Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

601–610 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#601

Post by Etheryte »

vkaku wrote: post #473

I've dealt with this multiple times, so let me give my perspective. - It is hard for manufacturers to do this with small teams. Mostly because they do not always have good CI/CD or platforms available to keep being on top of vulnerabilities and so on and so forth. - Not all manufacturers write their own software and often contract it out to other experts in the field. This includes firmware and app developers. - If a…

If your team is not large enough to meet the required standards then you need to get a bigger team, not ask everyone else to forget the standards. You could make the same point about taxes, radio frequency use, etc. This is a non-argument.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#602

Post by elicash »

heroprotagonist wrote: post #597

Can we actually trust the FCC comment process now? It's been astroturfed by interest groups for well over a decade now and that's only getting worse with AI generated content.

Unilaterally disarming seems bad. But yes, I’d agree a rethink of the process could take into consideration it doesn’t represent public sentiment, though I have no alternative solution in mind.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#604

Post by hot_gril »

dylan604 wrote: post #143
f33d5173 wrote: post #106

Earlier quoted context omitted.

Even if consumers don't necessarily care about security, required labelling gives brands an opportunity to stand out from one another. If I'm looking at two products on the shelf, where one claims to have greater security, and the other makes no such claim, I'm likely to buy the more secure one, even if I don't necessarily care much about security. If getting the secure label is relatively cheap (which it should be,…

oh man, you sound like the type of person that would fall for the intentionally misleading labels that makes it sound like one thing but is in fact absolutely not that thing. just yesterday, there was a link to an article about the lies on food packaging. so, labeling requirements are one thing, but requiring that the information is straight forward and leaves no options for misleading would be great. I just don't th…

"This milk contains no !"

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#605

Post by rolph »

joezydeco wrote: post #565
rolph wrote: post #367

Earlier quoted context omitted.

>> The answer we're probably going to go with is that the device is 'leased' to the customer. It's part of their subscription. 1000% wrong answer, unless you straight up front sell a service with an installer making a site visit to deploy chattels of service. such as satellite television, or DSL internet. when you swap handfulls over the counter before any contractual agreements i.e. clickthrough TOS , you are sellin…

No, we're straight up selling with a dealer/installer in the pipeline. We're not that stupid to try and sell direct to the customer these days.

i find that revealing, it seems direct enduser engagement has really stung you, is there something other than people being people, or are there onerous requirements that are not worth it?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#606

Post by MetaWhirledPeas »

vkaku wrote: post #473

I've dealt with this multiple times, so let me give my perspective. - It is hard for manufacturers to do this with small teams. Mostly because they do not always have good CI/CD or platforms available to keep being on top of vulnerabilities and so on and so forth. - Not all manufacturers write their own software and often contract it out to other experts in the field. This includes firmware and app developers. - If a…

> - A lot of blast damage can be contained if home devices use local / MDNS based service discovery as opposed to Internet based services. Many services could then either choose to reply locally or sometimes relay to the Internet if users policies allow. Unless people want other people unlocking their doors through the Internet, and they explicitly say it, Internet connection can not be mandated.

Networking ignoramus here. Are you suggesting the device could be prohibited from accessing the internet directly, and would be required to relay through a separate device (presumably with better security assurances)? Because that sounds like a good idea.

Are there off-the-shelf firewall (or whatever) products that do this already? Quarantine the IoT devices and limit them to whitelisted, curated endpoints?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#607

Post by gsuuon »

rfoo wrote: post #365
gsuuon wrote: post #320

Earlier quoted context omitted.

This is great for hackers but doesn't it make IoT devices incredibly insecure for normal users who wouldn't even know their device has reached end of support?

> doesn't it make IoT devices incredibly insecure for normal users How secure or insecure a device is is unrelated to whether its source code is public. Disclosure: I might be biased on this, as I'm a reverse engineer.

Releasing source code could lower the barrier a bit but the main thing I was calling out is releasing the keys - maybe they could be transferred to a trusted custodian instead.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#608

Post by EricMausler »

AnthonyMouse wrote: post #546
EricMausler wrote: post #514

Earlier quoted context omitted.

This might be an unpopular opinion but I respectfully do not see it that way. I agree with promoting security for IoT devices, but there needs to be consent from the company being probed for vulnerabilities or else I find it hard to consider it legitimate research, regardless of intent. I dont think anyone would like it very much if someone came to their house and documented all the ways to rob it they could find, ev…

> There is an inherent risk of your vulnerabilities being broadcasted somewhere either on purpose or accidentally once that information is collected and organized by the researcher. A legitimate researcher is going to promptly notify you of any vulnerabilities they discover and you as a large organization are going to promptly remediate them. But the trouble isn't that the law might impose a $100 fine on a smug profe…

I agree the laws are too broad. I think we need add layers of granularity to them. Create more of a framework for settling the rules on what is and isn't allowed. Maybe we settle on everything goes, but the company should be involved.

A legitimate researcher should be notifying the company that they are going to be looking for vulnerabilities in the first place. That is part of the distinction in behavior that I am encouraging. This way if someone is caught poking around for things to abuse unsolicited, at least there's a little more merit to holding them accountable. We are able to treat it more like the threat it is.

A good faith company can give researchers pointers on where to look. Maybe the company has a really good reason to prevent looking at certain things, and they are able to convince the researcher of that. I dk. Point is the framework for settling all that should be promoted rather than promoting people to act identical to criminals right up until they decide whether to sell / abuse the information illegally or notify the company and try to get a reward. Does that make more sense?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#609

Post by SimingtonFCC »

TeMPOraL wrote: post #549
alerighi wrote: post #487

Earlier quoted context omitted.

> Remote update mechanisms can themselves present security problems in some domains. Not really if done right to be fair. It's just a matter of implementing a signature verification of the firmware updates that are installed on the device. > IoT is making its way into defense and enterprise environments where reliability is a matter of national security. If it's a matter of national security surely you don't use IoT…

> If it's a matter of national security surely you don't use IoT devices connected to the public internet. Of course they do. That's the flip side of PaaS and reverse-NIH syndrome, the "opex > capex" thinking: "Industry 4.0" is built on web tech, with all the practices and assumptions baked in. Your critical infrastructure is, or is about to, be running JavaScript on a docker-compose cluster, and expecting to be piec…

I would love to see frank discussion on the record of consumer-grade vs infrastructure-grade practices and what label(s) would be appropriate for each! It’s not lost on me either that the roots of much high-ticket critical infrastructure is about to rest on web tech and highly evolved descendants of 8-bit micros.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#610

Post by hot_gril »

Just requiring security updates doesn't guarantee much; they have to actually stop the threats. I'd like some opt-in qualification guaranteeing support similar to what autos have. There are recalls for safety issues, refunds for negligence, etc for a reasonable amount of time. Behind the scenes, this requires some kind of fund or insurance to back up the liability, which does have a cost. It's fine if not all products meet this high bar, but it'd be good for highly-committed IoT companies to be able to distinguish themselves from the cheapos.
Post reply on HN