231–240 of 299 posts
Earlier quoted context omitted.
On the other hand, remote upgradability is how malware gets itself installed in the first place.
Most HTTP libraries verify certificates by default. That's all you really need to do...
Earlier quoted context omitted.
If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…
Earlier quoted context omitted.
> Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.
> Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
But Cisco (i.e. Talos) are the ones finding the vulnerabilities in routers made by other companies in this case.
> Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
They still would be companies though. That's the point. If they expect to be out of business by then regardless, or they're outside of your jurisdiction, or they know they're judgment proof, it doesn't change their behavior.
It's like trying to address homelessness by allowing the victims of panhandling to sue the perpetrators. There is no blood to be had from that stone.
All you do is make the problem worse, because every company you destroy is a company which is no longer around to patch their installed base of devices. Meanwhile they're immediately replaced in the market by another company which is no better.
Regulation and liability only works against monopolies and other huge companies. When you actually have a competitive market like this, you need to use the carrot rather than the stick.
Earlier quoted context omitted.
Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?
wat you mean like, say, routing all of the traffic from my system to the internet?
Earlier quoted context omitted.
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…
This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…
Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.
Earlier quoted context omitted.
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…
I'm not sure what sort of liability you're wanting here. Criminal culpability for this sort of thing is simply against the American social contract. You go to jail for specific things that have been previously made illegal, not just for causing public ills. And you can already sue companies if you want civil liability.
That said in extreme cases like e.g. airplanes I think it would be fair to consider it negligent when code is just brought into production without any kind of debugging or testing.
I guess the stakes decide when something is or isn't negligent.
Earlier quoted context omitted.
At least get a WRT841N, they are like 15$+sales tax, unless you get the wrong vendor. Less if you find refurb's or buy bulk. They are the main workhorse for our local mesh network, with WRT1043 devices handling encrypted uplinks due to the lack of speed with chacha/poly running on the former (think under 10Mbit/s). Don't worry, they do handle advanced mesh routing algorithms at line rate, e.g. 2x2 mimo 802.11n and 10…
Thanks, I've only got 1.5Mb DSL, but that's a better price point and I appreciate your useful comments on mesh.
Earlier quoted context omitted.
You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad.…
At the end of the day, the end consumer will pay.
Earlier quoted context omitted.
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…
This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…
Nobody has half a fucking clue where the libraries they're slapping together come from, nor how they're maintained, nor how they're vulnerable. It gets worse every day with trash like DockerHub, and has no relief in sight.
So yeah -- let the folks who won't adhere to proper engineering burn.
Earlier quoted context omitted.
>Why should I trust the FBI? Because this is their job. And you'll probably need to reboot your router anyway in the near future so why now do it now just in case? >Could the FBI put their own malicious code on the router, via this supposed exploit? Sure. So could space aliens.
I don't think the FBI Special Agent job description is one line of "make humans trust you" - I believe it's closer to "protect the country from foreign and domestic threats," and I think just because the FBI tells me to jump doesn't mean I should jump... Your second point is not clear to me. Space aliens aren't an extant authority on our planet (afaik)
You can find independent corroboration of this this malware with little effort. And if your gear is compromised, it's most likely doing something you don't want. So "jumping" is the smart move here unless you just want to be contrary.
The second point is: if you're assuming a conspiracy based on zero evidence, why not go big?