 15.4 has just been released and non of them exploded! Stop being poor!
- musicale 4y ago
  > Security is not a pile of obfuscation and hoping it will make things difficult enough. I think that's called security by obscurity, and it is certainly a thing, although not necessarily the most effective strategy. Making things harder for malicious actors is kind of the point.
TeMPOraL 4y ago
As much as I support Right to Repair and end-user control, and also don't particularly like some of the ideas coming out of the security side, I think you're right. The statement you quoted is very much not true, both here specifically, and also in general. In optimal conditions, it seems to me that you always have a trade-off - "security or utility, pick one". If it often looks like you can get both, it means both currently are bad (er, suboptimal, to be polite). In the limit, the most secure computer is an inert rock: there's no way an attacker can break in and exploit it for anything. The flip side being, of course, that it's completely useless for the legitimate operator too. Coming back from the theoretical extremes, straight to real-life systems: > software locks that make benevolent repair harder can also make malicious tampering (to hardware and/or software) more difficult as well. This is true and self-evident, IMHO. A security system (whether hardware or software) can't reliably tell who's accessing it and why. The goal is to only have the right people use the device/program for the right reasons, but such discrimination can only be achieved by proxy. Auth (both kinds) proxy for "right people", and "right reasons" is just assumed. I highlight the latter because people can be "hacked" too. You can imagine having a magical system that can correctly authenticate and authorize users 100% of the time, defeating any impersonation attempts (including attacker having unfettered physical access to the system in question) - but that system is still highly vulnerable, because the attacker can confuse, gaslight, scare or threaten the authorized user into self-pwning. The badly but memorably named "Self-XSS" attack is just the most trivial example. Point being: once you correct for bad UX and shitty corporate practices, dealing with risk of self-pwning (and, related, the risk of misinformed or accidental misuse) will always make security trade against the capability of the owner (or the agents of that owner, such as a repair shop). And then it gets much more complicated when the device has multiple owners with conflicting interests, and/or there are additional stakeholders, such as the general public[0]. Balancing those conflicting needs often requires not just legal, but also technological lockouts. All this is why I don't find "but security!" as a valid argument in itself. There is such a thing as too much security. Balancing conflicting needs of the owner, the other owners, additional stakeholders and a sense of fairness in general, is an exercise of trade-offs. Often you need to sacrifice security to achieve fairness. Conversely, security features can also be used unfairly, as a form of abuse. DRM technologies, for example, are abused quite a lot - and Right to Repair is, to a large degree, also a fight against security measures that favor the vendors at the expense of end-users and society at large. -- [0] - A modern car, for example, may be owned by the buyer, but thanks to intellectual property laws its also partially owned by one or more companies, and you have both governments and the public in general as stakeholders - all of which have mutually conflicting interests. E.g. you may want to redo the entire UI of the car - but you'd need access to IP the vendor doesn't want to release without a license, and it's way too expensive to them to license those secrets to you individually. Then, this would fly against homologation procedures, and the government ain't going to change them just for you. Meaning your mod can't go through processes establishing road-worthiness, safety and emission standards - all of which is important for... just about all the stakeholders, perhaps other than you.
alex7734 4y ago
Sorry but stopping thieves/malware is not worth the economic damage that manufacturer repair monopoly brings to the consumer. You can make your phone 100% safe by turning it off and encasing it in concrete but having to pull out the pneumatic hammer to make a call is prohibitively expensive and very much not useful. Moreover security is a poor excuse anyways as many measures taken by manufacturers do not improve security in any way. And for those that do, there are ways to achieve that security without harming the consumer. Manufacturers are tilting the scale in their favor to such a degree that I'd argue should be made illegal because it damages society as a whole. There is a reason antitrust laws used to be enforced way back in Microsoft's days.
- musicale 4y ago
  Excellent argument against a point I wasn't making. More seriously, your comment is probably better than the original article, because you acknowledge that there is a tradeoff.

kris_wayton 4y ago

Assuming the catalytic converter is underneath the car, making that particular area inaccessible would be a lot less headache than the engine bay.

musicale 4y ago
Indeed. There may be an interesting analogy there about primary and secondary purposes and effects. ;-) However, the same basic argument applies: harder to repair/replace, but also harder to steal or tamper with.

