Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

361–370 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#361

Post by ryankrage77 »

janalsncm wrote: post #128
hermannj314 wrote: post #72

Earlier quoted context omitted.

This is a great point. What are your thoughts on requiring a switch on all IoT devices so the consumer can flip a switch and their "smart Widget" just becomes a "widget"? This would be a nice for both security perspective and a consumer perspective. An insecure e-stationary bike should just become a stationary bike rather than a 100-pound pile of trash.

My opinion is that a stationary e-bike should be a stationary bike whether or not the wifi is connected, and then I can choose whether I want to connect it online. I don’t think a switch is necessary, just don’t connect the thing.

The Bob dishwasher from DaanTech gets this right, it has Wi-Fi capabilities and a DRM scheme for its propietry dishwasher fluid modules, but those are extra features, and it works fine as a dishwasher without them. If the company drops support or goes out of business, I won't even notice in terms of impact on washing my dishes.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#362

Post by Finnucane »

landemva wrote: post #351
snarf21 wrote: post #288

Earlier quoted context omitted.

The biggest problem isn't even new regulations. The liability for violation always tends to be a rounding error to profits. Then, even if there are teeth, there is no money for enforcement which makes it all pointless. Look at how the FTC and SEC have completely failed us in the 21st century. Better regulations would matter if we ever bothered to enforce the ones we already have.

This sums up the situation that government regulations don't work. These regulations put us on the path of trusting religious-like in government. We could be working toward push-button simple network segmentation with some kind of default filtering for install by the average home user.

Which the manufacturers of IoT devices will give us willingly out of the goodness of their hearts?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#363

Post by phero_cnstrcts »

entropyie wrote: post #67
trelane wrote: post #5

How about requiring devices to accept alternate, Free Software firmware, from the upstream provider? At the very least, it should be possible after some time period of no updates or insecurity, but a blanket requirement is less susceptible to games. Probably the best thing to happen to wireless routers is OpenWRT and the other descendents of the WRT firmware.

This is also a key point to fighting ewaste and making devices last longer. I have appliances from the 70s including a rotary telephone, that I still use regularly. If you combined mandatory OSS support with repair cafes, you would have a model for sustainable reuse and better security. You may even start a commercial aftermarket in reflashing older devices!

At rotary phones still compatible with todays standards? If that’s the case I might get one too.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#364

Post by bick_nyers »

ics wrote: post #319
trelane wrote: post #5

How about requiring devices to accept alternate, Free Software firmware, from the upstream provider? At the very least, it should be possible after some time period of no updates or insecurity, but a blanket requirement is less susceptible to games. Probably the best thing to happen to wireless routers is OpenWRT and the other descendents of the WRT firmware.

Possibly weird idea: federal firmware escrow. The OEM gets to put a stamp on their product after submitting firmware source/keys to the FCC. When the OEM either declares the product not supported or provides no updates for X length of time, the files are automatically published to a public repository. Perhaps there is an appropriate license which says essentially that it is almost public domain, with an exception (or…

This is an amazing idea and I would only buy a product that has this stamp on them. I would put some additional triggers into the publication of source code as well, notably if the company goes out of business. I would also put some kind of timer and renewal process on it, like a company needs to recertify every 1-5 years (pros and cons to different time lengths) and that they have indeed been providing actual updates (and not just fake ones) and actual support.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#365

Post by rfoo »

gsuuon wrote: post #320
distract8901 wrote: post #92

I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks. The core problem is that without control of the firmware, consumers don't really…

This is great for hackers but doesn't it make IoT devices incredibly insecure for normal users who wouldn't even know their device has reached end of support?

> doesn't it make IoT devices incredibly insecure for normal users

How secure or insecure a device is is unrelated to whether its source code is public.

Disclosure: I might be biased on this, as I'm a reverse engineer.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#366

Post by codedokode »

PhilipRoman wrote: post #70
SoftTalker wrote: post #34

Earlier quoted context omitted.

IIRC the main objection was that it could be used to do something with the radio (boost power?) that caused the device to exceed FCC limits for a consumer radio? Something along those lines?

For those out of the loop these documents have a good introduction to how free software interacts with radio regulations https://wireless.wiki.kernel.org/en/developers/regulatory/st... https://wireless.wiki.kernel.org/en/developers/regulatory TLDR manufacturers and "serious" companies won't touch anything that could potentially be configured to emit signals that your local government doesn't like. So Linux has to pre…

So Linux takes government's side, not user's?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#367

Post by rolph »

joezydeco wrote: post #162
wiremine wrote: post #125

Earlier quoted context omitted.

