A regulation that would force companies to release source code in case they go out of business. A form of escrow maybe?
I have several paperweights that used to be "smart". And several others that still work but will never get another update.
Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
311–320 of 944 posts
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#312One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter. Th…
> There are also often practical issues related to security patching embedded devices: for example, a downstream supplier's driver can make it impossible to upgrade a kernel unless/until the supplier provides a fix. Of course, strong regulation here could help to drive bad practices like that out of the industry, but I'm not going to hold my breath on that one. The effect of regulation like this would make it harder…
> I would love it if the lawmakers considered this scenario.
You're building on quicksand, and you're asking for us to give you leeway when the building collapses.
Either do the work of making all of those security fixes yourself, or pick a better platform to build on top of.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#313Maybe we need to approach it differently? There will always be an "End of Life" date. And there will always be a user using the product beyond it. So my question is: How do we make it safe? My first thought is a "deadman's switch". If a device doesn't get or see some form of a signal, it just stops updating and disables IOT features. If the user wishes it to come alive again, there's a button they can press to have i…
I am not a fan of this idea as it would only contribute to eWaste, but I think one aspect I can get onboard with is a clearly defined expiration for updates.
I think we would be getting too far into the weeds to specify what "security updates" means as there will always be ways to work around the language, but the fact that a manufacturer will guarantee a certain expiration of updates would be better than where we are now. If a vulnerability is discovered before expiration, presumably it would give the market and consumers leverage to hold the manufacturer's feet to the fire.
I think no nonsense update expiration dates is a very easy win.
Bricking the device after expiration or if it can't communicate is just a non-starter for me. Many devices can find a second life if manufactures were incentivized to open their hardware vs close it. Under a brick after expiration scenario I worry manufactures will be incentivized to lock down or prevent tampering to avoid exposure to torts that this rule might open up.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#314Earlier quoted context omitted.
Thank you for these thoughtful points. Some relevant responses from other threads: From https://news.ycombinator.com/item?id=37394188 : I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe here, a vulnerability needs to be patched if it mi…
You're the lawyer guy? What statutory authority are you drawing on that you believe allows you, the FCC, to regulate this stuff? Thanks!
Good question. The Notice of Proposed Rulemaking has a Legal Authority section that discusses this issue https://www.fcc.gov/document/fcc-proposes-cybersecurity-labe.... I also touch on it here https://news.ycombinator.com/item?id=37393316
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#315With all due respect, I think the market should address this. Like UL Approval from Underwriters Laboratories, players in the market can submit their products to an organization that vets their security and sets standards about updates, product lifetimes, security incident response time commitments etc to obtain their seal of approval. Perhaps the seal has grade levels to indicate the vendor's commitment to security.…
I can see it being useful for audiences who know what they're looking for. As an average retail consumer, if I saw such a label I would either have no idea what it means or have to do my own research about what UL is - not to mention the impossibility of them enforcing anything. I guess they could remove the label but how would I know a product I'm using has violated their commitment - routinely check a UL website?
If Amazon etc. was partially responsible for checking the database for you and ensuring listings are properly updated in a reasonable timeframe then it would be more accessible for the average consumer. Even if a consumer doesn't know what UL certification means, if product A has it and product B doesn't and they are similar enough in price, the consumer may opt for product A.
Edit: Reasonable timeframe should probably be dependent on the size/scale/competency of the marketplace platform. In other words, Amazon should be held to a higher standard than a low traffic web store.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#316Earlier quoted context omitted.
As far as I remember FCC about 8 years ago didn't liked OpenWRT, and even enforced on TP Link to lock it.
IIRC the main objection was that it could be used to do something with the radio (boost power?) that caused the device to exceed FCC limits for a consumer radio? Something along those lines?
The main issue these days is the 5GHz band that might interfere with radar. That's mostly an issue outside near an airport, that is, it affects practically nobody, so the solution is to snoop the problematic bands and disable them when detecting radar signals, and use them otherwise for a bandwidth boost.
These days this seems to be mostly done in wifi chip firmware (that is then signed and under lock and wrap to make it tamper proof), but back in the day it was too easy to circumvent the mechanism.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#317Earlier quoted context omitted.
Thanks for participating! After this thread winds down, I and my team are going to comb through it for suggestions and take as many as we can. We're also looking into other venues to engage directly with cybersecurity professionals. But please feel free to comment on the record as well -- a robust and detailed record is worth a lot more than whatever I can do individually.
I think that you'll get a lot of feedback. I would suggest to my peers, that the links you gave are "official channels," and are probably what you really want, as opposed to a rather rambling thread of comments. But for me, you just get a rambling comment. I made my career on devices. In particular digital scanners and cameras. I worked for a company that was about as tinfoil as you could get, and they supported devi…
I would suggest to my peers, that the links you gave are "official channels," and are probably what you really want, as opposed to a rather rambling thread of comments.
I sort of want both. Official commentary moves the needle, but selfishly, I love the thread comments. People tell you what they really think, and sometimes go into a lot of detail as to why. It's an education for me.
I think IoT security is a huge issue, and I think that the solution could be that there are standard, open-source, open-license, free-to-use packages; maybe written in languages like C, that could be offered to the industry. These could enforce low-level compliance with security standards.
"Universal basic security" would probably be a major field of policy approach if we found ourselves with some huge disaster requiring a regulatory response. It's at least worth thinking about now, even if it goes beyond the scope of what the immediate regs can do.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#318Earlier quoted context omitted.
I would like to add most of the IoT problem is no patches at all. The firmware they get is usually bog standard with some very minor tweaks out of china somewhere. It is a problem of vendor locked in products where you have to buy a hub to do an update. If there even is an update. If you want to get a good picture of how sideways updating can even be watch the linus tech tips on where he wanted (and has the tech abil…
> I would like to add most of the IoT problem is no patches at all. The firmware they get is usually bog standard with some very minor tweaks out of china somewhere. I was on a team that worked with a firmware vendor, from the US, for a bluetooth chip. We would send in bug reports, they'd send us firmware with fixes. Except it was obvious they did not use source control because they would sometimes base patches off o…
Sounds like broadcom to me.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#319How about requiring devices to accept alternate, Free Software firmware, from the upstream provider? At the very least, it should be possible after some time period of no updates or insecurity, but a blanket requirement is less susceptible to games. Probably the best thing to happen to wireless routers is OpenWRT and the other descendents of the WRT firmware.
Possibly weird idea: federal firmware escrow. The OEM gets to put a stamp on their product after submitting firmware source/keys to the FCC. When the OEM either declares the product not supported or provides no updates for X length of time, the files are automatically published to a public repository. Perhaps there is an appropriate license which says essentially that it is almost public domain, with an exception (or fee?) to use it for any purpose other than supporting the lifetime of an existing product.
As others have stated, free software is one way of giving the public ability to keep things up to date but that's almost like the government saying people are allowed to clean up pollution. It doesn't put any pressure on companies to behave better.
Another issue is build-ability of open source code. If an OEM submits firmware source and keys to a third party, even regularly, who really knows whether it is actually functional and complete. Automated tests or sample hardware are possible ideas but have their own failure modes and could be difficult for to implement solely for this purpose.
Another weird idea for the above. If one requirement was deterministic builds, then in addition to source/keys, a suitable toolchain to build could also be required such that the repository stewards would only need to run exactly what the OEM provides, and if the checksums don't match then it means they are not in compliance.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#320I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks. The core problem is that without control of the firmware, consumers don't really…
This is great for hackers but doesn't it make IoT devices incredibly insecure for normal users who wouldn't even know their device has reached end of support?