Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

781–790 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#781

Post by lxbxc »

uuuuuuuuuid wrote: post #741
steamer25 wrote: post #333

Earlier quoted context omitted.

This may be beyond the FCC's purview, but given some of the comments (e.g., https://news.ycombinator.com/item?id=37393644 ) perhaps an entirely different strategy is warranted. Instead of trying to compel manufacturers, who may no longer even exist, to support their old products; perhaps the government should focus on protecting consumers and aftermarket vendors who update / modify / reverse-engineer older revisions-…

I imagine someone in the many many comments has already suggested this. But just in case: It wound be great if all of my emails to security@somewebsite.con could be CC’d to security@fcc.gov and that would immediately convey to me, somewebsite, and the FCC (and anyone else) that I am indeed disclosing and not ransoming. I understand there would be a cost that the FCC would bear. I just think it would be a worthwhile c…

This seems like a pretty clear breach of first amendment rights (we have a right to choose what we say, and who we say it to). It is probably a good idea for researchers to implement this strategy, and obviously more protections are needed for researchers in this area, but eroding the bill of rights is not the way.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#782

Post by robertlagrant »

bick_nyers wrote: post #372
CodeWriter23 wrote: post #349

Earlier quoted context omitted.

FDA: $450K per product. And they aren't doing very much more than asking the vendor to describe their protocols, then ensure the vendor complies with their protocols and any agency guidance. Source: I work at an FDA-regulated company.

Did not know it was $450k per product, my second responsibility outside of software engineering was being the risk manager at my previous company as well which is FDA-regulated. Still, many IoT companies that sell products don't even have protocols or a QMS at all, and need some kind of heat applied to them.

I might be a bit cynical, but if you divide the world of IoT into companies that do things well (but charge more) and companies that do things badly (but charge less), then I think the following might happen if you mandate QMS and audits.

The companies that do well already just add to their costs (and prices) as they need to employ people to maintain these systems, and companies that do badly will also have to hire those people, and increase their prices, but they will be creating a paper shield around the products, rather than a genuine product improvement.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#783

Post by chupasaurus »

codedokode wrote: post #366
PhilipRoman wrote: post #70

Earlier quoted context omitted.

For those out of the loop these documents have a good introduction to how free software interacts with radio regulations https://wireless.wiki.kernel.org/en/developers/regulatory/st... https://wireless.wiki.kernel.org/en/developers/regulatory TLDR manufacturers and "serious" companies won't touch anything that could potentially be configured to emit signals that your local government doesn't like. So Linux has to pre…

So Linux takes government's side, not user's?

I'd call it "safe defaults".

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#784

Post by ale42 »

petsfed wrote: post #439
ChrisCinelli wrote: post #161

Earlier quoted context omitted.

Openwrt is not the best example. Community sucks, some routers are full of bugs and the security is not great either. In general even if I like open devices and having the option to use my own software, this is not a solution for most of the consumers. It is not a solution even for the enthusiast that know how to flash their own firmware. Because even if they may do it a few times initially, eventually they stop doin…

There is absolutely no scenario where I want the firmware of any of my infrastructure devices updating without my say so. Even if there are dire security consequences of not updating. If a firmware update on my smart watch bricks it, who cares? But if my entire house/office is without internet connection because of a bug in the router update, then I don't want to waste time determining if its my ISP, my physical conn…

I see two essential points (that might have been addressed in another comment somewhere else in the thread, but I can't read everything) regarding pushed firmware updates:

• It happens, especially if the update has been a "quick fix" to a security issue, that the update introduces unexpected behaviours, or incompatibilities. Supposing this was just a "security-only" update that doesn't change any features, I would approve it, and then discover it breaks something in my installation (e.g., compatibility with a specific device or software I'm using). In that case, I need to be able to rollback the update and run the previous firmware version (possibly mitigating the security issue in another way, if it's properly documented) to avoid serious issues that, depending on the device, might prevent important equipment from being operated.

• For firmware updates that include more than security fixed, approval and the possibility of rolling back is even more important. It's quite common that updates remove seldom-used features a minority of users depend on. It even happens that some features get removed and replaced by subscription-only services, which is even worse.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#785

Post by lxbxc »

withinboredom wrote: post #779
klausa wrote: post #577

Earlier quoted context omitted.

I think this is oversimplifying things. Is finishing the dinner more important than applying a patch that fixes actively exploited bug that locks your oven into cleaning mode and burns everything inside into ash over the next three hours? Or something that disables the safety checks and lets the oven overheat and burn your house down? (Granted, the latter shouldn't physically be possible because it should have physic…

Finishing dinner can be more important than the house not burning down. A burned down house is likely insured. A dinner with a potential business client is not.

