3 ms·

> Most software vulnerabilities aren't intentionally added backdoors, but flaws in the software that shipped on a device. Disagree, it is extremely common for

> Most software vulnerabilities aren't intentionally added backdoors, but flaws in the software that shipped on a device. Disagree, it is extremely common for e.g. TVs and smart phones to ship with malware included. In fact it is almost impossible to buy some classes of devices that aren't intentionally compromised. Having the thing never connect to the Internet at all and never receive updates is a far better security posture, and is the common recommendation among knowledgeable people for e.g. TVs. In practice, your neighbors are almost certainly quite a bit less malicious than whatever a smart device might talk to on the Internet. Your neighbor isn't going to hack your cordless phone. Your TV manufacture is definitely going to drop malware onto it, disable functionality (i.e. damage it), etc.

kube-system 2y ago
> Disagree, it is extremely common for e.g. TVs and smart phones to ship with malware included. Both are common! But there are many hundreds of thousands of known software vulnerabilities. > Having the thing never connect to the Internet at all and never receive updates is a far better security posture It might be, depending on the particular situation. But it doesn’t really matter for IoT devices, because they all, by definition, connect to the internet. “Don’t connect to the internet” is a nonsensical suggestion for IoT devices.
AJ007 2y ago
Any sort of warranty or security representation is basically snake oil except in a very narrow set of circumstances and conditions, yet still not 100%. If Apple can't keep iPhones 100% locked down, with billions of security spend, no fucking way some government program is going to authentic security across a wide variety of devices or various hardware & software qualities. One thing the government can or perhaps should mandate, and is easily verifiable, is kill switches - devices should be physically incapable of connecting to any wireless network when a kill switch is engaged. If the FTC or a trade regulator wants to regulate at another level, maybe they could also say certain classes of devices must continue to function when disconnection (I might want the Apple TV plugged in to the TV connected to the internet, but the TV itself totally disconnected.) Because some devices now will surreptitiously search for open WiFi networks and try to go online even if a user does not connect via WiFi, this seems reasonable. If we go down the route of a government agency creating and mandating security, #1 Government back doors will persist and perhaps even be required (relevant to the whole TikTok thing this week.) #2 They will be unable to quickly respond to new threat surfaces while still representing that whatever is present is secure (it isn't.)
- hulitu 2y ago
  > If Apple can't keep iPhones 100% locked down, with billions of security spend, I would say this is intentional. Like hardcoded passwords in {Cisco, Palo Alto, Fortinet} routers.
reverendsteveii 2y ago
> Most software vulnerabilities aren't intentionally added backdoors >it is extremely common for e.g. TVs and smart phones to ship with malware included These aren't mutually exclusive. With that being said, I'm probably with you when it comes to the overall debate. For something to get exploited it needs a vulnerability and a means to exploit it. The most insecure device in the world can't be exploited if I'm the only one who ahs the means to do it. Unfortunately we live in a world where Zawinski's Law has itself expanded such that everyone wants to be able to access everything from everywhere, which rules out airgapping a lot of devices. It's a consumer economy - we have to build what people want and then secure it. We don't have the luxury of building secure things and then convincing people to want them.

kube-system 2y ago

> Disagree, it is extremely common for e.g. TVs and smart phones to ship with malware included. Both are common! But there are many hundreds of thousands of known software vulnerabilities. > Having the thing never connect to the Internet at all and never receive updates is a far better security posture It might be, depending on the particular situation. But it doesn’t really matter for IoT devices, because they all, by definition, connect to the internet. “Don’t connect to the internet” is a nonsensical suggestion for IoT devices.

AJ007 2y ago

Any sort of warranty or security representation is basically snake oil except in a very narrow set of circumstances and conditions, yet still not 100%. If Apple can't keep iPhones 100% locked down, with billions of security spend, no fucking way some government program is going to authentic security across a wide variety of devices or various hardware & software qualities. One thing the government can or perhaps should mandate, and is easily verifiable, is kill switches - devices should be physically incapable of connecting to any wireless network when a kill switch is engaged. If the FTC or a trade regulator wants to regulate at another level, maybe they could also say certain classes of devices must continue to function when disconnection (I might want the Apple TV plugged in to the TV connected to the internet, but the TV itself totally disconnected.) Because some devices now will surreptitiously search for open WiFi networks and try to go online even if a user does not connect via WiFi, this seems reasonable. If we go down the route of a government agency creating and mandating security, #1 Government back doors will persist and perhaps even be required (relevant to the whole TikTok thing this week.) #2 They will be unable to quickly respond to new threat surfaces while still representing that whatever is present is secure (it isn't.)

hulitu 2y ago
> If Apple can't keep iPhones 100% locked down, with billions of security spend, I would say this is intentional. Like hardcoded passwords in {Cisco, Palo Alto, Fortinet} routers.

reverendsteveii 2y ago

> Most software vulnerabilities aren't intentionally added backdoors >it is extremely common for e.g. TVs and smart phones to ship with malware included These aren't mutually exclusive. With that being said, I'm probably with you when it comes to the overall debate. For something to get exploited it needs a vulnerability and a means to exploit it. The most insecure device in the world can't be exploited if I'm the only one who ahs the means to do it. Unfortunately we live in a world where Zawinski's Law has itself expanded such that everyone wants to be able to access everything from everywhere, which rules out airgapping a lot of devices. It's a consumer economy - we have to build what people want and then secure it. We don't have the luxury of building secure things and then convincing people to want them.