4 ms·

The biggest problem isn't even new regulations. The liability for violation always tends to be a rounding error to profits. Then, even if there are teeth, there

The biggest problem isn't even new regulations. The liability for violation always tends to be a rounding error to profits. Then, even if there are teeth, there is no money for enforcement which makes it all pointless. Look at how the FTC and SEC have completely failed us in the 21st century. Better regulations would matter if we ever bothered to enforce the ones we already have.

landemva 3y ago
This sums up the situation that government regulations don't work. These regulations put us on the path of trusting religious-like in government. We could be working toward push-button simple network segmentation with some kind of default filtering for install by the average home user.
- Finnucane 3y ago
  Which the manufacturers of IoT devices will give us willingly out of the goodness of their hearts?
  - landemva 3y ago
    Yet government is made of people so it does not have God-like powers, even though it is often worshipped. I would prefer to plug in a box that does this segment/filter. I will pay if it can be rebuilt from available source code. Make it easy to install and setup. If nobody purchases then nobody cares and why would government get involved? Seems like FCC scope creep. Forcing every IoT vendor to do it overlooks the problem of each vendor having and maintaining the skillsets. How about something like UL to create a slim standard and test against that standard. The aforementioned box idea could apply to be tested against the standard. https://www.ul.com https://www.ul.com
    - andybak 3y ago
      > Yet government is made of people so it does not have God-like powers, even though it is often worshipped. A slightly bizarre aside.
- autoexec 3y ago
  > These regulations put us on the path of trusting religious-like in government. We don't need to have religious-like faith in government because we can vote for people who will do what we want them to and we can vote out the people who refuse to do their job. It doesn't happen without the people getting involved and holding their government accountable though. You don't have to pray when you can vote. Without regulation you could only ever have religious-like faith in private corporations because they have zero incentive to act benevolently and you have zero power to replace a CEO who is acting against the interests of the public. You have no vote, so prayer is all you have left.
  - landemva 3y ago
    How well did that work for bank oversight in 2008, and again in 2023 with SVB? The accountability of "my one vote will remove government's failed regulators" fails on the scale of $billions.
    - autoexec 3y ago
      Your examples are situations were deregulation/lack of regulation caused problems. Without regulations, prayer didn't work out so well. We all know IoT security is a problem, but after decades of that problem existing prayer hasn't worked there either. No one person's vote can fix government but collectively we have the option to enact change. I'll take having the ability to make changes over being powerless to make changes every time.
    - rjbwork 3y ago
      >How well did that work for bank oversight in 2008, and again in 2023 with SVB Hilarious own goal on this one.
    - klausa 3y ago
      Is there an argument that the government failed in oversight with SVB? I think this is a textbook slam-dunk by the government? They stepped in when the situation was _bad_, but not _catastrophic_ yet (mmmmaybe arguable), took over, and no depositors got hurt. Is there an argument that this could've gone better, apart from "no banks ever fail"?
- ClumsyPilot 3y ago
  > regulations put us on the path of trusting religious-like in government We trust in government to set rules and punish rulebreakers. When that is not true, do we enact punishment ourselves? Results would be not pretty.