6510 4y ago

Bluntly put: Making it harder is not security. Security is not a pile of obfuscation and hoping it will make things difficult enough. Lets forget your analogy with stealing car parts. We can just do that :) Lets have the realistic or real world settings where we are all purchasing incredibly cheap IoT devices that bring us all kinds of wonderful functionality. Businesses, factories or brands making incredibly cheap stuff are not very stable. They make a popular widget for a while then dissolve and everyone moves on. They can also move on to the next version of their product abolishing support for previous version. If build reasonably well and used rarely or carefully such devices can last for many decades. It thus is guaranteed for a large percentage of the devices to not have a single authorized repair provider for the longest period of their usage. Real security holes will be found, bugs will be exploited, they will be easy to find online and come with a life time guarantee to work. The analogy would be a catalytic converter that might explode. You shouldn't drive this car in your drive way. You should buy a brand new one from the same brand! But doesn't that have the same catalytic converter? Maybe! But as long as you don't know about it you are safe! Their 15.4 has just been released and non of them exploded! Stop being poor!

musicale 4y ago
> Security is not a pile of obfuscation and hoping it will make things difficult enough. I think that's called security by obscurity, and it is certainly a thing, although not necessarily the most effective strategy. Making things harder for malicious actors is kind of the point.

TeMPOraL 4y ago

As much as I support Right to Repair and end-user control, and also don't particularly like some of the ideas coming out of the security side, I think you're right. The statement you quoted is very much not true, both here specifically, and also in general. In optimal conditions, it seems to me that you always have a trade-off - "security or utility, pick one". If it often looks like you can get both, it means both currently are bad (er, suboptimal, to be polite). In the limit, the most secure computer is an inert rock: there's no way an attacker can break in and exploit it for anything. The flip side being, of course, that it's completely useless for the legitimate operator too. Coming back from the theoretical extremes, straight to real-life systems: > software locks that make benevolent repair harder can also make malicious tampering (to hardware and/or software) more difficult as well. This is true and self-evident, IMHO. A security system (whether hardware or software) can't reliably tell who's accessing it and why. The goal is to only have the right people use the device/program for the right reasons, but such discrimination can only be achieved by proxy. Auth (both kinds) proxy for "right people", and "right reasons" is just assumed. I highlight the latter because people can be "hacked" too. You can imagine having a magical system that can correctly authenticate and authorize users 100% of the time, defeating any impersonation attempts (including attacker having unfettered physical access to the system in question) - but that system is still highly vulnerable, because the attacker can confuse, gaslight, scare or threaten the authorized user into self-pwning. The badly but memorably named "Self-XSS" attack is just the most trivial example. Point being: once you correct for bad UX and shitty corporate practices, dealing with risk of self-pwning (and, related, the risk of misinformed or accidental misuse) will always make security trade against the capability of the owner (or the agents of that owner, such as a repair shop). And then it gets much more complicated when the device has multiple owners with conflicting interests, and/or there are additional stakeholders, such as the general public[0]. Balancing those conflicting needs often requires not just legal, but also technological lockouts. All this is why I don't find "but security!" as a valid argument in itself. There is such a thing as too much security. Balancing conflicting needs of the owner, the other owners, additional stakeholders and a sense of fairness in general, is an exercise of trade-offs. Often you need to sacrifice security to achieve fairness. Conversely, security features can also be used unfairly, as a form of abuse. DRM technologies, for example, are abused quite a lot - and Right to Repair is, to a large degree, also a fight against security measures that favor the vendors at the expense of end-users and society at large. -- [0] - A modern car, for example, may be owned by the buyer, but thanks to intellectual property laws its also partially owned by one or more companies, and you have both governments and the public in general as stakeholders - all of which have mutually conflicting interests. E.g. you may want to redo the entire UI of the car - but you'd need access to IP the vendor doesn't want to release without a license, and it's way too expensive to them to license those secrets to you individually. Then, this would fly against homologation procedures, and the government ain't going to change them just for you. Meaning your mod can't go through processes establishing road-worthiness, safety and emission standards - all of which is important for... just about all the stakeholders, perhaps other than you.

alex7734 4y ago

Sorry but stopping thieves/malware is not worth the economic damage that manufacturer repair monopoly brings to the consumer. You can make your phone 100% safe by turning it off and encasing it in concrete but having to pull out the pneumatic hammer to make a call is prohibitively expensive and very much not useful. Moreover security is a poor excuse anyways as many measures taken by manufacturers do not improve security in any way. And for those that do, there are ways to achieve that security without harming the consumer. Manufacturers are tilting the scale in their favor to such a degree that I'd argue should be made illegal because it damages society as a whole. There is a reason antitrust laws used to be enforced way back in Microsoft's days.

musicale 4y ago
Excellent argument against a point I wasn't making. More seriously, your comment is probably better than the original article, because you acknowledge that there is a tradeoff.