4 ms·

> Every user need to know their devices and vendor before purchasing. This completely ignores the reality of how the majority of people buy and use their compu

by cnvogel 12y ago

> Every user need to know their devices and vendor before purchasing. This completely ignores the reality of how the majority of people buy and use their computers. Sure, personally I (as: the HN user typing this comment) can portscan my router, solder in the serial port to get the system console... but that's not something that can reasonably be required from any average Joe. Things on that level of negligence should be dealt with just like bare cables touchable from the outside: Have some entity go into stores, buy the box, check it for the worst vulnerabilities, declare it unsuitable for sale and place a ban on the vendor. We do this for childrens' toys, electrical appliances, ... why not do it for IT equipment? Just to weed out the worst offenders in terms of security holes.

a3n 12y ago
That's a great idea, and would be a natural fit for both Consumer Reports and Underwriters Laboratories in the US.
userbinator 12y ago
Be careful what you wish for... giving more control to the authorities is something that may have quite oppressive long-term effects. You might solve this problem in the short term, but end up with only being able to buy approved devices containing more obscure, government-sponsored backdoors instead.
- acdha 12y ago
  Yeah, I mean, who hasn't heard about the time the UL people snuck a backdoor into someone's lighting so the DEA could kill pot-farms. Or that time when Consumer Reports forced car manufacturers to give the highway patrol a backdoor to prevent speeding. Ignoring the history of non-government regulation, there's a reason why the FCC isn't the agency which recorded everyone's phone calls. There are huge civil liberties issues right now but they're orthogonal to consumer protection; we'll need to rein in the NSA no matter how or if we decide to do anything about companies shipping shoddy devices.
- TeMPOraL 12y ago
  I know you fear losing control and utility of your computing devices (I do too!) "because security", but I'm with GP on this one. This level of negligence is something public needs to be protected from. It's akin to a company manufacturing toys from toxic materials. Whether by accident or cost-cutting, the product is dangerous and should be taken off the shelves, and producer should be open for liability for any damages it caused. It's a matter of consumer protection.
- moe 12y ago
  but end up with only being able to buy approved devices containing more obscure, government-sponsored backdoors instead. We currently have these backdoors-due-to-incompetence in addition to the government backdoors. Taking either out of the equation is a win.
- belorn 12y ago
  Like all those Lemon laws. Used car dealers reputation might someday not be synonymous with fraudster that try to peddle broken machines to gullible people. I must say you a taking quite a leap from "do not sell devices which is intended to harm consumers" to "sell only approved devices which has government-sponsored backdoors in them". Should consumers be scared that government try to do the same with food safety?
  - Frondo 12y ago
    I have often, especially in the comment sections for regional newspapers, seen the claim that yes, the government should step away from food safety. The food producer's freedom from inspection trumps the citizenry's ability to eat with minimal risk of food poisoning, so goes the thinking.
jakejake 12y ago
I'm sure somebody will probably point out to me why this is a terrible idea, but I have thought that ISPs probably can detect traffic known to be coming to/from bot networks and then send a letter of warning to the customer. They can do it for supposedly illegal file sharing, so why not do something helpful and let customers know that fishy traffic is coming from their system? I don't mean they should be able to shut you off or anything, but I personally wouldn't mind a notification letting me know that I may have been hacked.
- phaus 12y ago
  They are allowed to look into the traffic only as much as they need to in order to maintain quality service. They notice stuff like botnets and piracy because both of these activities have the potential to generate abnormal amounts of traffic. Another reason they are likely to notice these things is because a third party will often notify them about the activity. They would have to monitor your connection/activity in a way that's highly unethical and possibly illegal in order to detect anything that isn't overly noisy.
  - jakejake 12y ago
    That makes sense. I'd imagine though that it shows up on the ISP's radar when major DoS attacks happen. It seems like they could set up alarms for such things. Maybe it could be an opt-in thing.
    - phaus 12y ago
      DoS attacks also generate huge amounts of traffic, and so they are also detected through the normal, high-level monitoring activity that ISPs conduct.
noblethrasher 12y ago
It wouldn't even be that hard: Just require the vendors to publish the state machine diagram, and if an examiner discovers a hidden “weird machine”[1], they recommend a sanction that depends on how powerful the weird machine is. If it’s Turing equivalent, then it gets banned outright. If the weird machine was knowingly created and hidden, then we start talking about fines and other penalties. [1] http://en.m.wikipedia.org/wiki/Weird_machine http://en.m.wikipedia.org/wiki/Weird_machine
- azernik 12y ago
  Most IT equipment is not built in such a way that its behavior is formally-verifiable or even formally-describable as a state machine - for the most part, we're talking about a full Linux installation that comes with the vendor's preferred web server (for administration) and default routing configuration.
  - noblethrasher 12y ago
    Sorry, I should have made it more explicit that I'm just talking about the stuff at the edges. For instance, we can do this with something like a TCP library just by evaluating it against the state machine published in the RFC. Similarly, custom protocols are ultimately just state machines, and it's easier to effect secureness when you limit the protocol to a regular or context-free grammar[1]. But, if the vendor insists that their protocol needs a more powerful grammar, then at least we can start talking about security/feature trade-offs in formal terms (i.e. vendors would have to justify their decisions with math and computer science instead of feature checkboxes and pricing psychology). [1] http://www.cs.dartmouth.edu/~sergey/langsec/ http://www.cs.dartmouth.edu/~sergey/langsec/
    - moe 12y ago
      How do you "limit the protocol to a regular or context-free grammar" in a consumer internet router?
      - noblethrasher 12y ago
TeMPOraL 12y ago
Yes, exactly. In the US, this is the thing NSA should be going after ("pentesting for the people"), unleashing their wrath on vendors who sell this product (How many a politician uses a vulnerable router like that? How many a public service? It could endanger lives.) This is the thing EFF should be making easy money on.

