Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

For a good summary of the history of food safety I'd recommend: https://www.ncbi.nlm.nih.gov/books/NBK221553/

Often the regulation _drives_ the technology. There is no inherent business need to create new technologies that improve the food safety, outside of demand from consumers or regulators.

> In 1909 the American Public Health Association appointed a committee to develop a “standard” bacteriological technique for screening oysters and other shellfish, which recommended use of a tube dilution method for the presence of Escherichia coli. In an effort to gain data on levels of contamination, USDA's Bureau of Chemistry conducted an extensive bacteriological study along the Atlantic and Gulf coasts between 1908 and 1910.

Again, though, consumers can only register there preferences with the existing market. So if they want _safer_ foods than are available on the market, there is no real way for them to register that desire.

> In the absence of government standards, companies willing to spend funds to assure protection of the public health are disadvantaged by the need to compete with companies unwilling to do so, because the latter could sell their products at a lower price. Some consumers might be willing to spend more on a “better” or “safer” product; poorer consumers, of course, would be unable to do so and would bear greater food safety risks than more affluent consumers. Price differentials for safer products would not be possible in many parts of the food marketplace, however, as most foodstuffs are sold as unbranded commodities at the beginning of the food chain, and often (as with most meat, poultry, and produce) at the retail level. Thus, even if society were willing to rely upon the market to encourage food safety, it is unlikely to be an effective producer of safety because of the commodity nature of most food transactions, as well as the difficulty of connecting foodborne illness with particular eating occasions or individual foods. For the same reasons, personal injury litigation provides only a weak incentive for food companies to improve their food safety efforts, because there is a low probability that they will be sued for foodborne illness, the damages they would pay are likely to be small, and there is a low probability that such litigation would have negative public relations consequences (Buzby and Frenzen, 1999).

> Imo existing laws regarding misleading marketing and accuracy are probably all that we need

Many of the food safety laws that exist are exactly to prevent this exact kind of misleading marketing and accuracy. Or, in other cases, to force them to make specific claims that can be later enforced rather than generic claims that can never be enforced.

In my mind, an analog to "put on the box how long security updates will be provided" are "nutrition facts", in that these don't just say: "everything on the box must be true", but also: "you must disclose some specific things about the product".

The introduction of nutrition labeling changed both consumer behavior, and the products being offered to consumers: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6340779/

> In pooled analyses (Table 2), food labeling reduced intakes of energy by 6.6% (95% CI= −8.8%, −4.4%. n=31 estimates; Appendix Figures 1 and 2), total fat by 10.6% (95% CI= −17.7%, −3.5%, n=13; Appendix Figures 3 and 4), and other unhealthy options by 13.0% (95% CI= −25.7%, −0.2%, n=16). Food labeling increased vegetable consumption by 13.5% (95% CI=2.4%, 24.6%, n=5; Appendix Figures 13 and 14).

> ...

> Reformulation outcomes were evaluated by six studies (Appendix Table 13, Appendix Figures 20–24). Food labeling significantly reduced the contents of trans fat (−64.3%, 95% CI= −91.1%, −37.5%, n=3) and sodium (−8.9%, 95% CI= −17.3%, −0.6%, n=4). Significant effects were not identified on product contents of total energy, saturated fat, dietary fiber, or other healthy (protein and unsaturated fat) or unhealthy (total fat, sugar, and dietary cholesterol) dietary components.

Bringing it back to this topic that would mean forcing them to make a statement like: "we will provide security updates for 3 months" in small print somewhere on the packaging, rather than _only_ having the phrase "WORLD-BEATING SECURITY" in 45pt font on the front. And, again, all of this is voluntary, and only required if they want to display a specific logo.

I honestly can't see _any_ argument for how this would be objectionable. I don't think existing laws are sufficient, because they don't require a company to make any specific claims. As such, no companies make any specific claims about security, which means as a consumer I have *no* ability to express a preference in the market for products that make stronger claims about security.

I just have to point out that these are all extraordinarily short numbers. There are industrial control systems that are still in operation despite being made out of mechanical relays from before the advent of microprocessors.

We got used to electronics getting replaced every 3-5 years because if it's a laptop by then it will be considered slow and have a questionable battery. But these devices are now being permanently affixed to real estate.

We need a way to update these devices that will outlive the manufacturers. Because many of the devices will.

I'm the CTO of a small software studio who has worked almost exclusively in the IoT space for the last 8 years. We've worked on large, Fortune 500 companies, all the way down to startups. Half our projects have been for consumer IoT, the other half for B2B projects.

