9 ms·

Most hardware has no reason to require direct internet access or an account with the manufacturer to work. If some device requires internet access, then it cann

by chme 2y ago

Most hardware has no reason to require direct internet access or an account with the manufacturer to work. If some device requires internet access, then it cannot be trusted to not transmit personal data, therefore it should be possible to replace the software on that device, so that something that is trusted by the consumer can be installed. While DJI here might create good hardware, their internet and account requirement makes it uncontrollable by the consumer, so I do understand that some consumers or, the possible more security aware US, will not trust it. But for the same reason China and other countries might not trust Apple or similar. Trust is something that needs to be earned and which has to go both ways, if a company doesn't trust their users, and prevents people using their bought products however they like, then why should their users trust the company and let their uncontrollable software record their private lives and possible report back to them?

segasaturn 2y ago
While I agree with you, I doubt banning Chinese tech will remedy this problem. My experience is that American brands are much, much more aggressive about making you connect to the internet, install our apps, create an account, subscribe to our newsletter etc. Look at the difference between iRobot and Chinese robot vacuums on Amazon - the difference is night and day.
- chme 2y ago
  True. I was just talking about my experience with DJI. Where you buy a product, can use it for a bit, and then it stops working, because you haven't connected it to the internet or created an account. It is often the 'market leaders' that are so afraid to loose customers and their market position to implement customer hostile processes into their products.
- hatsix 2y ago
  Depends on what you consider the "problem". As Congress sees it, the problem is two-fold... You have no control over your data. The company that does have control over your data is beholden to a foreign country not currently considered "a close ally".
- mike_d 2y ago
  > American brands are much, much more aggressive about making you connect to the internet, install our apps, create an account This whataboutism ignores one very important point. When you connect a device to an American company they might do things that we consider privacy violations, while still staying generally within the bounds of the law. We like to joke about data going to the NSA or something, but in the extremely limited cases where it does protections exist with oversight. Contrast this to Chinese companies where by law every company is part-owned by the government itself. The Ministry of State Security literally has employees who show up to these companies every day like normal workers, but their job is to find and exploit intelligence on foreign individuals and businesses.
  - peoplefromibiza 2y ago
    > This whataboutism ignores one very important point. Reverse whataboutism is still whataboutism. For example this predicate > while still staying generally within the bounds of the law. Completely ignores the fact that US companies have been found lying and deceiving to circumvent the barriers posed by the law. But not only US companies, remember the diesel gate? This other predicate > (In China) by law every company is part-owned by the government itself It's completely false, while this one > The Ministry of State Security literally has employees who show up to these companies every day like normal workers It's pure intellectual dishonesty . Every sufficiently advanced intelligence agency has spies. With the USA agencies being the largest employers for spies on the entire Planet.
  - ethbr1 2y ago
    The idea of running any internet-connected software with a push-update mechanism, built and controlled by a company in a country without a strong independent rule of law, should terrify far more people than it apparently does. This is one of those 'It's not a problem until it is a problem, and then it's a big fucking problem' scenarios.
    - FactKnower69 2y ago
      >a country without a strong independent rule of law I'd really like you to try and define this term in a way that doesn't exclude the US
- khazhoux 2y ago
  > While I agree with you, I doubt banning Chinese tech will remedy this problem. I don't mean this as a political issue, but in your comment I see one of the reasons Trump appeals to people. He promotes a mindset of "stop handwringing and just fix the damn problem." Here we know the following: 1) DJI devices have an always-on connection 2) Chinese government is unfriendly to US and exerts strong control over Chinese companies 3) China regularly blocks US companies for whatever reason they decide. So yeah, we can say "but banning DJI won't solve the general problem of bad companies; we shouldn't just focus on China; is a ban really fair? etc etc. Or, we can just say "screw it -- China treats US companies like shit and we're not gonna just hand over all our drone info"
  - segasaturn 2y ago
    I'm not sure how that would actually "fix the damn problem"? My point is that American tech companies are just as data-hungry as DJI, probably more, and Chinese tech products are more likely to let users control their devices off-line than American brands. You're right though that creating a boogeyman and attacking it while ignoring the much larger and more complicated problems is great politics (and always has been)