  - landemva 3y ago
    If your ISP determines there is a botnet from your home IP and you refuse their request to fix it, then it seems appropriate for your ISP to take action or "enact punishment".
    - ClumsyPilot 3y ago
      Okay, let look at the reverse situation If my ISP charges me for 100 mbps but provides 10, can I enact punishment without government interfering and protecting ISP from my punishment?
      - landemva 3y ago
        Using rule of law and courts, it depends on your contract. Many residential providers have service as a best effort. Guaranteed service with penalties are typically possible, if you are willing to pay significantly more.
        ClumsyPilot 3y ago
        This is textbook definition of hypocrisy. ISP does whatever they want without any qualifiers about contract and without any need to go to court.n
- paiute 3y ago
  I’ve worked in security before and i don’t really think the government should be involved that much. There are so many different situations to consider. What i would support is the fcc coming up with a list of common patterns and then forcing devices to state which, if any, pattern they follow. I have a weather station for example which doesn’t really need any security on the device end.
  - necovek 3y ago
    Does your weather station connect to the internet? (the discussion is about IoT devices) If so, plenty of IoT devices have been used in botnets, as point of entry into local networks (hello printer, home assistant, file share...), or simply killed off with a DoS attack.
autoexec 3y ago
It's better to get the policies in place now and then complain about the lack of funding/enforcement. The mere threat of enforcement will cause some companies to design their products better and when a major security incident happens because of a bunch of insecure IoT devices and people are outraged it'll be a lot easier to motivate action if we can say "We already have rules that would have prevented this entirely, but the FCC wasn't provided the resources to enforce them." That's a clear call to specific action as opposed to "We don't have rules that would have prevented this, and also many of the rules we do have across several agencies don't have enough funding to enforce rules designed to solve other problems."
whats_a_quasar 3y ago
IDK man this is a pretty defeatist attitude and doesn't lead to any steps to improve the situation. There's an FTC commissioner here in the comments today who's interested in the community's input. If you don't think it will have any effect that's your prerogative, but members of the public providing good technical opinions can only be a good thing. I don't agree with the vibe that past failures mean that regulations are pointless. Nothing is perfect at preventing abuses, but regulations do shape the actions of corporations and the terms of the discussion. Plus, the FTC is not one person - the commissioner making the post entered office in 2020, and so it seems broad to pin him with vague statements about the FTC completely failing us.
klausa 3y ago
HN when governments agencies have little leverage to enforce rules: The violations are a rounding error to profits! We need to make the laws more stringent. HN when EU passes laws that have significant teeth in them and let them actually enforce them: This is ridiculous overreach! It will kill innovation and make it impossible to do business there! Love it, never change <3
- avarun 3y ago
  Almost like it's different people :) The bigger issue is that simplistic takes expressed strongly with no room for disagreement tend to get the most upvotes from other people. The people who agree will upvote, the people who disagree will just move on, and the people who don't have an opinion will think the person sounds like they know what they're talking about and will upvote anyway. That's how you end up with back to back threads where completely opposite takes are highly upvoted, and both of them happen to be awful takes.

