Whatever the regulation, please please please may it only apply to companies above a certain revenue (or some other metric). Regulation of this form has a dampening effect on innovation, and this would be a straw on the camels back for startups.
Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
621–630 of 944 posts
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#622As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…
> Even if the owner can't control exactly what is in an update, they absolutely MUST be able to control when an update occurs. +1 for this at the consumer level. My oven may have a critical update, but - for right now - *nothing* is more critical than finishing dinner. I'll let the update apply the day after thanksgiving when I'm doing the dishes. There are a few connected appliances brands that do this well: updates…
I'm wondering why you'd have a smart oven in the first place. Seems like all risk and no reward.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#623The software industry in the US is enormously productive. It's the crown jewel of the American economy, and frankly props up our economy.
And it's completely unregulated.
Please, let's resist the siren song of regulation and it's inevitable unintended and undesirable side effects.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#624Not a US citizen so I'm not sure if I can even choose a state so here it is.
IoT devices are almost always data collection devices: CCTVs, thermostat sensors, smart light switches. The IoT devices do not only exist in the comfort of American home, but also American industries, American office buildings, and unlike your computer browser that receives security updates every 2 weeks or so, IoT devices are probably 5+ years out of date and are succeptible to hacks discovered over the years. Hacks can be discovered by malicious individuals, and distributed everywhere over the course of hours, so called 0 days attack. Think ransomware, cryptominers, backdoors. What would've happened over the course of years? and unlike computer devices where we have vulnerable softwares, IoT devices are typically low level, in which a security compromise in the network can definitely compromise the entire hardware, by exposing secret data locked only by software such as leaking privte keys, to allowing attackers to install custom software on cameras in your homes.
And worse, there's little incentive for manufacturers to continue supporting 5+ years in service, even though they are still in service. They may stop that line of products and sell new products instead, or even worse went out of business.
We have been putting to much trusts on the industry, but we need security to protect those who are vulnerable. Do you know when's the last time the camera in your dining room got its security update?
Manufacturers should be liable to ensure informational safety of its equipments. They need to specify on the device until when security updates are guaranteed, and beyond that, consumers are to be responsible for the device, either by using third party security updates at theie own risks, or by getting newer models with newer security guarantees.
So the call to actions would be:
1. Limited period mandatory security updates that is communicated on the devices. 2. Allowing any third parties to make changes on the device, especially after the security period is over.
One consideration is of course, opensourcing its software. The internet is really quick to spot security issues and even proposes the fix, and this would come at no financial cost to the manufacturers that don't have the incentive to test the security on their devices.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#625Earlier quoted context omitted.
How well did that work for bank oversight in 2008, and again in 2023 with SVB? The accountability of "my one vote will remove government's failed regulators" fails on the scale of $billions.
Is there an argument that the government failed in oversight with SVB? I think this is a textbook slam-dunk by the government? They stepped in when the situation was _bad_, but not _catastrophic_ yet (mmmmaybe arguable), took over, and no depositors got hurt. Is there an argument that this could've gone better, apart from "no banks ever fail"?
Fed had to set up a swap/lend facility that weekend. Sort of like they make it up as they go.
The specific regulator is going to retire. "Abbasi and Mary Daly, president of the San Francisco Fed, came under scrutiny after a post-mortem report undertaken by the Federal Reserve found problems with how SVB was supervised." https://www.msn.com/en-us/money/markets/key-san-francisco-fe...
And through regulatory capture the CEO of SVB was on the board of directors of the regulator!
https://www.reuters.com/markets/us/ceo-failed-silicon-valley...
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#626As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…
> Remote update mechanisms can themselves present security problems in some domains.
I've proposed many times that the device have a physical write-enable switch on it, not a software switch. That way, a malware infestation won't survive a reboot, and your backup hard drives won't get compromised.
I'm amazed that nobody does this. (Hard drives used to have a write-enable switch on them.)
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#627Earlier quoted context omitted.
> These regulations put us on the path of trusting religious-like in government. We don't need to have religious-like faith in government because we can vote for people who will do what we want them to and we can vote out the people who refuse to do their job. It doesn't happen without the people getting involved and holding their government accountable though. You don't have to pray when you can vote. Without regula…
Maybe I could have some faith if regulatory bureaucrats were fired when there are major regulatory failures e.g. 737 max. Maybe I could have some faith if police state agency employees were jailed for FISA abuse. Voting isn't enough because even elected officials aren't allowed to fire these people.
Specifically, FAA allowed Boeing to use software to cover up design flaw (crammed bigger engines under wings which causes pitch up problem) so it would appear to drive like older 737s. Apparently only a test pilot has been charged for falsifying some paperwork. 737MAX should be required to get a new type certification due to the significant changes.
Another example of regulatory capture leading to inadequate oversight is FDA, which has revolving door with drug companies. https://www.mdlinx.com/article/10-dangerous-drugs-recalled-b...
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#628Earlier quoted context omitted.
> Even if the owner can't control exactly what is in an update, they absolutely MUST be able to control when an update occurs. +1 for this at the consumer level. My oven may have a critical update, but - for right now - *nothing* is more critical than finishing dinner. I'll let the update apply the day after thanksgiving when I'm doing the dishes. There are a few connected appliances brands that do this well: updates…
I think this is oversimplifying things. Is finishing the dinner more important than applying a patch that fixes actively exploited bug that locks your oven into cleaning mode and burns everything inside into ash over the next three hours? Or something that disables the safety checks and lets the oven overheat and burn your house down? (Granted, the latter shouldn't physically be possible because it should have physic…
[deleted]
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#629Earlier quoted context omitted.
> "All I have to do is buy the company that owns the central server (or compromise it in some other less visible way) and I now have the ability to introduce malicious code to all devices that are receiving 'security updates.' You won't be able to make a rule to prevent asset transfer (correct me if I'm wrong) so you won't be able to close this hole." Has this actually been a problem in the past? I do not know of any…
There are malicious actors in the business of buying popular App Store apps and introducing malware into updates.
Or buying chrome extensions. Even domains.
Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
#630As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…
> Remote update mechanisms can themselves present security problems in some domains. I've proposed many times that the device have a physical write-enable switch on it, not a software switch. That way, a malware infestation won't survive a reboot, and your backup hard drives won't get compromised. I'm amazed that nobody does this. (Hard drives used to have a write-enable switch on them.)
Why doesn't MS do similar on all of their OS code by placing it on a read-only filesystem? Only allow updates when reboot into an update mode.