    - khazhoux 2y ago
      See, that's exactly what I mean. Here [1], CISA assesses China-made drones as a national security risk. That is a non-partisan agency. But your response is: * American tech companies are just as data-hungry, if not more. -> irrelevant, this is about foreign cyberattacks or foreign data mining * China produces more user-controllable devices than American brands. -> irrelevant * Boogeyman -> Scare word * Ignoring the much larger and complicated problem -> Deflects and says we can't do /anything/ unless we consider all angles and do /everthing/ This leads to endless handwringing, and is one of the reasons the left has support of only 50% of Americans, when it should be (in my opinion) a huge majority. Because we're endlessly caught up in the attitude of "nope, we really can't do anything in the face of obviously problematic issues." Gosh, it feels racist to ban a Chinese tech company (even though the Chinese government does actually target our cyber infrastructure). Gosh, what about the bad American companies? [1] https://s3.documentcloud.org/documents/24362988/cybersecurity-guidance-chinese-manufactured-uas-final.pdf https://s3.documentcloud.org/documents/24362988/cybersecurit...
- tw04 2y ago
  And yet the US government isn't worried about a US company leaking photos of sensitive information to the US government. The same cannot be said of the Chinese government who may be happy to get extensive drone footage of everyday US infrastructure which can be used in a future war. Meanwhile, China won't even let Google provide a valid map of the country... https://en.wikipedia.org/wiki/Google_Maps#Google_Maps_in_China https://en.wikipedia.org/wiki/Google_Maps#Google_Maps_in_Chi... But tell us all more about how we should be more concerned about a US company requiring an internet login.
  - lmm 2y ago
    The US government is right to be worried about China. Individuals, especially but not exclusively those of us who aren't US citizens, might well have more to fear from the US.
  - makeitdouble 2y ago
    This is always an interesting read for the rest of us neither in the US nor China. On one hand I understand we'll need to move to more insular and protective policies and basically ban foreign technology in so many places, on the other hand I don't want a gov like Ethiopia to have the choice between having no technology or being spied to the bone by all of its tech providers. The EU would be the only place with a one in a million chance to pull it off, there sure must be another way ?
deleted 2y ago
[deleted]
jpgvm 2y ago
> direct internet access or an account with the manufacturer to work Unfortunately this is required by regulators in many countries. In Thailand you can't fly a drone without a license. You need to obtain the license before activating the drone and provide your information and the license number at time of activation (which is tied to drone serial number). It sucks but it's the law here.
- kragen 2y ago
  shitty laws in thailand are no excuse for human rights infringements in the other 99% of the world
  - cruffle_duffle 2y ago
    Requiring an account to use a DJI drone is a human rights violation?
    - kragen 2y ago
      yes, extorting your personal data including things like high-resolution geolocation of where you are, that's a human rights violation. it strips you of your right to privacy. it's also a national security threat, and it's still a national security threat even if the company that's extorting it is domestic dji having access to cameras also strips anyone the drone can see of their human right to privacy
euroderf 2y ago
I would like to see a requirement that any drone sold in (or imported to) the US (or EU) has to be flashable - without having to desolder components, or any other such nonsense. Press some buttons and load new software. An accompanying requirement would be to document interfaces to hardware subsystems (chip spec sheets would suffice). With drones, the potential for mischief is too great to let malware be smuggled in. Is this a politically and technically realistic goal ? Or am I talkin' thru my hat ?
- AdamJacobMuller 2y ago
  Impossible, especially for drones, because it would allow people to trivially flash firmware to drones which can bypass restrictions like no-fly zones and reporting requirements which allow the FAA or other LE to answer questions like "who was flying a drone playing chicken with a low-flying Cessna"
  - chipt4 2y ago
    Err, while it takes a little more technical know-how and some electronics experience, this already exists and is still extremely easy to do.. https://betaflight.com/ https://betaflight.com/ or https://github.com/iNavFlight/inav https://github.com/iNavFlight/inav or https://ardupilot.org/ https://ardupilot.org/ among others
    - snypher 2y ago
      I hope they don't start asking questions about where the px4s are made!
  - euroderf 2y ago
    I figured geofencing might be a dealbreaker.
kragen 2y ago
i agree, but we shouldn't require all firmware to be open-source and user-replaceable on only chinese devices; we should require it for everything, perhaps with narrow exceptions for things like pos terminals and certain kinds of industrial equipment
greenavocado 2y ago
Back before the war it was possible to obtain hacked DJI ROMs from the Russians that disabled all of these connections and restrictions including no-fly zones.