landemva 3y ago

This sums up the situation that government regulations don't work. These regulations put us on the path of trusting religious-like in government. We could be working toward push-button simple network segmentation with some kind of default filtering for install by the average home user.

Finnucane 3y ago
Which the manufacturers of IoT devices will give us willingly out of the goodness of their hearts?
- landemva 3y ago
  Yet government is made of people so it does not have God-like powers, even though it is often worshipped. I would prefer to plug in a box that does this segment/filter. I will pay if it can be rebuilt from available source code. Make it easy to install and setup. If nobody purchases then nobody cares and why would government get involved? Seems like FCC scope creep. Forcing every IoT vendor to do it overlooks the problem of each vendor having and maintaining the skillsets. How about something like UL to create a slim standard and test against that standard. The aforementioned box idea could apply to be tested against the standard. https://www.ul.com https://www.ul.com
  - andybak 3y ago
    > Yet government is made of people so it does not have God-like powers, even though it is often worshipped. A slightly bizarre aside.
autoexec 3y ago
> These regulations put us on the path of trusting religious-like in government. We don't need to have religious-like faith in government because we can vote for people who will do what we want them to and we can vote out the people who refuse to do their job. It doesn't happen without the people getting involved and holding their government accountable though. You don't have to pray when you can vote. Without regulation you could only ever have religious-like faith in private corporations because they have zero incentive to act benevolently and you have zero power to replace a CEO who is acting against the interests of the public. You have no vote, so prayer is all you have left.
- landemva 3y ago
  How well did that work for bank oversight in 2008, and again in 2023 with SVB? The accountability of "my one vote will remove government's failed regulators" fails on the scale of $billions.
  - autoexec 3y ago
    Your examples are situations were deregulation/lack of regulation caused problems. Without regulations, prayer didn't work out so well. We all know IoT security is a problem, but after decades of that problem existing prayer hasn't worked there either. No one person's vote can fix government but collectively we have the option to enact change. I'll take having the ability to make changes over being powerless to make changes every time.
  - rjbwork 3y ago
    >How well did that work for bank oversight in 2008, and again in 2023 with SVB Hilarious own goal on this one.
  - klausa 3y ago
    Is there an argument that the government failed in oversight with SVB? I think this is a textbook slam-dunk by the government? They stepped in when the situation was _bad_, but not _catastrophic_ yet (mmmmaybe arguable), took over, and no depositors got hurt. Is there an argument that this could've gone better, apart from "no banks ever fail"?
ClumsyPilot 3y ago
> regulations put us on the path of trusting religious-like in government We trust in government to set rules and punish rulebreakers. When that is not true, do we enact punishment ourselves? Results would be not pretty.
- landemva 3y ago
  If your ISP determines there is a botnet from your home IP and you refuse their request to fix it, then it seems appropriate for your ISP to take action or "enact punishment".
  - ClumsyPilot 3y ago
    Okay, let look at the reverse situation If my ISP charges me for 100 mbps but provides 10, can I enact punishment without government interfering and protecting ISP from my punishment?
    - landemva 3y ago
      Using rule of law and courts, it depends on your contract. Many residential providers have service as a best effort. Guaranteed service with penalties are typically possible, if you are willing to pay significantly more.
      - ClumsyPilot 3y ago
        This is textbook definition of hypocrisy. ISP does whatever they want without any qualifiers about contract and without any need to go to court.n
paiute 3y ago
I’ve worked in security before and i don’t really think the government should be involved that much. There are so many different situations to consider. What i would support is the fcc coming up with a list of common patterns and then forcing devices to state which, if any, pattern they follow. I have a weather station for example which doesn’t really need any security on the device end.
- necovek 3y ago
  Does your weather station connect to the internet? (the discussion is about IoT devices) If so, plenty of IoT devices have been used in botnets, as point of entry into local networks (hello printer, home assistant, file share...), or simply killed off with a DoS attack.

autoexec 3y ago

It's better to get the policies in place now and then complain about the lack of funding/enforcement. The mere threat of enforcement will cause some companies to design their products better and when a major security incident happens because of a bunch of insecure IoT devices and people are outraged it'll be a lot easier to motivate action if we can say "We already have rules that would have prevented this entirely, but the FCC wasn't provided the resources to enforce them." That's a clear call to specific action as opposed to "We don't have rules that would have prevented this, and also many of the rules we do have across several agencies don't have enough funding to enforce rules designed to solve other problems."

whats_a_quasar 3y ago

IDK man this is a pretty defeatist attitude and doesn't lead to any steps to improve the situation. There's an FTC commissioner here in the comments today who's interested in the community's input. If you don't think it will have any effect that's your prerogative, but members of the public providing good technical opinions can only be a good thing. I don't agree with the vibe that past failures mean that regulations are pointless. Nothing is perfect at preventing abuses, but regulations do shape the actions of corporations and the terms of the discussion. Plus, the FTC is not one person - the commissioner making the post entered office in 2020, and so it seems broad to pin him with vague statements about the FTC completely failing us.

klausa 3y ago

HN when governments agencies have little leverage to enforce rules: The violations are a rounding error to profits! We need to make the laws more stringent. HN when EU passes laws that have significant teeth in them and let them actually enforce them: This is ridiculous overreach! It will kill innovation and make it impossible to do business there! Love it, never change <3

avarun 3y ago
Almost like it's different people :) The bigger issue is that simplistic takes expressed strongly with no room for disagreement tend to get the most upvotes from other people. The people who agree will upvote, the people who disagree will just move on, and the people who don't have an opinion will think the person sounds like they know what they're talking about and will upvote anyway. That's how you end up with back to back threads where completely opposite takes are highly upvoted, and both of them happen to be awful takes.