require minimum supported lifetimes of 5 years or full open sourcing of software (device and server) in the event that support ceases prior to the required lifetime.
gradually expand that lifetime out to ten.
Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
751–760 of 944 posts
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#752(I also submitted this as an Express Comment in the proceeding. If you agree, consider also filing a comment.) A lot of issues around IoT device security are hard, but there is one simple and easy piece of policy that would be a big win: Make the requirements stricter if the product contains a microphone than if it doesn't. Some device makers are putting microphones into devices that don't need them, to support funct…
Make strict rules for all of them. As another commenter pointed out, the wifi-connected clothes dryer could be used in an attack to take down the power grid by having many of them switch on at the same time - causing a network overload.
Don't try to predict potential avenues of attack. Make strict rules for all IoT devices.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#753Earlier quoted context omitted.
Apart from Smart TVs, most people don't have an IoT device to begin with.
Smart speakers, printers, thermostats, light bulbs, security cameras, door bells, locks, smartwatches, TV sticks...
I don't count a watch as an IoT device. And most on the market are Apple devices.
Apart from printers and smart TVs, less than half of US households have any of those other devices.
https://www.statista.com/statistics/1124290/smart-home-devic...
Anecdotally, most people I know who own those devices are the more technically inclined. Especially the thermostats and light bulbs. Even the doorbell surveillance networks have low penetration.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#754Europe has CRA and RED. Maybe start with those?
This is a good point! CRA (Cyber Resilience Act) will make secure update and other basic security requirements part of the CE labelling process. It seems well thought-out.
CRA will apply to any device with what is defined as a digital element (which in effect will be close to 100% of all IoT devices for instance). This definition also looks solid.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#755Earlier quoted context omitted.
Have a look at https://www.apple.com/sg/support/professional/enterprise/
So have you tried it? Has anyone done it? Upthread it was suggested for consumers. (And you'd have to be a pretty big enterprise to have any leverage with Apple!)
You can try it. I don't think Apple will want to talk to you.
That's fine. They have just as much freedom as you do.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#756Earlier quoted context omitted.
> These regulations put us on the path of trusting religious-like in government. We don't need to have religious-like faith in government because we can vote for people who will do what we want them to and we can vote out the people who refuse to do their job. It doesn't happen without the people getting involved and holding their government accountable though. You don't have to pray when you can vote. Without regula…
Maybe I could have some faith if regulatory bureaucrats were fired when there are major regulatory failures e.g. 737 max. Maybe I could have some faith if police state agency employees were jailed for FISA abuse. Voting isn't enough because even elected officials aren't allowed to fire these people.
> Maybe I could have some faith if regulatory bureaucrats were fired when there are major regulatory failures e.g. 737 max.
If I were Boeing, I would hire the fired bureaucrat with a lavish comp package and make sure he's at every meeting, conference, get-together, etc. looking well-tanned and happy.
That makes negotiating with the fired guy's replacement much much easier.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#757Earlier quoted context omitted.
> Remote update mechanisms can themselves present security problems in some domains. Not really if done right to be fair. It's just a matter of implementing a signature verification of the firmware updates that are installed on the device. > IoT is making its way into defense and enterprise environments where reliability is a matter of national security. If it's a matter of national security surely you don't use IoT…
> It's just a matter of implementing a signature verification correctly With rollback protection, a chain of signing keys to allow revocation, time stamping, correct parsing, enough scratch space to hold an entire separate image in A/B, enough processing power to verify image signatures, etc etc. Doing this well is very hard. Given most IoT vendors don’t yet know how to prevent XSS, there’s near zero chance they’ll g…
Also with right to repair, you need to be able to disable signiture checks and upload custom firmware
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#758Earlier quoted context omitted.
This is also a key point to fighting ewaste and making devices last longer. I have appliances from the 70s including a rotary telephone, that I still use regularly. If you combined mandatory OSS support with repair cafes, you would have a model for sustainable reuse and better security. You may even start a commercial aftermarket in reflashing older devices!
At rotary phones still compatible with todays standards? If that’s the case I might get one too.
In my case I use a small gadget to convert the pulses to DTMF tones, which feed into a voip connection.
The point is that the device itself still works, unlike much iot crap which can't be made to work once the server goes down.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#759Earlier quoted context omitted.
This might be an unpopular opinion but I respectfully do not see it that way. I agree with promoting security for IoT devices, but there needs to be consent from the company being probed for vulnerabilities or else I find it hard to consider it legitimate research, regardless of intent. I dont think anyone would like it very much if someone came to their house and documented all the ways to rob it they could find, ev…
This is a very poor analogy. For one thing, casing someone's home is not interesting research. It's not news to anyone that locks only keep honest people out. You need physical access to break in. The legal system and the people nearby (neighbors and residents, and their firearms in the USA) are the main lines of defense here. Unlocked doors are a harm targeting one household. Conversely, with vulnerable IoT devices,…
I think a better analogy can be drawn by just considering the physical version of some things. For IoT, you can say if someone discovers a specific brand of physical lock can be broken in unexpected ways, they should be allowed to communicate this in a way that benefits the users of the lock without facing any legal risk. For internet banking, you can discuss a physical vault that safekeeps everyone's gold, and say that someone who notices a broken lock should not be punished for telling the vault manager to fix the lock. Unfortunately the common situation is that the lock company and the vault manager will sue because they don't want to admit they put their users and clients at risk - it sounds absurd, but that's what happens in the electronic world.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#760I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks. The core problem is that without control of the firmware, consumers don't really…
>AND be obligated to release the full source code for the device once they decide to end support. This is unreasonable. Code is often reused in the next generation of a product. The company may not have the rights to release all of the code.
Then they have to acquire the rights to do so for of all components before they use those components.