by chme 2y ago

segasaturn 2y ago

While I agree with you, I doubt banning Chinese tech will remedy this problem. My experience is that American brands are much, much more aggressive about making you connect to the internet, install our apps, create an account, subscribe to our newsletter etc. Look at the difference between iRobot and Chinese robot vacuums on Amazon - the difference is night and day.

chme 2y ago
True. I was just talking about my experience with DJI. Where you buy a product, can use it for a bit, and then it stops working, because you haven't connected it to the internet or created an account. It is often the 'market leaders' that are so afraid to loose customers and their market position to implement customer hostile processes into their products.
hatsix 2y ago
Depends on what you consider the "problem". As Congress sees it, the problem is two-fold... You have no control over your data. The company that does have control over your data is beholden to a foreign country not currently considered "a close ally".
mike_d 2y ago
> American brands are much, much more aggressive about making you connect to the internet, install our apps, create an account This whataboutism ignores one very important point. When you connect a device to an American company they might do things that we consider privacy violations, while still staying generally within the bounds of the law. We like to joke about data going to the NSA or something, but in the extremely limited cases where it does protections exist with oversight. Contrast this to Chinese companies where by law every company is part-owned by the government itself. The Ministry of State Security literally has employees who show up to these companies every day like normal workers, but their job is to find and exploit intelligence on foreign individuals and businesses.
- peoplefromibiza 2y ago
  > This whataboutism ignores one very important point. Reverse whataboutism is still whataboutism. For example this predicate > while still staying generally within the bounds of the law. Completely ignores the fact that US companies have been found lying and deceiving to circumvent the barriers posed by the law. But not only US companies, remember the diesel gate? This other predicate > (In China) by law every company is part-owned by the government itself It's completely false, while this one > The Ministry of State Security literally has employees who show up to these companies every day like normal workers It's pure intellectual dishonesty . Every sufficiently advanced intelligence agency has spies. With the USA agencies being the largest employers for spies on the entire Planet.
- ethbr1 2y ago
  The idea of running any internet-connected software with a push-update mechanism, built and controlled by a company in a country without a strong independent rule of law, should terrify far more people than it apparently does. This is one of those 'It's not a problem until it is a problem, and then it's a big fucking problem' scenarios.
  - FactKnower69 2y ago
    >a country without a strong independent rule of law I'd really like you to try and define this term in a way that doesn't exclude the US
khazhoux 2y ago
> While I agree with you, I doubt banning Chinese tech will remedy this problem. I don't mean this as a political issue, but in your comment I see one of the reasons Trump appeals to people. He promotes a mindset of "stop handwringing and just fix the damn problem." Here we know the following: 1) DJI devices have an always-on connection 2) Chinese government is unfriendly to US and exerts strong control over Chinese companies 3) China regularly blocks US companies for whatever reason they decide. So yeah, we can say "but banning DJI won't solve the general problem of bad companies; we shouldn't just focus on China; is a ban really fair? etc etc. Or, we can just say "screw it -- China treats US companies like shit and we're not gonna just hand over all our drone info"
- segasaturn 2y ago
  I'm not sure how that would actually "fix the damn problem"? My point is that American tech companies are just as data-hungry as DJI, probably more, and Chinese tech products are more likely to let users control their devices off-line than American brands. You're right though that creating a boogeyman and attacking it while ignoring the much larger and more complicated problems is great politics (and always has been)
  - khazhoux 2y ago
    See, that's exactly what I mean. Here [1], CISA assesses China-made drones as a national security risk. That is a non-partisan agency. But your response is: * American tech companies are just as data-hungry, if not more. -> irrelevant, this is about foreign cyberattacks or foreign data mining * China produces more user-controllable devices than American brands. -> irrelevant * Boogeyman -> Scare word * Ignoring the much larger and complicated problem -> Deflects and says we can't do /anything/ unless we consider all angles and do /everthing/ This leads to endless handwringing, and is one of the reasons the left has support of only 50% of Americans, when it should be (in my opinion) a huge majority. Because we're endlessly caught up in the attitude of "nope, we really can't do anything in the face of obviously problematic issues." Gosh, it feels racist to ban a Chinese tech company (even though the Chinese government does actually target our cyber infrastructure). Gosh, what about the bad American companies? [1] https://s3.documentcloud.org/documents/24362988/cybersecurity-guidance-chinese-manufactured-uas-final.pdf https://s3.documentcloud.org/documents/24362988/cybersecurit...
tw04 2y ago
And yet the US government isn't worried about a US company leaking photos of sensitive information to the US government. The same cannot be said of the Chinese government who may be happy to get extensive drone footage of everyday US infrastructure which can be used in a future war. Meanwhile, China won't even let Google provide a valid map of the country... https://en.wikipedia.org/wiki/Google_Maps#Google_Maps_in_China https://en.wikipedia.org/wiki/Google_Maps#Google_Maps_in_Chi... But tell us all more about how we should be more concerned about a US company requiring an internet login.
- lmm 2y ago
  The US government is right to be worried about China. Individuals, especially but not exclusively those of us who aren't US citizens, might well have more to fear from the US.
- makeitdouble 2y ago
  This is always an interesting read for the rest of us neither in the US nor China. On one hand I understand we'll need to move to more insular and protective policies and basically ban foreign technology in so many places, on the other hand I don't want a gov like Ethiopia to have the choice between having no technology or being spied to the bone by all of its tech providers. The EU would be the only place with a one in a million chance to pull it off, there sure must be another way ?

deleted 2y ago

[deleted]

jpgvm 2y ago

> direct internet access or an account with the manufacturer to work Unfortunately this is required by regulators in many countries. In Thailand you can't fly a drone without a license. You need to obtain the license before activating the drone and provide your information and the license number at time of activation (which is tied to drone serial number). It sucks but it's the law here.

kragen 2y ago
shitty laws in thailand are no excuse for human rights infringements in the other 99% of the world
- cruffle_duffle 2y ago
  Requiring an account to use a DJI drone is a human rights violation?
  - kragen 2y ago
    yes, extorting your personal data including things like high-resolution geolocation of where you are, that's a human rights violation. it strips you of your right to privacy. it's also a national security threat, and it's still a national security threat even if the company that's extorting it is domestic dji having access to cameras also strips anyone the drone can see of their human right to privacy

euroderf 2y ago

I would like to see a requirement that any drone sold in (or imported to) the US (or EU) has to be flashable - without having to desolder components, or any other such nonsense. Press some buttons and load new software. An accompanying requirement would be to document interfaces to hardware subsystems (chip spec sheets would suffice). With drones, the potential for mischief is too great to let malware be smuggled in. Is this a politically and technically realistic goal ? Or am I talkin' thru my hat ?

AdamJacobMuller 2y ago
Impossible, especially for drones, because it would allow people to trivially flash firmware to drones which can bypass restrictions like no-fly zones and reporting requirements which allow the FAA or other LE to answer questions like "who was flying a drone playing chicken with a low-flying Cessna"
- chipt4 2y ago
  Err, while it takes a little more technical know-how and some electronics experience, this already exists and is still extremely easy to do.. https://betaflight.com/ https://betaflight.com/ or https://github.com/iNavFlight/inav https://github.com/iNavFlight/inav or https://ardupilot.org/ https://ardupilot.org/ among others
  - snypher 2y ago
    I hope they don't start asking questions about where the px4s are made!
- euroderf 2y ago
  I figured geofencing might be a dealbreaker.

kragen 2y ago

i agree, but we shouldn't require all firmware to be open-source and user-replaceable on only chinese devices; we should require it for everything, perhaps with narrow exceptions for things like pos terminals and certain kinds of industrial equipment

greenavocado 2y ago

Back before the war it was possible to obtain hacked DJI ROMs from the Russians that disabled all of these connections and restrictions including no-fly zones.