4 ms·

FWIW, seeing a security compliance label on an IoT product wouldn't mean anything to me as a consumer. There is no such thing as computer security in 2023, and

FWIW, seeing a security compliance label on an IoT product wouldn't mean anything to me as a consumer. There is no such thing as computer security in 2023, and there are no hints that security will exist at any point on the horizon. Even the biggest names in the field cannot put out secure products. Products from well-meaning manufacturers are going to be absolutely riddled with security problems, and putting a sticker on the box won't change that. It is literally impossible to put out a software product with anything resembling security today. It'd be like putting a "secure against bricks" sticker on a window. Our industry is a joke. Building secure software products can't be done without completely rearchitecting how our industry operates, which isn't going to happen.

eru 3y ago
> It'd be like putting a "secure against bricks" sticker on a window. I lived in a house that had such secure windows. I even witnessed someone trying and failing to smash a window with a brick.
- dylan604 3y ago
  we installed a storm door not for protection against storms, but an intruder armed with a brick and/or hammer because our front door was 85% single pane of glass. it seems like a bad analogy on the GP's part
NegativeK 3y ago
> There is no such thing as computer security in 2023 This is absurd. Even the passive basics like relying on your free email provider's filtering and running Windows Defender is going to stop a huge number of attacks. If you're expecting perfect security, you'll be disappointed -- but we can't declare complete bankruptcy.
- coldpie 3y ago
  Scroll down: https://arstechnica.com/author/dan-goodin/ https://arstechnica.com/author/dan-goodin/ This is just a teeny tiny sampling of the security vulnerabilities disclosed every day. Our industry is just not built with security as a goal, and even if we started caring about it today, we have 50 years of not caring to patch up. Caring about security in a meaningful way (i.e. formal verification, engineer licensing & liability) is really, really expensive. No one is going to carry that burden when their competitors don't have to. The end result is the situation we find ourselves in: there is no such thing as computer security, and any networked computer should be considered compromised by default.
  - NegativeK 3y ago
    I'm sorry, I can't really debate with a reductionist claim that everything is 100% fucked when it's readily apparent that some threat actors are still being stopped. For what it's worth, I'm not disagreeing with your points about needing drastic, systemic improvements in how we handle security.
    - nier 3y ago
      Quote from one [0] of the articles at the linked Ars Technica index page: «A ragtag bunch of amateur hackers, many of them teenagers with little technical training, have been so adept at breaching large targets, including Microsoft, Okta, Nvidia, and Globant, that the federal government is studying their methods to get a better grounding in cybersecurity.» My opinion is that we fail completely to build secure systems in a forward thinking way and the fact that we manage to stop threat actors that exploit holes that are already known to us is insignificant. [0]: https://arstechnica.com/security/2023/08/homeland-security-details-how-teen-hackers-breached-some-of-the-biggest-targets/ https://arstechnica.com/security/2023/08/homeland-security-d...
callalex 3y ago
This take is simply not based in reality. Compare what it took to gain root access to a computer 20 years ago to a modern iPhone and tell me again that there is absolutely no point in caring about security.
- soylentcola 3y ago
  Amusingly enough, being able (or not being able) to gain root access to my own devices is one of the main reasons I can't address or verify their security - especially as official support is dropped over time. Modern phones and other appliances have (or are) computers to which it is nigh impossible to operate as root. You might say you have to pwn them even if you supposedly own them ;)
SimingtonFCC 3y ago
I understand your skepticism. That's why I want to see the label functioning as something like an enforceable representation to consumers. If someone wants to sell brick-proof glass, and get a sticker from the US Government saying so, it better be brick-proof.
- coldpie 3y ago
  Well, my comment is predicated on the, apparently erroneous :), assumption that no glass is brick-proof. It is impossible to build a secure software product with our current tooling & development practices. The number of security flaws in every software product is so high as to make the label meaningless. I don't think there's a meaningful distinction to end consumers between "this product has 1,000 holes, 100 of which are publicly disclosed" (i.e. no label) and "this product has 900 holes" (i.e. with label).
  - daveevad 3y ago
    > the, apparently erroneous :), assumption that no glass is brick-proof That reminds me of: > With sufficient thrust, pigs fly just fine. https://www.rfc-editor.org/rfc/rfc1925 https://www.rfc-editor.org/rfc/rfc1925
  - mkoubaa 3y ago
    A car that's safe to crash in is also impossible to build, but the NHTSA has standardized crash tests that they built up over time that has meaningfully made cars safer.
    - fillskills 3y ago
      +1 for having a bare minimum requirements for IOT sellers against some standard testing criteria. Raise the bar but Possibly another important would be NHTSA gathers and publishes numbers on accidents. Having some regularly published numbers would certainly shine more light and is probably lowest hurdle to cross from a political standpoint.
- landemva 3y ago
MattPalmer1086 3y ago
I completely agree that it is meaningless to assert that something is "secure". Even very well secured things have been hacked, and the smallest of mistakes can have huge impact. What would be meaningful is an assertion that some basic set of secure practices have been or are followed. For example, that there are no default passwords on a device, that security updates will be provided on some defined schedule, that network protocols meet some reasonable standard of security, etc.
Maximus9000 3y ago
Does the IoT company called "Eve" give hope to the industry? From what I understand, they take a security first approach to their IoT products. I haven't tried them out yet though.
kristianbrigman 3y ago
I think this might be useful if we kind of wargame prospective regulations to follow all the ways people might abuse it, then you might get something that works. Maybe lawmakers already do that? This thread feels in that spirit too…
closeparen 3y ago
There is no security against all the threats you can possibly be imagine, but being free of well known, stupid simple vulnerabilities is still good.