by cnvogel 12y ago

a3n 12y ago

That's a great idea, and would be a natural fit for both Consumer Reports and Underwriters Laboratories in the US.

userbinator 12y ago

Be careful what you wish for... giving more control to the authorities is something that may have quite oppressive long-term effects. You might solve this problem in the short term, but end up with only being able to buy approved devices containing more obscure, government-sponsored backdoors instead.

acdha 12y ago
Yeah, I mean, who hasn't heard about the time the UL people snuck a backdoor into someone's lighting so the DEA could kill pot-farms. Or that time when Consumer Reports forced car manufacturers to give the highway patrol a backdoor to prevent speeding. Ignoring the history of non-government regulation, there's a reason why the FCC isn't the agency which recorded everyone's phone calls. There are huge civil liberties issues right now but they're orthogonal to consumer protection; we'll need to rein in the NSA no matter how or if we decide to do anything about companies shipping shoddy devices.
TeMPOraL 12y ago
I know you fear losing control and utility of your computing devices (I do too!) "because security", but I'm with GP on this one. This level of negligence is something public needs to be protected from. It's akin to a company manufacturing toys from toxic materials. Whether by accident or cost-cutting, the product is dangerous and should be taken off the shelves, and producer should be open for liability for any damages it caused. It's a matter of consumer protection.
moe 12y ago
but end up with only being able to buy approved devices containing more obscure, government-sponsored backdoors instead. We currently have these backdoors-due-to-incompetence in addition to the government backdoors. Taking either out of the equation is a win.
belorn 12y ago
Like all those Lemon laws. Used car dealers reputation might someday not be synonymous with fraudster that try to peddle broken machines to gullible people. I must say you a taking quite a leap from "do not sell devices which is intended to harm consumers" to "sell only approved devices which has government-sponsored backdoors in them". Should consumers be scared that government try to do the same with food safety?
- Frondo 12y ago
  I have often, especially in the comment sections for regional newspapers, seen the claim that yes, the government should step away from food safety. The food producer's freedom from inspection trumps the citizenry's ability to eat with minimal risk of food poisoning, so goes the thinking.

jakejake 12y ago

I'm sure somebody will probably point out to me why this is a terrible idea, but I have thought that ISPs probably can detect traffic known to be coming to/from bot networks and then send a letter of warning to the customer. They can do it for supposedly illegal file sharing, so why not do something helpful and let customers know that fishy traffic is coming from their system? I don't mean they should be able to shut you off or anything, but I personally wouldn't mind a notification letting me know that I may have been hacked.

phaus 12y ago
They are allowed to look into the traffic only as much as they need to in order to maintain quality service. They notice stuff like botnets and piracy because both of these activities have the potential to generate abnormal amounts of traffic. Another reason they are likely to notice these things is because a third party will often notify them about the activity. They would have to monitor your connection/activity in a way that's highly unethical and possibly illegal in order to detect anything that isn't overly noisy.
- jakejake 12y ago
  That makes sense. I'd imagine though that it shows up on the ISP's radar when major DoS attacks happen. It seems like they could set up alarms for such things. Maybe it could be an opt-in thing.
  - phaus 12y ago
    DoS attacks also generate huge amounts of traffic, and so they are also detected through the normal, high-level monitoring activity that ISPs conduct.

noblethrasher 12y ago

It wouldn't even be that hard: Just require the vendors to publish the state machine diagram, and if an examiner discovers a hidden “weird machine”[1], they recommend a sanction that depends on how powerful the weird machine is. If it’s Turing equivalent, then it gets banned outright. If the weird machine was knowingly created and hidden, then we start talking about fines and other penalties. [1] http://en.m.wikipedia.org/wiki/Weird_machine http://en.m.wikipedia.org/wiki/Weird_machine

azernik 12y ago
Most IT equipment is not built in such a way that its behavior is formally-verifiable or even formally-describable as a state machine - for the most part, we're talking about a full Linux installation that comes with the vendor's preferred web server (for administration) and default routing configuration.
- noblethrasher 12y ago
  Sorry, I should have made it more explicit that I'm just talking about the stuff at the edges. For instance, we can do this with something like a TCP library just by evaluating it against the state machine published in the RFC. Similarly, custom protocols are ultimately just state machines, and it's easier to effect secureness when you limit the protocol to a regular or context-free grammar[1]. But, if the vendor insists that their protocol needs a more powerful grammar, then at least we can start talking about security/feature trade-offs in formal terms (i.e. vendors would have to justify their decisions with math and computer science instead of feature checkboxes and pricing psychology). [1] http://www.cs.dartmouth.edu/~sergey/langsec/ http://www.cs.dartmouth.edu/~sergey/langsec/
  - moe 12y ago
    How do you "limit the protocol to a regular or context-free grammar" in a consumer internet router?
    - noblethrasher 12y ago

TeMPOraL 12y ago

Yes, exactly. In the US, this is the thing NSA should be going after ("pentesting for the people"), unleashing their wrath on vendors who sell this product (How many a politician uses a vulnerable router like that? How many a public service? It could endanger lives.) This is the thing EFF should be making easy money on.