Is there a definition of a "security update"? Software has an infinite number of bugs and it is cost infeasible to fix them all. If it's years down the road, the engineers that wrote the code may be long gone.
Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
501–510 of 944 posts
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#502Earlier quoted context omitted.
The issue is that it's currently not a regulatory requirement. So when you go to the chip maker and demand that their chip have drivers in the Linux kernel tree so it will continue to support newer kernel versions, they turn you down. Most of their customers don't care about this and they would have to pay a developer to produce drivers of the quality that would be accepted by the Linux kernel maintainers. Then you'r…
I don't understand your argument, are you agreeing with me that regulation will cause this to happen? So why is that an argument against regulation?
It's an argument for getting the regulation right.
For example, one of the obvious ways around these requirements is you set up Sell To Retailers, LLC which nominally does the final assembly, is responsible for the update requirement and then files for bankruptcy whenever anyone tries to enforce it against them.
The bad way to get around that is to try to hang the requirement on some kind of larger entity, like the retailer. Then every retailer bans every kind of smaller device maker who might not be around to make updates in ten years and you have a rule that unintentionally causes catastrophic market concentration.
The good way is to require that the customer can flash custom firmware to the device and the hardware has sufficient published documentation for a third party to make drivers for it (the easiest way to satisfy which would be to publish open source drivers and firmware).
That way if the manufacturer goes bust, as some of them will even independent of trying to get out of the requirement, someone else can still patch the device. And that someone will be more likely to exist, because communities like DD-WRT will have already produced custom firmware for the device and be there to patch serious vulnerabilities even if the manufacturer is gone.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#503A required support period of some number of years is problematic for products developed by startups, because startups cannot guarantee that they will still exist to provide support in several years. They can have the best of intentions and excellent engineering, but still fail in the market and be unable to keep maintaining a device. So requiring security support for several years wouldn't have any effect on these de…
Any guarantees and warranties have the same caveat: if the company goes under, you got nobody left to sue. And there’s no squeezing water from a rock anyway, a defunct company can’t pay for the updates nor the damages
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#504This is likely outside of the scope of this proposal, but my red team brain sees IoT devices from China as a distributed Trojan Horse. In a time of conflict with China, firmware updates will be sent which will create the largest DDOS botnet in history. Our cheap IoT lightbulbs will take down major internet infrastructure. I don’t know the solution to that problem, but it’s a problem. Isn’t it?
This is something that has us worried too. The FCC took some action on this issue last year by outright banning equipment from certain companies (e.g. Huawei), but we haven't even scratched the surface of this pervasive problem. I really encourage you to share your concerns through an official comment. Maybe the label can include commitments about the provenance (and, e.g., control of signing keys) of the on-device software and associated cloud services?
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#505There’s some great recommendations in this thread but I just want to thank you for engaging with this community to solicit opinions from the trenches. This is really meaningful to most of us who see the regulations in our lives as something far away that we can’t influence. Another reminder for everyone that while you likely can’t influence something like a presidential election on your own, you can influence many ot…
Thanks! I am thrilled that so many people are participating. The FCC is going to need a lot of this community's input over the next few years as more and more devices go online.
Thank you so much for asking HN! I can't think of a more informed, higher signal community to interface with and get open and honest feedback from. Really brilliant idea.
I don't have much input on this issue, but I wanted to ask that if you know folks in the US Copyright Office, that you recommend the same approach to them with regards to their upcoming regulatory stance on AI.
The copyright office is going to hear one-sided input from artists and the largest tech companies (seeking to build moats), but they need to broaden their inquiry to include technologists, researchers, and startups. HN is an excellent place to increase their understanding.
If you can, I would greatly appreciate it if you tip the copyright office off about HN!
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#506Earlier quoted context omitted.
Sorry for any confusion. The relevant language: If they meet certain criteria for the security of their product, manufacturers can put an FCC cybersecurity label on it. So if they don't, they can't put the label. That's all.
Well, making a voluntary sticker to opt-in to certain legal obligations is fine. But you are saying already that manufacturers don't really want to commit to anything? What makes you think the sticker would change that? (In principle, I'm all for manufacturers offering more warranties. But when it comes to spending money, privately I almost never opt for the enterprise grad hardware that does come with warranties lik…
The labeling program provides a signal to consumers that the device meets a certain standard. The incentive to the manufacturer is that it allows them to borrow the FCC's reputation and advertise a security that is well defined. The consumer can see that the device has that certification, and know that product has legal obligations, and
It's a pretty reasonable first step. No manufacturer is being punished, there's no warranty requirement, and the gov isn't taking away choice. Instead the FCC gives manufacturers a way to reliably signal to consumers that their product meets a security standard. Google can do that because they're Google and have a reputation - this approach would let joe-schmo IOT device manufacturer do the same.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#507Earlier quoted context omitted.
I like this approach, it doesn't necessarily need to be just the "market" performing the audits however. The FDA handles audits of medical software companies just fine. Focusing on the Quality Management System and their Risk Assessment/Security practices seems like a solid approach, and of course centralize this data and make it easily searchable as much as possible, and provide API access to it in case vendors like…
FDA: $450K per product. And they aren't doing very much more than asking the vendor to describe their protocols, then ensure the vendor complies with their protocols and any agency guidance. Source: I work at an FDA-regulated company.
It depends... I just worked my part of certifying a product(security) and it was only ~$40k.
Agreed on the current state of the FDA filings - there's a lot of paperwork and process auditing - but guidance is lacking and I'd like to have more clarity rather than just "industry best-practices." That said - things are much better and it seems like the trajectory is improving.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#508What does this mean for DIY hardware?
For one I like my ESP32 and Arduino hardware because I can do whatever the heck I want with it. Will I be limited in choices if a bill/regulation is passed so as to make it restrictive on buying IoT hardware that’s not compliant with “security features “?
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#509Earlier quoted context omitted.
It allows users to replace insecure software with secure software. And it allows updates long after the company drops official support of the device.
That's great for the 0,1% of users who will do that. As said: I'm all for it. But the problem is the other 99,9%.
Seriously. I'm a SWE and I would throw out a TV and get a new one before spending hours minimum figuring out how to switch the firmware to a open source version.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#510For visibility into Linux IoT firmware contents, you can upload the public firmware binary for any IoT device to the Microsoft binary analysis service. This free service is based on their acquisition of ReFirm Labs Binwalk Enterprise.
https://techcommunity.microsoft.com/t5/microsoft-defender-fo...
> Firmware analysis takes a binary firmware image that runs on an IoT device and conducts an automated analysis to identify potential security vulnerabilities and weaknesses. This analysis provides insights into the software inventory, weaknesses, and certificates of IoT devices without requiring an endpoint agent to be deployed.