Surely this has to be a joke.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#786

Post by neop1x »

WaitWaitWha wrote: post #725

Thanks for reaching out to the community. Instead of mandatory updates, there are lower hanging fruits you can win, and will have just as much, if not more positive security impact. 1. No default password, one must be set at initial configuration 2. Devices must function without public internet connection (unless it is one of the device's primary function to transmit out) 3. Devices must function without centralized…

I have zigbee and wifi smart home based on Home Assistant, zigbee2mqtt and ESP Home. It is completely local, no internet required and works perfectly. The automation is done in Node Red. If I need to do some action from the internet, I do it through wireguard VPN (one click on my Android phone).

I especially like that zigbee is not even able to make connections to the internet itself. I "own" the devices.

I understand that VPNs are hard for average users, but centralised, potentially insecure server infrastructures, generally situated in China, pose a significant security concern.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#787

Post by happymellon »

structural wrote: post #632
MarcoPerazaFCC wrote: post #156

Earlier quoted context omitted.

Re: the licensing issue, companies wanting to put a label on their product would probably want to extract similar guarantees up their supply chain. Especially with a voluntary program like the one the FCC is proposing, good practices won't become the norm across the market overnight. But maybe, at the very least, the segment of product and component makers that take security seriously will begin to grow. I encourage…

As someone who designs IoT devices like these for a living, the device manufacturers here are in many cases the smallest companies in the supply chain and have very little ability to influence things upstream of them, especially for specialty products or companies entering a new market. It's often a major win to get a chipmaker to pick up the phone and sell us their product, much less receive any support at all. I wi…

If it was forward looking, rather than retroactive then it would at least mean that chip manufacturers wouldn't be able to sell their undocumented/unsupported crap because all the buyers have to have it?

If there are no buyers then their attitude should change.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#788

Post by jpc0 »

charcircuit wrote: post #663
distract8901 wrote: post #92

I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks. The core problem is that without control of the firmware, consumers don't really…

>AND be obligated to release the full source code for the device once they decide to end support. This is unreasonable. Code is often reused in the next generation of a product. The company may not have the rights to release all of the code.

A competent technician with access to a workshop can make even 80 year old vehicles work. That is long past the service life of that vehicle but it can still be done, an iteration of the same technology is likely still in use today though in your car.

That isn't possible for software simply because reverse engineering is not simple, reverse engineering a small microcontrollers firmware might be possible, reverse engineering even something like old unix wouldn't be and definitely any modern operating system wouldn't be even though there is no legal precedent for that source code to be protected.

In 30-40 years time when early windows and early DOS copyright expires do you think Microsoft is going to benevolently make that source code available? It has legally become public domain but the source code will still remain closed.

How about firmware for IOT devices being installed in your house, it's likely that that hardware can be made to work for the next 60 years but you are forced to replace it in 3 when the manufacturer decices it's no longer financially viable to support it.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#789

Post by tomaskafka »

nickff wrote: post #475
iandanforth wrote: post #383

I think the most valuable security feature for IoT devices is being able to work without contact with a central service. If the value of a device is tied to opening a connection to and occasionally retrieving code from a third party it is inherently insecure . All I have to do is buy the company that owns the central server (or compromise it in some other less visible way) and I now have the ability to introduce mali…

> "All I have to do is buy the company that owns the central server (or compromise it in some other less visible way) and I now have the ability to introduce malicious code to all devices that are receiving 'security updates.' You won't be able to make a rule to prevent asset transfer (correct me if I'm wrong) so you won't be able to close this hole." Has this actually been a problem in the past? I do not know of any…

There are reports about Saudi stakeholders co-owning few billion stake Twitter with Elon just to be able to install people who exfiltrate data used for tracking and arresting journalists and activists, for example.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#790

Post by eithed »

EricMausler wrote: post #618
saurik wrote: post #545

Earlier quoted context omitted.

The problem here is that the thing I am probing is something I own: the device in my house that I ostensibly purchased and am allowed to smash with a hammer or put in a blender for all anyone should care; the context is that the DMCA is often used by companies to claim that DRM on the device is there to protect copyrights--whether music the device had access to, even if it isn't the reason many or even most people bu…

I hate it too, but the heart of this is that ownership is under question. People should not have agreed to buy things where there are parts of it they don't own that they don't even need, but they did. They did it a lot because it didn't matter to them and now those devices are prevalent everywhere and it's a PITA to try to buy the type of item you actually want - where you own it entirely. Ownership has never actual…

Out of curiosity - why should I be required to ask for permission from given company to probe company owned infrastructure?

What I mean here is that if there's a bug / vulnerability on given company infrastructure, then that company should fix it and not put on a blame on a user that was affected by it (even if device that communicates with given infrastructure always follows happy path)

Post reply on HN