eru 3y ago

> It'd be like putting a "secure against bricks" sticker on a window. I lived in a house that had such secure windows. I even witnessed someone trying and failing to smash a window with a brick.

dylan604 3y ago
we installed a storm door not for protection against storms, but an intruder armed with a brick and/or hammer because our front door was 85% single pane of glass. it seems like a bad analogy on the GP's part

NegativeK 3y ago

> There is no such thing as computer security in 2023 This is absurd. Even the passive basics like relying on your free email provider's filtering and running Windows Defender is going to stop a huge number of attacks. If you're expecting perfect security, you'll be disappointed -- but we can't declare complete bankruptcy.

coldpie 3y ago
Scroll down: https://arstechnica.com/author/dan-goodin/ https://arstechnica.com/author/dan-goodin/ This is just a teeny tiny sampling of the security vulnerabilities disclosed every day. Our industry is just not built with security as a goal, and even if we started caring about it today, we have 50 years of not caring to patch up. Caring about security in a meaningful way (i.e. formal verification, engineer licensing & liability) is really, really expensive. No one is going to carry that burden when their competitors don't have to. The end result is the situation we find ourselves in: there is no such thing as computer security, and any networked computer should be considered compromised by default.
- NegativeK 3y ago
  I'm sorry, I can't really debate with a reductionist claim that everything is 100% fucked when it's readily apparent that some threat actors are still being stopped. For what it's worth, I'm not disagreeing with your points about needing drastic, systemic improvements in how we handle security.
  - nier 3y ago
    Quote from one [0] of the articles at the linked Ars Technica index page: «A ragtag bunch of amateur hackers, many of them teenagers with little technical training, have been so adept at breaching large targets, including Microsoft, Okta, Nvidia, and Globant, that the federal government is studying their methods to get a better grounding in cybersecurity.» My opinion is that we fail completely to build secure systems in a forward thinking way and the fact that we manage to stop threat actors that exploit holes that are already known to us is insignificant. [0]: https://arstechnica.com/security/2023/08/homeland-security-details-how-teen-hackers-breached-some-of-the-biggest-targets/ https://arstechnica.com/security/2023/08/homeland-security-d...

callalex 3y ago

This take is simply not based in reality. Compare what it took to gain root access to a computer 20 years ago to a modern iPhone and tell me again that there is absolutely no point in caring about security.

soylentcola 3y ago
Amusingly enough, being able (or not being able) to gain root access to my own devices is one of the main reasons I can't address or verify their security - especially as official support is dropped over time. Modern phones and other appliances have (or are) computers to which it is nigh impossible to operate as root. You might say you have to pwn them even if you supposedly own them ;)

SimingtonFCC 3y ago

I understand your skepticism. That's why I want to see the label functioning as something like an enforceable representation to consumers. If someone wants to sell brick-proof glass, and get a sticker from the US Government saying so, it better be brick-proof.

coldpie 3y ago
Well, my comment is predicated on the, apparently erroneous :), assumption that no glass is brick-proof. It is impossible to build a secure software product with our current tooling & development practices. The number of security flaws in every software product is so high as to make the label meaningless. I don't think there's a meaningful distinction to end consumers between "this product has 1,000 holes, 100 of which are publicly disclosed" (i.e. no label) and "this product has 900 holes" (i.e. with label).
- daveevad 3y ago
  > the, apparently erroneous :), assumption that no glass is brick-proof That reminds me of: > With sufficient thrust, pigs fly just fine. https://www.rfc-editor.org/rfc/rfc1925 https://www.rfc-editor.org/rfc/rfc1925
- mkoubaa 3y ago
  A car that's safe to crash in is also impossible to build, but the NHTSA has standardized crash tests that they built up over time that has meaningfully made cars safer.
  - fillskills 3y ago
    +1 for having a bare minimum requirements for IOT sellers against some standard testing criteria. Raise the bar but Possibly another important would be NHTSA gathers and publishes numbers on accidents. Having some regularly published numbers would certainly shine more light and is probably lowest hurdle to cross from a political standpoint.
landemva 3y ago

MattPalmer1086 3y ago

I completely agree that it is meaningless to assert that something is "secure". Even very well secured things have been hacked, and the smallest of mistakes can have huge impact. What would be meaningful is an assertion that some basic set of secure practices have been or are followed. For example, that there are no default passwords on a device, that security updates will be provided on some defined schedule, that network protocols meet some reasonable standard of security, etc.

Maximus9000 3y ago

Does the IoT company called "Eve" give hope to the industry? From what I understand, they take a security first approach to their IoT products. I haven't tried them out yet though.

kristianbrigman 3y ago

I think this might be useful if we kind of wargame prospective regulations to follow all the ways people might abuse it, then you might get something that works. Maybe lawmakers already do that? This thread feels in that spirit too…

closeparen 3y ago

There is no security against all the threats you can possibly be imagine, but being free of well known, stupid simple vulnerabilities is still good.