> either they must provide full (FLOSS) source code and documentation I like the spirit of this, but one problem with this is that the software stack is likely not FLOSS, and the manufacturers don't own all the software. A second problem is that lot of the software for production IoT-devices doesn't live in the device. Third, there are safety concerns with a lot of devices that you'd need legal productions for. Final…

I'm working on an IoT device for industrial use, and we're wrestling with this very problem. The answer we're probably going to go with is that the device is 'leased' to the customer. It's part of their subscription. This solves a ton of problems about FLOSS and support of the same. It's now a closed device, and you have no rights to the code inside. If we go out of business, you have a brick that you don't have to p…

>> The answer we're probably going to go with is that the device is 'leased' to the customer. It's part of their subscription. 1000% wrong answer, unless you straight up front sell a service with an installer making a site visit to deploy chattels of service.

such as satellite television, or DSL internet.

when you swap handfulls over the counter before any contractual agreements i.e. clickthrough TOS , you are selling a hardware, that means user ownership.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#368

Post by kxrm »

smif wrote: post #350
kxrm wrote: post #313

Earlier quoted context omitted.

I am not a fan of this idea as it would only contribute to eWaste, but I think one aspect I can get onboard with is a clearly defined expiration for updates. I think we would be getting too far into the weeds to specify what "security updates" means as there will always be ways to work around the language, but the fact that a manufacturer will guarantee a certain expiration of updates would be better than where we ar…

How would opening up the hardware solve the issue for the average consumer? Let's say the official update channel goes dead on your smart fridge, the company has gone out of business. What would happen in that scenario for the average consumer (not someone who posesses the skills or will to tinker around with the firmware and such)?

My comment is more about not incentivizing locking down hardware vs incentivizing opening it up so I can't speak a lot to your questions.

> How would opening up the hardware solve the issue for the average consumer?

At the risk of going off-topic, what I will ask you is, why do you feel that opening hardware requires a consumer have special skills? I'd argue that open hardware wouldn't have to limit adoption to those who possess the skills. I think requiring special skills is a bug because currently manufacturers don't even consider the idea of a second life for products.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#369

Post by dtaht »

SimingtonFCC wrote: post #304
dtaht wrote: post #176

Thank you for engaging with the community in this way. Many years ago, in a fight to preserve individuals ability to flash their own routers, Vint Cerf, and I, and a coalition of many others, filed this report: http://www.taht.net/~d/fcc_saner_software_practices.pdf (retaining the ability to reflash our own routers, allowed my research project to continue, and the resulting algorithm, fq_codel (rfc8290), now runs on…

High-quality comment. Thanks very much! I'll read your filing and think about it. But also, it's a great example of impactful public FCC commentary. I hope your work inspires others to make their mark in the record.

Thank you very much for reading. It was the first, and last time, I ever took place in the public process and political action.

https://www.computerworld.com/article/2993112/vint-cerf-and-...

We were within months of delivering a massive RFC8290-based fix for wifi performance and we´d been bricking routers left and right... and then got in a whole bunch that we could not modify... due to that proposed regulation... I lost my temper, organized 260+ to sign, made that filing, won, and went back to work. I should perhaps have pressed harder, as the binary blob issue has got ever more terrifying, deeply embedded into too many baseband processors.

If I hold your attention a little bit? It would be rather nice if modern fq + aqm algorithms went into the internet nationwide. "Bufferbloat" is at epidemic proportions. Most the fixes arrived for it in Linux in 2012, and are only slowly rolling out 10+ years later, due to the accompanying epidemic of manufacturers´ not tracking new Linux kernels, (with all those accompanying vulnerabilities). I care very much about addressing security issues, but care about internet "latency under load" and better videoconferencing experiences more.

There´s only a billion or so devices left to upgrade.

https://www.usenix.org/system/files/conference/atc17/atc17-h...

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#370

Post by com2kid »

mannyv wrote: post #318
com2kid wrote: post #171

Earlier quoted context omitted.

> I would like to add most of the IoT problem is no patches at all. The firmware they get is usually bog standard with some very minor tweaks out of china somewhere. I was on a team that worked with a firmware vendor, from the US, for a bluetooth chip. We would send in bug reports, they'd send us firmware with fixes. Except it was obvious they did not use source control because they would sometimes base patches off o…

Sounds like broadcom to me.

Hilariously, not that time.

I do understand why you might think that though. :-D

Post reply on HN