Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

Post by fragmede » Wed, Sep 06, 2023, 1:14 AM UTC

MichaelZuo wrote: post #458

ryukoposting wrote: post #378

As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…

This is a good point, some IoT devices really can't be designed to be physically serviceable, while still remaining reasonably compact, e.g. those that need very high levels of water resistance, especially saltwater resistance. And adding any remote update mechanism at all would more then likely decrease overall security. So there actually should be a counter mandate too, for devices that are impractical to design to…

Post by fragmede » Wed, Sep 06, 2023, 1:28 AM UTC

SimingtonFCC wrote: post #455

dtaht wrote: post #369

Earlier quoted context omitted.

Thank you very much for reading. It was the first, and last time, I ever took place in the public process and political action. https://www.computerworld.com/article/2993112/vint-cerf-and-... We were within months of delivering a massive RFC8290-based fix for wifi performance and we´d been bricking routers left and right... and then got in a whole bunch that we could not modify... due to that proposed regulation... I…

Thanks again -- will review both links (especially the latter!) The FCC hasn't traditionally been a cybersecurity agency and will, most likely, never really be one; however, we can certainly do things through rules to empower experts, the public, and the agencies with cybersecurity expertise. If that one thing is all you ever did at the FCC, sounds like the public owes you a big debt of gratitude.

Post by deadbunny » Wed, Sep 06, 2023, 1:34 AM UTC

EricMausler wrote: post #514

Buttons840 wrote: post #464

Earlier quoted context omitted.

Also, security researchers should have strong legal protections; they should be given the benefit of the doubt at every turn. Currently, researchers are sometimes threatened with decades in prison for testing the security of websites or devices. If they act in good faith as researchers, this should never happen. This is literally a national security issue. We currently stifle security research on essential IoT device…

This might be an unpopular opinion but I respectfully do not see it that way. I agree with promoting security for IoT devices, but there needs to be consent from the company being probed for vulnerabilities or else I find it hard to consider it legitimate research, regardless of intent. I dont think anyone would like it very much if someone came to their house and documented all the ways to rob it they could find, ev…

Post by [deleted] » Wed, Sep 06, 2023, 1:39 AM UTC

fragmede wrote: post #679

klausa wrote: post #675

Earlier quoted context omitted.

>If the attacker has total control, then all bets are off no matter what mechanisms you put in first. Great, so we now agree that it's important to keep the system patched and up to date.

That depends on updates never introducing new vulnerabilities.

Post by eru » Wed, Sep 06, 2023, 1:42 AM UTC

emiliobumachar wrote: post #441

eru wrote: post #140

Earlier quoted context omitted.

Well, lots of people have been not-buying liquorice their whole life, but nothing's changing. The market for liquorice candy is alive and well. Less snarky: if other people still want to buy certain products, manufacturers will provide. But that's not a bad thing. Different folks have different preferences.

Insecure IOT has the huge externality of providing muscle to criminal botnets, though.