Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What If We Put Warnings on IoT Devices?

troyhunt.com

Post reply on HN
Print view View original

51–60 of 159 posts

Re: What If We Put Warnings on IoT Devices?

#51

Post by npsimons »

seanmcdirmid wrote: post #32
npsimons wrote: post #17

Earlier quoted context omitted.

> This feels kind of like that. It might feel like that, but it isn't. Everything[1] causes cancer. Not everything needs to have an Internet connection to a service to function, not essentially at least. It's only these people looking to monetize or "h0ok all teh th7ngs up!!1!eleven!" that are shoveling crap that no one asked for, but everyone is too lazy to object to. I've got a pair of wireless earbuds, completely…

Everything connected to the internet is a potential security and privacy risk. If they had a law requiring warning labels, then all products would just have to have that warning, regardless of whatever good design was applied to it (which is subjective and hard to judge, especially in the legal sense). But ya, take out the internet connection, and no more problems. Take out the battery and the risk of fire/explosion…

> Everything connected to the internet is a potential security and privacy risk.

Yes, that's true. What I'm saying is that not everything needs to be connected to the Internet, and requiring things to be connected to function fully is stupid and anti-consumer. By requiring the label on things that don't essentially need an Internet connection, it would allow those of us discerning consumers to avoid the crappy products.

> But ya, take out the internet connection, and no more problems. Take out the battery and the risk of fire/explosion also goes away.

The fire/explosion risk doesn't go away (power bricks have been known to cause fires). And electricity is essential to electronic devices functioning; Internet connectivity is not.

Re: What If We Put Warnings on IoT Devices?

#53

Post by throw2016 »

oneweekwonder wrote: post #37
npsimons wrote: post #12

Earlier quoted context omitted.

> I'm one of those crazy people who believes in standards-based protocols and commodity hosting service). If that counts as crazy, then lock me up, because I'm crazy too. I'll second everything you said, but I'm not so sure it's entirely ignorance - I believe a large number of people just don't care (which is ignorance of another kind).

> standards-based protocols Ok seeing we talking IoT what standard: of the top of my head mqtt, coap, http/rest, soap? Those are just communication protocols. Now we still need to standardize the application data layer jsonschema, swagger/openapi, wsdl? and most of the time the vendor wants to own the application for their benefit. Also the classic xkcd of standards leading to more standards is so true. As you mentio…

This self serving 'general public don't care' argument by software folks is becoming tired and cliched.

The general public doesn't care about freedom of press. Let's take that away. The general public doesn't care about elections. Let's take that away.

People use these self serving assumptions of ignorance to empower themselves. You have a ton of devices and things you use in your everyday life. Why should a doctor or civil engineer need to understand the details of software and hardware technologies to get value from it? Do all software folks understand the details of medical stuff or their home construction?

That's why you need regulations, so vague terms like the 'general public don't care' are not used to abuse them.

Re: What If We Put Warnings on IoT Devices?

#54

Post by TremendousJudge »

npsimons wrote: post #17
seanmcdirmid wrote: post #13

In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless. This feels kind of like that.

> This feels kind of like that. It might feel like that, but it isn't. Everything[1] causes cancer. Not everything needs to have an Internet connection to a service to function, not essentially at least. It's only these people looking to monetize or "h0ok all teh th7ngs up!!1!eleven!" that are shoveling crap that no one asked for, but everyone is too lazy to object to. I've got a pair of wireless earbuds, completely…

Right now I'm writing my bachelor's thesis on IoT platforms. I think the real problem is that there's no real established pattern for authentication (the way there is for things like signing up for a web app). You ship devices and there isn't a 'one true way' for authenticating them against your platform, authenticating the user, partnering the user with the device, and then encrypting all traffic from the device to the local or public network.

Everybody uses their own homegrown solution, which depends heavily on the hardware they have to work with. This means that some companies get it right and many get it wrong. Yeah, the biggest problem is companies shoehorning connectivity to products, but the second biggest problem is that there really isn't a standard for securing that connectivity.

Re: What If We Put Warnings on IoT Devices?

#55

Post by BeefySwain »

jacquesm wrote: post #10

Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. None of those grafted on services for me, I really have yet to see anything that was so compelling that I would give up and consent to essentially renting a device and having an account with some service to make it useful. That way you also don't need to warn anybody about the lousy security, I'm…

While this is still possible (usually) when buying physical goods, it is getting to be nearly impossible for software. Good luck buying professional grade graphics or video editing software without getting signing away any agency over the software.

In fact, depending on how you view "intellectual property" laws, anything that isn't public domain could be considered a "grafted on service"

Re: What If We Put Warnings on IoT Devices?

#56

Post by [deleted] »

npsimons wrote: post #17
seanmcdirmid wrote: post #13

In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless. This feels kind of like that.

> This feels kind of like that. It might feel like that, but it isn't. Everything[1] causes cancer. Not everything needs to have an Internet connection to a service to function, not essentially at least. It's only these people looking to monetize or "h0ok all teh th7ngs up!!1!eleven!" that are shoveling crap that no one asked for, but everyone is too lazy to object to. I've got a pair of wireless earbuds, completely…

[deleted]

Re: What If We Put Warnings on IoT Devices?

#57

Post by seanmcdirmid »

jstanley wrote: post #46
seanmcdirmid wrote: post #44

Earlier quoted context omitted.

Even if they did, would it matter? It would be some chemical term, like the one you see in an ingedient list, that is meaningless to most people. And these are places, not products...with gardens. Even if they use organic pesticides, they probably still have to put up the warning.

> that is meaningless to most people. Therefore no people should be allowed to know? For what it's worth, I'm not in favour of California's labelling requirements either. But just because something is meaningless to the majority of the population doesn't mean it's meaningless to the entire population. And it is specifically the population that is interested in knowing it that finds it least meaningless!

I didn't say allowed or not. Sure, you should know that there are 15 ug of theomacrotasium among a hundred other things in your environment, but then what? Information overload means our decisions can get worse, not better, when presented with more of it.

What would be more meaningful: certifications that act as abstractions for complex problems. Organic kind of acts like this already, and of course there are multiple federal certs for electronics. Having a functioning regulatory system as well as a working civil law system also help.

Re: What If We Put Warnings on IoT Devices?

#59

Post by detaro »

michaelfeathers wrote: post #15

It would be interesting to have a word for devices that is sort of like 'organic' for food. It would indicate that the device is self-contained and has no connectivity.

"no connectivity" sounds fine to express that. "unconnected" maybe.

But IMHO such devices aren't the problem. I can't think of many (any?) devices where I'd want an unconnected one and can't get it. The problem are connected devices that come with unexpected extra connections (networked camera that wants to talk to cloud service etc). Maybe "service-less" for that?

Post reply on HN