3 ms·

I agree with the sentiment but do you really trust the government can actually audit some giant codebase? The internet of things really includes your computer a

I agree with the sentiment but do you really trust the government can actually audit some giant codebase? The internet of things really includes your computer and your PS4 and every piece of software on them. It includes your router and your printer and your IP cam that's basically the same thing as your router with camera attached. I don't know what the solution is but I really can't imagine a government body able to audit all that code in any meaningful way. I think rather (and please punch holes in this idea) ... maybe fines if something isn't secure? I can't see how that would work either though. Not even the big guys have secure software as new issues are found all the time. Basically it seems like you need to shun companies that get caught which will hopefully send a message. Also possibly take precautions. Put your internet of things devices on their own networks etc., don't let them on the net directly, ...?

snarfy 12y ago
The government wouldn't be doing the work. We just need the legal framework in place. The industry would do it themselves, but they don't now since there are no real consequences. There should be. We have plenty of rules around how medical records are treated. There needs to be similar rules for all this stuff.
higherpurpose 12y ago
Making companies liable for any hacking would be one way to go, which may be quite effective - granted the politicians will actually listen to the People on this, and not the army of lobbyists that will be set unto Washington against such a proposal.
tzs 12y ago
> I agree with the sentiment but do you really trust the government can actually audit some giant codebase? He didn't say that the government would do the code auditing (unless I missed it). It would be outside firms. I believe they do something similar for certifying hardware. The FCC certifies outside hardware testing labs as being qualified to certify that hardware satisfies FCC requirements. The hardware makers wishing to gain certification hire one of those labs.
- swombat 12y ago
  Indeed... the government can't even audit their own code, let alone someone else's!...
  - tptacek 12y ago
    The government does't audit their own code; they contract Lockheed, SAIC, and Raytheon to do that.
acdha 12y ago
> I don't know what the solution is but I really can't imagine a government body able to audit all that code in any meaningful way. The NSA doesn't seem to have any trouble hiring top-notch reverse engineers. There's no reason to believe that the same approach couldn't work to benefit the country if the combination of mission & budget for competitive salaries were applied to defense instead. That said, the first thing I'd start with would be much simpler: mandatory support where device manufacturers are required to issue security & reliability updates for 10 years[1] or release all of the source code, tools and signing keys into the public domain so there's at least the possibility of user support. 1. Most people expect a car or major appliance to last at least that long without becoming unsafe.
ryandrake 12y ago
I would trust the government to do the things it is good at: regulation, enforcement and penalties. They can contract away the code auditing, security reviews, penetration testing, etc. The government is needed because the free market provides no real way to hit back at companies that harm customers with defective products. In an ideal world, customers would boycott companies that misbehaved, but in reality this never happens. Victims simply do not stop doing business with companies that victimize them. Last time I checked, my local Target and Home Depot were chock-full of customers, despite their demonstrated inability to handle their customers' data securely. EDIT: And, it would be the FTC, not the FCC who would apply such regulation. Indeed, they already list Privacy and Security as within their power to regulate: [1]. In fact their site even has a section dedicated to Internet Of Things: [2]. The problem seems to not be that they are uninvolved, they simply seem to have no teeth. 1: http://www.ftc.gov/tips-advice/business-center/privacy-and-security http://www.ftc.gov/tips-advice/business-center/privacy-and-s... 2: http://www.ftc.gov/tips-advice/business-center/guidance/careful-connections-building-security-internet-things http://www.ftc.gov/tips-advice/business-center/guidance/care...

snarfy 12y ago

The government wouldn't be doing the work. We just need the legal framework in place. The industry would do it themselves, but they don't now since there are no real consequences. There should be. We have plenty of rules around how medical records are treated. There needs to be similar rules for all this stuff.

higherpurpose 12y ago

Making companies liable for any hacking would be one way to go, which may be quite effective - granted the politicians will actually listen to the People on this, and not the army of lobbyists that will be set unto Washington against such a proposal.

tzs 12y ago

> I agree with the sentiment but do you really trust the government can actually audit some giant codebase? He didn't say that the government would do the code auditing (unless I missed it). It would be outside firms. I believe they do something similar for certifying hardware. The FCC certifies outside hardware testing labs as being qualified to certify that hardware satisfies FCC requirements. The hardware makers wishing to gain certification hire one of those labs.

swombat 12y ago
Indeed... the government can't even audit their own code, let alone someone else's!...
- tptacek 12y ago
  The government does't audit their own code; they contract Lockheed, SAIC, and Raytheon to do that.

acdha 12y ago

> I don't know what the solution is but I really can't imagine a government body able to audit all that code in any meaningful way. The NSA doesn't seem to have any trouble hiring top-notch reverse engineers. There's no reason to believe that the same approach couldn't work to benefit the country if the combination of mission & budget for competitive salaries were applied to defense instead. That said, the first thing I'd start with would be much simpler: mandatory support where device manufacturers are required to issue security & reliability updates for 10 years[1] or release all of the source code, tools and signing keys into the public domain so there's at least the possibility of user support. 1. Most people expect a car or major appliance to last at least that long without becoming unsafe.

ryandrake 12y ago

I would trust the government to do the things it is good at: regulation, enforcement and penalties. They can contract away the code auditing, security reviews, penetration testing, etc. The government is needed because the free market provides no real way to hit back at companies that harm customers with defective products. In an ideal world, customers would boycott companies that misbehaved, but in reality this never happens. Victims simply do not stop doing business with companies that victimize them. Last time I checked, my local Target and Home Depot were chock-full of customers, despite their demonstrated inability to handle their customers' data securely. EDIT: And, it would be the FTC, not the FCC who would apply such regulation. Indeed, they already list Privacy and Security as within their power to regulate: [1]. In fact their site even has a section dedicated to Internet Of Things: [2]. The problem seems to not be that they are uninvolved, they simply seem to have no teeth. 1: http://www.ftc.gov/tips-advice/business-center/privacy-and-security http://www.ftc.gov/tips-advice/business-center/privacy-and-s... 2: http://www.ftc.gov/tips-advice/business-center/guidance/careful-connections-building-security-internet-things http://www.ftc.gov/tips-advice/business-center/guidance/care...