4 ms·

I think what's being said here is that if we're going to talk about what "needs" to be done about security (especially if government regulation is to be involve

I think what's being said here is that if we're going to talk about what "needs" to be done about security (especially if government regulation is to be involved), and if we're going to ban something, then it ought to be devices that need to talk to "the cloud". Saying we "need" APs to segment VLANs is missing the point. The cloud servers are known to be malicious (e.g. that company that intentionally bricked people's inverters the other day). As you say, it's impossible to have reasonable filters when everything wants to talk to the entire world. What we "need" is for IoT devices to communicate through purely local networks and have no Internet access. e.g. mandate a standard to discover a local MQTT broker (which the router may also provide). In that world, there's no reason for a device to ever talk to anything other than e.g. 192.168.1.1, so filtering is easy and can be made default.

simoncion 2y ago
> The cloud servers are known to be malicious... Malicious software is malicious regardless of whether it's running as a VM on Someone Else's Server, or a Linux process on personally-owned bare metal. > Saying we "need" APs to segment VLANs is missing the point. > What we "need" is for IoT devices to communicate through purely local networks and have no Internet access. [They will do this via a mechanism using MQTT where they're required to declare if they're bad.] a) Who said anything about APs? While I do have WiFi Access Points (that I did not mention), I also have hard-wired VLAN segmentation. [0] b) From a network design perspective, it's a lot easier and more efficient to provide a VLAN that doesn't have Internet egress than to attempt to sort out which of a mess of hosts are permitted to talk to the Internet from which aren't, and ALSO prevent MAC- and/or IP-address spoofing to evade any such filtering. c) I have no idea why you're invoking MQTT (specifically), but any scheme that requires a potentially-untrusted host running potentially-untrusted hardware and software to declare whether or not it's to be trusted is doomed to failure right off the bat. [0] Sure, I'm a power user. But, a "VLAN-isolated network for untrusted machines" feature shouldn't be something that only power users get. This SHOULD be a baseline feature in consumer-grade WiFi APs and switches. (The race-to-the-bottom feature of the "market" for consumer gear is very sad.)
- ndriscoll 2y ago
  Most people have a single combo box for their router/switch/firewall/AP, and maybe modem. For most people, those things are synonymous. The point is isolating devices from each other isn't what people need. They need their devices to accept commands from each other or their computer/phone. What they don't need is their devices to talk to half the Internet. My htpc talks to exactly one machine, for example (my NAS). It's trivial to audit and would work fine if I blocked Internet access or gave it a whitelist. For people that use home assistant, again their devices should need to talk to a broker and that's it. A reasonable device only talks to a handful of locations because you didn't ask it to do anything else. The world where Android and Windows and IoT devices chat all day to thousands of servers is what's the problem. Restricting such devices to only talk to the Internet is exactly the wrong solution. You could lock things down once there's an ecosystem in place for local control, but doing it now just ossifies the existing dumpster fire. If one were to suggest regulation is needed for security (and governments are starting to do so), then what's needed is to ban cloud devices.
  - simoncion 2y ago
    > For most people, those things are synonymous. When talking about these things in a tech-savvy forum, you'd do well to separate the components (switch, WiFi AP, router) out, rather than thinking them as one indivisible unit. It helps for clarity of conversation and thinking. You have some misconceptions that might arise from this muddling you're doing. > The point is isolating devices from each other isn't what people need. They need their devices to accept commands from each other or their computer/phone. What they don't need is their devices to talk to half the Internet. When did I suggest isolating these devices from anything other than the Internet? The whole point of having a router tied into the various VLANs on your network is so that you can program the router to decide what off-subnet traffic goes where. If you want to have a fully-isolated VLAN, you can... but I never mentioned any isolation other than from Internet egress. > A reasonable device only talks to a handful of locations because you didn't ask it to do anything else. If you purchase devices that are hard-coded to talk to machines hosted on someone else's servers, and you don't want to reverse-engineer and take ongoing maintenance responsibility for the software running in those devices, then your only choice in the matter if the manufacturer chooses to "host" those servers in GCP, AWS, or similar is to prevent the devices from talking to the Internet at all. You might also review this conversation I had regarding the infeasibility of making a whitelist for typical devices and clients that demand Internet access: <https://news.ycombinator.com/item?id=42455401 https://news.ycombinator.com/item?id=42455401>

