Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

681–690 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#681

Post by hot_gril »

klausa wrote: post #675
hot_gril wrote: post #674

Earlier quoted context omitted.

If the attacker has total control, then all bets are off no matter what mechanisms you put in first. Adding a safe mode would at least allow manufacturer to stop any non-total exploit without relying on the more complicated update mechanism. Also, the appliance would more likely work in a kinda normal way in the meantime.

>If the attacker has total control, then all bets are off no matter what mechanisms you put in first. Great, so we now agree that it's important to keep the system patched and up to date.

I didn't say otherwise. Only that a forced update mechanism is insufficient for stakes as high as burning down the house. Maybe the patch fails to download/install, or they take too long to develop the patch in the first place, or the patch doesn't work for all models on the first try. There needs to be a simple kill switch if we're talking about threats like this.

Besides that, the safe mode oven should still be able to cook food manually.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#682

Post by spiderice »

hot_gril wrote: post #678
stevehawk wrote: post #670

Earlier quoted context omitted.

The ability to pre-heat my oven without standing in front of it. That's really the big win. But also to be able to tell if spouse or children left it on.

But I can walk to my oven and turn it on, which wasn't a real problem even when I lived in a huge house. What am I missing?

We really can’t force you to see the obvious if you’re set on not understanding something.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#683

Post by dcow »

MetaWhirledPeas wrote: post #606
vkaku wrote: post #473

I've dealt with this multiple times, so let me give my perspective. - It is hard for manufacturers to do this with small teams. Mostly because they do not always have good CI/CD or platforms available to keep being on top of vulnerabilities and so on and so forth. - Not all manufacturers write their own software and often contract it out to other experts in the field. This includes firmware and app developers. - If a…

> - A lot of blast damage can be contained if home devices use local / MDNS based service discovery as opposed to Internet based services. Many services could then either choose to reply locally or sometimes relay to the Internet if users policies allow. Unless people want other people unlocking their doors through the Internet, and they explicitly say it, Internet connection can not be mandated. Networking ignoramus…

Homekit tried to do this. I don’t know if they still do.

This can be done today by only advertising a ULA v6 prefix to IoT devices. The problem is the router has to now have global knowledge of what devices are allowed to talk to what services. Or the device has to work entirely locally with mDNS, DNS-SD etc.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#684

Post by nfriedly »

nfriedly wrote: post #557

Here's a few things that I would find useful for IoT device labeling: 1) An indication of whether it supports local control, or requires an internet connection. (I can control my Philips Hue lights from my phone even when the internet is down, as long as they're on the same network. However, my MyQ Garage Door opener can only be controlled from my phone when both the phone and the garage door have an internet connect…

Oh, and just to clarify, I think open protocols should count towards openess, even on closed source devices. It should just be clearly labeled.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#685

Post by hot_gril »

fragmede wrote: post #677
hot_gril wrote: post #622

Earlier quoted context omitted.

I'm wondering why you'd have a smart oven in the first place. Seems like all risk and no reward.

Lucky guy, it sounds like you've never experienced overwhelming anxiety over having possibly left the oven on while out of the house.

That'd be a legit feature, but far less involved than a full-on smart oven. At most, it'd have a way to turn off the oven remotely (but not turn it on).

Anyway, last time I had this anxiety, I checked my Ring camera in the kitchen that's posted there for reasons like this. Works for the stove and faucet too.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#686

Post by screwturner68 »

EricMausler wrote: post #608
AnthonyMouse wrote: post #546

Earlier quoted context omitted.

> There is an inherent risk of your vulnerabilities being broadcasted somewhere either on purpose or accidentally once that information is collected and organized by the researcher. A legitimate researcher is going to promptly notify you of any vulnerabilities they discover and you as a large organization are going to promptly remediate them. But the trouble isn't that the law might impose a $100 fine on a smug profe…

I agree the laws are too broad. I think we need add layers of granularity to them. Create more of a framework for settling the rules on what is and isn't allowed. Maybe we settle on everything goes, but the company should be involved. A legitimate researcher should be notifying the company that they are going to be looking for vulnerabilities in the first place. That is part of the distinction in behavior that I am e…

so are you saying that I shouldn't be testing a product I purchased or a product that someone mandated I have in my house? I shouldn't have to notify anyone, I own it and I should be able to do with it whatever I please. In addition if I do find an exploit I am not obligated to notify the company nor should I be. A good faith company should be doing their due diligence and not releasing unprotected/poorly protected devices as is common today.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#687

Post by hot_gril »

spiderice wrote: post #682
hot_gril wrote: post #678

Earlier quoted context omitted.

But I can walk to my oven and turn it on, which wasn't a real problem even when I lived in a huge house. What am I missing?

We really can’t force you to see the obvious if you’re set on not understanding something.

That's alright, I'm good. Smart ovens are pretty rare, so it seems like a lot of people don't get this.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#688

Post by MarcoPerazaFCC »

elihu wrote: post #616

Some ideas: Customers should be able to return for a full refund any products that have security vulnerabilities that aren't addressed within the support period. Companies could opt to participate in a source code escrow program where the source code for the product is deposited with a third party, and if the company goes out of business or something, the source code is released with a sufficiently-permissive license…

Thanks for the thoughtful reply. I encourage you to file an official comment with your ideas.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#689

Post by hsbauauvhabzb »

hsbauauvhabzb wrote: post #493

I’ll preface this with the fact that I am a security engineer (‘penetration tester’) but I probably don’t live in your country. I care more about my privacy than I do about the security of my device, but an architecture that supports the second almost always supports the first (my neighbours hacking my zigbee isn’t a threat model almost anyone should be concerned about, unless there’s a pattern of hacking en masse).…

Edit: when I say opt out, I mean it - I frankly think ‘if you don’t like it don’t buy it’ is a good article when every non-commercial TV reports usage information back to the provider. There aren’t viable options for many products as all the product manufacturers scummy analytics teams have got their hooks in.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#690

Post by paiute »

landemva wrote: post #351
snarf21 wrote: post #288

Earlier quoted context omitted.

The biggest problem isn't even new regulations. The liability for violation always tends to be a rounding error to profits. Then, even if there are teeth, there is no money for enforcement which makes it all pointless. Look at how the FTC and SEC have completely failed us in the 21st century. Better regulations would matter if we ever bothered to enforce the ones we already have.

This sums up the situation that government regulations don't work. These regulations put us on the path of trusting religious-like in government. We could be working toward push-button simple network segmentation with some kind of default filtering for install by the average home user.

I’ve worked in security before and i don’t really think the government should be involved that much. There are so many different situations to consider. What i would support is the fcc coming up with a list of common patterns and then forcing devices to state which, if any, pattern they follow. I have a weather station for example which doesn’t really need any security on the device end.
Post reply on HN