Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#201

Post by MattPalmer1086 »

coldpie wrote: post #19

FWIW, seeing a security compliance label on an IoT product wouldn't mean anything to me as a consumer. There is no such thing as computer security in 2023, and there are no hints that security will exist at any point on the horizon. Even the biggest names in the field cannot put out secure products. Products from well-meaning manufacturers are going to be absolutely riddled with security problems, and putting a stick…

I completely agree that it is meaningless to assert that something is "secure". Even very well secured things have been hacked, and the smallest of mistakes can have huge impact.

What would be meaningful is an assertion that some basic set of secure practices have been or are followed. For example, that there are no default passwords on a device, that security updates will be provided on some defined schedule, that network protocols meet some reasonable standard of security, etc.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#202

Post by justinzollars »

I think our system has become Byzantine. The term comes from the Byzantine Empire, whose code of laws grew with time. Over hundreds of years the society was mired in complexity.

There are too many rules and regulations. The best thing you could do within your role is to advocate for rolling back and eliminating existing regulations to simplify business.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#203

Post by kijin »

SimingtonFCC wrote: post #91
JoshTriplett wrote: post #25

A mechanism requiring disclosure of how long security updates are available seems like a great step. Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable.

Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable. It's not inconceivable that this could be a requirement for getting a label (or some tier of label.) It depends how the advocacy comes out on the record.

The requirement can be easily bypassed by going bankrupt before the required time is up. You will soon hear advice like "if you want to get in to the IoT space, create a new C Corp for each iteration of your product..."

Whatever you require them to disclose after X years, it must be escrowed with a trusted third party in advance.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#204

Post by fnordpiglet »

Hi thanks for the work here. I read through (some) of the linked materials including the statements. The proposal itself is enormous, and all of it is extremely well researched. (Reading the comments here it reads like few folks read your links as most of the comments are addressed in some way).

That that end, and I realize part of these exercises is exhaustiveness, due to the legal and regulatory nature, it would be really useful if there were a TLDR version that included the request for comments boiled down to a sentence and laid out concisely. The document is enormous and unless it were literally my job (aka a paid lawyer or lobbyist) I couldn’t justify going through it all and composing responses point by point.

The points however are great and we should respond - for instance, the question of should the label be at a product level or a device level (I.e., subsystem of a product) is great. IMO it should be at a product level. Currently device level labeling ends up just being a blob of perfunctory tiny text. Products are what we interface with, and if any updates would be applied, they would be applied at a product level anyway.

Further, to the points made on energy star labeling in the statement made by your peer, I think the labeling should be simple - like a small discrete set of classes for compliance that can be extended over time with further rules. So 20 years security updates is “platinum” 10 years is “gold” 5 is “silver” or something. Then the classes of label can accrete meaning over time as you enhance your proposals.

I also wonder if the formal comment system is the right interface for this community… a few might convert all the way to a comment, but it’s not a trivial undertaking to read all the material and provide detailed commentary. I know it’s what you’ve got and what you have to work with, but in some ways a way to work best is right here in the HN comments and then lifting material up into your direct work via the proposal and statement. To that end maybe reaching out earlier in the process to get feedback would work?

Regardless I am glad to see our government proactively reaching out to adhoc communities of experts to solicit our feedback. Thank you, you are obviously one of the good eggs. I’ll bookmark your links and try to spend some time drafting a comment.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#205

Post by Maximus9000 »

coldpie wrote: post #19

FWIW, seeing a security compliance label on an IoT product wouldn't mean anything to me as a consumer. There is no such thing as computer security in 2023, and there are no hints that security will exist at any point on the horizon. Even the biggest names in the field cannot put out secure products. Products from well-meaning manufacturers are going to be absolutely riddled with security problems, and putting a stick…

Does the IoT company called "Eve" give hope to the industry? From what I understand, they take a security first approach to their IoT products. I haven't tried them out yet though.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#206

Post by 2OEH8eoCRo0 »

lacker wrote: post #124

Regulation to require a certain period of security updates doesn't seem useful to me. It's very easy to send out a "security update" that doesn't actually improve security. You can send out an ad to all your users saying "You should upgrade now to our newest product!" and call it a security update. Requiring security updates may end up just requiring companies to spam their users with a certain amount of marketing ma…

Liability. Make the manufacturer liable if a known vulnerability is exploited.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#207

Post by tkfu »

MattPalmer1086 wrote: post #189
tkfu wrote: post #93

One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter. Th…

While I acknowledge that CVE scoring of risk can be inconsistent and sometimes wildly wrong, what would you suggest in its place?

That's the problem, there isn't a good objective measure. Some type of "reasonableness" standard is usually invoked in situations like this, but that kinda just takes us back to square one: what's currently considered reasonable in the industry is pretty terrible.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#208

Post by btown »

tkfu wrote: post #93

One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter. Th…

I'm curious about your thoughts on balancing the damage of another Mirai with the damage of another SolarWinds. A regulation where every IoT device must accept a signed OTA update would make update servers an extremely valuable target for supply chain compromises.

On the one hand, without updates, a world of IoT devices will inevitably get infected slowly and permanently (as long as they're physically active).

But on the other hand, with mandatory updates, a world of IoT devices can get infected all at once (in the case of a supply chain attack) and possibly just as permanently (if the attacker's payload can disable or re-route the update system)?

Do you think that prevailing security standards for IoT manufacturers are good enough that this balance falls in favor of a mandatory-update regulation?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#209

Post by sokoloff »

MarcoPerazaFCC wrote: post #195
sokoloff wrote: post #182

From the speech: > Wi-Fi deauthentication attacks, which can render useless every Wi-Fi network in an area, can be carried out by a single device with a Wi-Fi antenna. Is the prevention of such attacks within the mandate of the FCC (so long as all other relevant RF parameters are adhered to in the device)? I understood that unlicensed ISM users must not cause interference to licensed users, and they must be tolerant…

In the 2010s, the FCC began enforcement proceedings against more than one hotel chain for using Wi-Fi deauthentication attacks against guests using their own Wi-Fi hotspots instead of the official hotel Wi-Fi networks. The claims were settled, so there's no court ruling on the matter, but our office is inclined to believe that the FCC has legal authority over such attacks. But we definitely encourage you to share you…

I'll do that, after taking some time to actually read the relevant CFR Parts to ensure my understanding is as reasonably informed as I can.

Thanks to you and your colleague for making that process well-announced.

For the record here (and I'll add to the comments above): I'm in favor of perfect regulation that would allow the FCC to perform that hotel enforcement action, provided it didn't significantly further impair the ability of hobbyists and entrepreneurs to create prototype products that use RF communications without having to engage with the FCC or third-party certification labs at every turn/step. (I worry that perfect regulation of an unlicensed usage of the spectrum is at least very difficult and may be practically impossible and I'm pretty sure that I don't want to flip all WiFi usage over to FCC-license-required.)

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#210

Post by yjftsjthsd-h »

sroussey wrote: post #174
CameronNemo wrote: post #23

Earlier quoted context omitted.

Why? The person you are replying to outlined one major example where IoT security was improved: wireless routers. Not allowing users to update the software on the hardware they own is just a botnet waiting to happen.

The solution without free firmware (and I don’t like this) is that the device bricks itself at the end of its scheduled lifetime. Which is to say, you are buying a multi-year lease up front. And the manufacturer should send you a recycling return box. This is a more honest way to sell these devices. Consumers that would not care about length of security updates will suddenly very much care how long their “lease” is……

That just forces e-waste. Aftermarket firmware lets a device stay useful indefinitely.
Post reply on HN