simoncion 2y ago

> The cloud servers are known to be malicious... Malicious software is malicious regardless of whether it's running as a VM on Someone Else's Server, or a Linux process on personally-owned bare metal. > Saying we "need" APs to segment VLANs is missing the point. > What we "need" is for IoT devices to communicate through purely local networks and have no Internet access. [They will do this via a mechanism using MQTT where they're required to declare if they're bad.] a) Who said anything about APs? While I do have WiFi Access Points (that I did not mention), I also have hard-wired VLAN segmentation. [0] b) From a network design perspective, it's a lot easier and more efficient to provide a VLAN that doesn't have Internet egress than to attempt to sort out which of a mess of hosts are permitted to talk to the Internet from which aren't, and ALSO prevent MAC- and/or IP-address spoofing to evade any such filtering. c) I have no idea why you're invoking MQTT (specifically), but any scheme that requires a potentially-untrusted host running potentially-untrusted hardware and software to declare whether or not it's to be trusted is doomed to failure right off the bat. [0] Sure, I'm a power user. But, a "VLAN-isolated network for untrusted machines" feature shouldn't be something that only power users get. This SHOULD be a baseline feature in consumer-grade WiFi APs and switches. (The race-to-the-bottom feature of the "market" for consumer gear is very sad.)

ndriscoll 2y ago
Most people have a single combo box for their router/switch/firewall/AP, and maybe modem. For most people, those things are synonymous. The point is isolating devices from each other isn't what people need. They need their devices to accept commands from each other or their computer/phone. What they don't need is their devices to talk to half the Internet. My htpc talks to exactly one machine, for example (my NAS). It's trivial to audit and would work fine if I blocked Internet access or gave it a whitelist. For people that use home assistant, again their devices should need to talk to a broker and that's it. A reasonable device only talks to a handful of locations because you didn't ask it to do anything else. The world where Android and Windows and IoT devices chat all day to thousands of servers is what's the problem. Restricting such devices to only talk to the Internet is exactly the wrong solution. You could lock things down once there's an ecosystem in place for local control, but doing it now just ossifies the existing dumpster fire. If one were to suggest regulation is needed for security (and governments are starting to do so), then what's needed is to ban cloud devices.
- simoncion 2y ago
  > For most people, those things are synonymous. When talking about these things in a tech-savvy forum, you'd do well to separate the components (switch, WiFi AP, router) out, rather than thinking them as one indivisible unit. It helps for clarity of conversation and thinking. You have some misconceptions that might arise from this muddling you're doing. > The point is isolating devices from each other isn't what people need. They need their devices to accept commands from each other or their computer/phone. What they don't need is their devices to talk to half the Internet. When did I suggest isolating these devices from anything other than the Internet? The whole point of having a router tied into the various VLANs on your network is so that you can program the router to decide what off-subnet traffic goes where. If you want to have a fully-isolated VLAN, you can... but I never mentioned any isolation other than from Internet egress. > A reasonable device only talks to a handful of locations because you didn't ask it to do anything else. If you purchase devices that are hard-coded to talk to machines hosted on someone else's servers, and you don't want to reverse-engineer and take ongoing maintenance responsibility for the software running in those devices, then your only choice in the matter if the manufacturer chooses to "host" those servers in GCP, AWS, or similar is to prevent the devices from talking to the Internet at all. You might also review this conversation I had regarding the infeasibility of making a whitelist for typical devices and clients that demand Internet access: <https://news.ycombinator.com/item?id=42455401 https://news.ycombinator.com/item?id=42455401>