Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#91

Post by SimingtonFCC »

JoshTriplett wrote: post #25

A mechanism requiring disclosure of how long security updates are available seems like a great step. Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable.

Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable.

It's not inconceivable that this could be a requirement for getting a label (or some tier of label.) It depends how the advocacy comes out on the record.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#92

Post by distract8901 »

I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks.

The core problem is that without control of the firmware, consumers don't really own these devices. The company can unilaterally decide one day to brick your device and force you to buy a new one. It should be obvious that this behavior is egregiously anti-consumer and anti-competitive.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#93

Post by tkfu »

One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter.

There are also often practical issues related to security patching embedded devices: for example, a downstream supplier's driver can make it impossible to upgrade a kernel unless/until the supplier provides a fix. Of course, strong regulation here could help to drive bad practices like that out of the industry, but I'm not going to hold my breath on that one. The effect of regulation like this would make it harder for manufacturers who don't have the market power to lean on their suppliers to provide security patches.

Finally, it's important that any regulation that mandates or strongly encourages software updates also mandates that the update system itself be implemented in a secure way. This is my specific area of expertise, and I can tell you that it's very often done very badly. A bad update system is a gigantic, flashing red target for attack. So something like mandating signatures (and sig validation) on software update images would be a good start. Mandating the use of TUF-compliant repositories would be even better.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#94

Post by marcosdumay »

cosmojg wrote: post #40
hannob wrote: post #10

> The FCC recently issued a Notice of Proposed Rulemaking [2] for a cybersecurity labeling program for connected devices. That appears to me to be the wrong way to go about this, and it has specifically to do with how IoT security is a problem. The most severe case of IoT security problems we have seen were things like mass botnets, where plenty of devices of the same type were hacked and then used for things like Do…

Exactly. I don't see the situation improving until either the owner or, preferably, the manufacturer of a device that participates in a DoS attack is held partially accountable for said attack.

Well, you can't hold somebody accountable if there isn't even a label or information somewhere saying that what they are doing is dangerous.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#95

Post by sanderjd »

eru wrote: post #80
hannob wrote: post #10

> The FCC recently issued a Notice of Proposed Rulemaking [2] for a cybersecurity labeling program for connected devices. That appears to me to be the wrong way to go about this, and it has specifically to do with how IoT security is a problem. The most severe case of IoT security problems we have seen were things like mass botnets, where plenty of devices of the same type were hacked and then used for things like Do…

Sounds like you are making an argument based on externalities. That's fine. But economic theory also gives you standard answers for externalities: Don't ban the behaviour you dislike. Either let people sort it out themselves (like the Coase Theorem https://en.wikipedia.org/wiki/Coase_theorem describes), or at most tax the offending behaviour.

I don't get what you're saying here. What "offending behavior" are you referring to in this case that might be taxed to disincentivize it?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#96

Post by eru »

coldpie wrote: post #19

FWIW, seeing a security compliance label on an IoT product wouldn't mean anything to me as a consumer. There is no such thing as computer security in 2023, and there are no hints that security will exist at any point on the horizon. Even the biggest names in the field cannot put out secure products. Products from well-meaning manufacturers are going to be absolutely riddled with security problems, and putting a stick…

> It'd be like putting a "secure against bricks" sticker on a window.

I lived in a house that had such secure windows. I even witnessed someone trying and failing to smash a window with a brick.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#97

Post by sanderjd »

jtbayly wrote: post #38
hannob wrote: post #10

> The FCC recently issued a Notice of Proposed Rulemaking [2] for a cybersecurity labeling program for connected devices. That appears to me to be the wrong way to go about this, and it has specifically to do with how IoT security is a problem. The most severe case of IoT security problems we have seen were things like mass botnets, where plenty of devices of the same type were hacked and then used for things like Do…

That’s only one aspect of the problem. Lots of people have been bitten by suddenly unsupported devices. I think it could do some good.

Sure, but the question here seemed to be about security, specifically. What you're talking about is definitely a problem, but it seems like a different one.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#98

Post by hannob »

weberer wrote: post #63
hannob wrote: post #17

Earlier quoted context omitted.

I am all for alternative free software firmware. But I don't think it adresses IoT security in any meaningful way.

It allows users to replace insecure software with secure software. And it allows updates long after the company drops official support of the device.

That's great for the 0,1% of users who will do that. As said: I'm all for it. But the problem is the other 99,9%.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#99

Post by SimingtonFCC »

ptero wrote: post #29

> I’ve advocated for the FCC to require device manufacturers to support their devices with security updates for a reasonable amount of time [1]. No offense intended, but I would be worried about this more than I would be worried about the current state of the IoT world. A blanket requirement would punish hobbyists and small companies prototyping new technologies. But big players could spend relatively minor technical…

None taken, of course. Several people in this thread have made this point, and it's a very reasonable one.

The current framework is 100% voluntary for what amounts to a marketing label. There are non-FCC government databases for issue reporting, and a commitment to reporting to such DBs could be part of what earns you a higher label. Would be great to see commentary on this point from the tech public.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#100

Post by tzs »

the4anoni wrote: post #14
trelane wrote: post #5

How about requiring devices to accept alternate, Free Software firmware, from the upstream provider? At the very least, it should be possible after some time period of no updates or insecurity, but a blanket requirement is less susceptible to games. Probably the best thing to happen to wireless routers is OpenWRT and the other descendents of the WRT firmware.

As far as I remember FCC about 8 years ago didn't liked OpenWRT, and even enforced on TP Link to lock it.

There was no requirement that firmware be locked down.

The requirement was that consumer radio transmitters could be too easily made to use frequencies and power levels that violate FCC regulations.

If a device had a transmitter where firmware could control those things, and the firmware for the device was one blob that contained everything so letting the user replace firmware meant letting the user control those restricted parameters, then the manufacturer might have to lock the firmware.

There were other possible approaches. One would be to split the firmware into two parts. One part for the radio hardware and the other for everything else. Make it so the firmware update process only allows the manufacturer to supply the first part.

Post reply on HN