There are two core financial realities that regulators need to understand:

1. From a purely financial perspective, most manufacturers do not have financial models that make perpetual, ongoing updates possible. Without a recurring revenue stream tied directly to a device, any software update reduces the return on investment for a product. For example, say you make a consumer IoT device and sell it without a subscription. The BOM might be $50 and the NRE is $50. You might sell it for $200, and make $100 profit. However, without a revenue stream of some sort, that profit needs to somehow support all the software updates those devices will receive in the future. Say each update costs $5 to build and deploy, and you release once a year. After 4 years you've spent $20 in updates, likely more due to inflation. At some point this becomes a losing proposition. The fact that GAAP says non-recurring engineering can be capitalized, but the maintenance cannot, creates even more issues. And due to the maturity of security, it's difficult, if not possible, to guess upfront how many updates a device might require.

This problem is compounded by the poor software practices at most manufacturers. It is non trivial to set up a software practice that keeps the cost of ongoing development in check. More model numbers and large fleets increase the development and QA costs. The per unit costs go down, but the absolute dollars go up.

2. The second issue is that IoT devices have a symbiotic relationship with other systems, and the financials for the overall product are tightly coupled. For example, consider cold chain monitoring systems. These devices are simple: measure the temperature, and send the data to a cloud-based pipeline. Alerts are forwarded to another. The value is in the outcome: alerting users to problems. However, to be competitive, the manufacturer might sell the hardware at a loss. If the _system_ is unprofitable, the vendor might turn off the system. In this case, it's hard to demand that the vendor provide updates for a defunct system. In the worst case, companies will go out of business and all the regulation in the world won't really help the consumer. Or the large companies will simply set up shell corporations to shield themselves.

Some in this thread suggested that all the software be open sourced. This is a fool's errand, IMHO. Forcing manufacturers to do this isn't viable because they often don't own the entire software stack: they have suppliers who own the IP, who in turn have their own suppliers. And it's really hard to draw the line in embedded systems. The BSP, RTOS/kernel and applications are all tightly coupled.

"But I bought the software!" you say. Yes, you did. You bought a binary snapshot in time of a software system. Unless you're paying for perpetual updates, you didn't buy unlimited free updates into perpetuity. And you definitely didn't buy source code.

So, what's the solution? I don't have any silver bullets, but here are some thoughts:

1. For many devices, allowing the user to replace the microcontroller outright is the ultimate consumer safeguard, while protecting IP. If the vendor doesn't provide updates, or goes out of business, the owner can replace the MCU or SOC. And it protects the IP of the manufacturer's supply chain. This requires a clean separation of concerns, and it also would allow competitors into the market. But this is the best actual safeguard to consumer protections and respecting IP. There are a lot of ramifications to this. The user instantly voids the warranty, and would need to take responsibility for the security and safety of the system. But for a lot of use cases, this is fine.

2. Incentivizing a secondary market to encourage third-parties to take over failed systems. For example, if a vendor winds down a failed IoT project, give them a tax break to sell the system to a third-party, or open source it. This would give vendors a lot more reasons to try and own/license all the IP to make it open source-able. There _are_ knock on effects: the third-party might charge for updates, or raise prices.

3. Incentivizing common hardware/software platforms. Here's the reality: most manufacturers don't really want to write their own software. They want to sell hardware: it's what they're good at. Encourage more generalized software architectures for IoT devices. This will reduce the costs and enable parts of the system to be updated, without requiring access to the entire system.

The bigger issue is that simplistic takes expressed strongly with no room for disagreement tend to get the most upvotes from other people. The people who agree will upvote, the people who disagree will just move on, and the people who don't have an opinion will think the person sounds like they know what they're talking about and will upvote anyway. That's how you end up with back to back threads where completely opposite takes are highly upvoted, and both of them happen to be awful takes.

It's "online marketplaces" like Amazon (or AliExpress) where you're actually purchasing from a random third party seller, and the marketplaces attempts to disclaim as much liability as possible that I'm more wary.

I actually don't know the specific laws or regulations on this. It's very possible that it's illegal for Home Depot to sell a non-UL or other nationally recognized laboratory mark. It's probably that it's illegal for third-party sellers on other sites to do it as well, but my faith in Amazon and other "online marketplaces" for policing their third party sellers on this kind of stuff is...not high.

I'm just trying to be a lot more careful about the stuff that goes into real circuitry, because I'm more used to playing with low-voltage DC stuff where I'm just not too fussed about it, so I feel OK ordering anything cheap that probably works.

---

Finally, I think it's actually a regulatory and consumer information _success_ that you feel safe buying something from Home Depot and wiring/plugging it into your house without thinking about the product safety risks. The reason for that is _those risks have largely been eliminated_. There was a time when you _did_ have to be super careful as a consumer of electrical products. Over the years, we've drastically improved the safety of these kinds of products to the point where we for the most part don't have to think about it anymore, because it's not a problem anymore. That's effective government regulation at work.