5 ms·

Since this can be a significant security issue for the state, why doesn't the government sponsor a security audit of the software. Does it upload the data or ev

Since this can be a significant security issue for the state, why doesn't the government sponsor a security audit of the software. Does it upload the data or everything is done on the device? (Also, will have to keep up with the updates)

grosswait 10mo ago
How does that provide any assurance against future changes that the public wouldn’t have any ability to know about.
- hackernewds 10mo ago
  So the govt implements rules and a panopticon for penalties. this works for the FDA, why wouldn't it for the FCC
  - pintxo 10mo ago
    Because regulation is bad, according to the current executive? Politics aside, the FDA applies a very generous amount of regulation (mostly justifiable), not sure we want to pay multiples for our consumer electronics, as it (mostly) shows acceptable behavior and rearely kills anybody.
    - trimethylpurine 10mo ago
      It is bad. Regulations have been historically hijacked to benefit corporate interests. See Intuit and tax policy for example. Voters on the right naively thought he'd work to fix it. (Wrong!) But it is very much bad for a very large number of issues. Maybe next executive will fix it? (Wrong!)
kspacewalk2 10mo ago
Better yet, why not pick a security auditor and have the bidder pay for it, as a condition for approval?
IAmBroom 10mo ago
"Why doesn't the state protect everyone from ___?" is a naive question. Almost anything can be a significant security issue for the state. They have to carefully choose where they are going to spend effort & money. And they pick whatever will keep them safely in power... which never ever includes "strict regulation of vacuum cleaners".
- PaulDavisThe1st 10mo ago
  > which never ever includes "strict regulation of vacuum cleaners but has routinely included "network and encryption related technologies". It's just that these two worlds now, amazingly and probably incorrectly, overlap.
  - CamperBob2 10mo ago
    The government's idea of regulating encryption-related technologies is to prohibit anyone but the government from using them. No, thanks.
- Tangurena2 10mo ago
  We don't regulate/protect the SCADA systems that run utilities like water treatment plants and the power transmission system.
Tangurena2 10mo ago
The NSA has a bad historical reputation for this sort of thing - intentionally weakening crypto standards to make things easier for themselves to break, while keeping them "strong enough" that other agencies outside of NSA/GCHQ/GRU can't. The Crypto AG scandal [0] was pretty bad, with Clipper/Skipjack & Dual_EC_DRBG [1] being more recent ones. The NSA could do what you are asking to do, but they probably won't let us know what the really bad holes are because they want to keep using them. Notes: 0 - https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-... 1 - https://www.scientificamerican.com/article/nsa-nist-encryption-scandal/ https://www.scientificamerican.com/article/nsa-nist-encrypti..., https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG

grosswait 10mo ago

How does that provide any assurance against future changes that the public wouldn’t have any ability to know about.

hackernewds 10mo ago
So the govt implements rules and a panopticon for penalties. this works for the FDA, why wouldn't it for the FCC
- pintxo 10mo ago
  Because regulation is bad, according to the current executive? Politics aside, the FDA applies a very generous amount of regulation (mostly justifiable), not sure we want to pay multiples for our consumer electronics, as it (mostly) shows acceptable behavior and rearely kills anybody.
  - trimethylpurine 10mo ago
    It is bad. Regulations have been historically hijacked to benefit corporate interests. See Intuit and tax policy for example. Voters on the right naively thought he'd work to fix it. (Wrong!) But it is very much bad for a very large number of issues. Maybe next executive will fix it? (Wrong!)

kspacewalk2 10mo ago

Better yet, why not pick a security auditor and have the bidder pay for it, as a condition for approval?

IAmBroom 10mo ago

"Why doesn't the state protect everyone from ___?" is a naive question. Almost anything can be a significant security issue for the state. They have to carefully choose where they are going to spend effort & money. And they pick whatever will keep them safely in power... which never ever includes "strict regulation of vacuum cleaners".

PaulDavisThe1st 10mo ago
> which never ever includes "strict regulation of vacuum cleaners but has routinely included "network and encryption related technologies". It's just that these two worlds now, amazingly and probably incorrectly, overlap.
- CamperBob2 10mo ago
  The government's idea of regulating encryption-related technologies is to prohibit anyone but the government from using them. No, thanks.
Tangurena2 10mo ago
We don't regulate/protect the SCADA systems that run utilities like water treatment plants and the power transmission system.

Tangurena2 10mo ago

The NSA has a bad historical reputation for this sort of thing - intentionally weakening crypto standards to make things easier for themselves to break, while keeping them "strong enough" that other agencies outside of NSA/GCHQ/GRU can't. The Crypto AG scandal [0] was pretty bad, with Clipper/Skipjack & Dual_EC_DRBG [1] being more recent ones. The NSA could do what you are asking to do, but they probably won't let us know what the really bad holes are because they want to keep using them. Notes: 0 - https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-... 1 - https://www.scientificamerican.com/article/nsa-nist-encryption-scandal/ https://www.scientificamerican.com/article/nsa-nist-encrypti..., https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG