Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

I'm interested in learning! what are those mistaken assumptions?

Uh, let me think ...!

Uh, first, I'll assume that "IoT" abbreviates Internet of Things.

===>>> IoTs?

Okay what things, IoTs, are being considered?

(a) I have some computers that run Windows. These computers are such "things"? The Windows software itself is such a "thing"?

(b) My Windows computers connect to a box, likely called a cable modem, I got from my ISP (Internet service provider). The box communicates with the rest of the world via a coaxial cable likely originally installed to carry cable TV. My computers communicate with the box via Ethernet cables or WiFi. The box also provides land line telephone. Soooo, that box is an example of an IoT under consideration?

(c) Recently I got a smart phone. Once I used a USB (universal serial bus) cable to connect the phone to one of my computers running Windows 10 Home Edition and via that cable was able to send an image from the phone to Windows 10. Then I disconnected the cable from the Windows computer, and now occasionally Windows 10 puts a popup window on my screen reporting that the cable connection is no longer receiving a signal. Apparently now forever Windows will keep that reporting and popup window. Sounds like an error in software design and maybe a security issue.

I only got the smart phone for emergencies, and otherwise, net, in one word, I HATE it. I keep it in my car in an envelope that claims to be a Faraday cage. My guess is, since the software is so bad, just awful, the worst I've ever seen in computing, there are likely many serious security problems. Since I want no problems of any kind, I can only hope that the envelope really is a Faraday cage.

(d) Several devices, e.g., table lamps in my office, have a USB socket for charging smart phones. Then these devices are IoTs?

(e) On Windows my favorite Web browser is Firefox. Is that an IoT?

I'm concerned about Firefox: Last week I went shopping for an emergency electric generator, and now when I use Firefox I get ads for such generators. Sooo, that looks like a security problem. Firefox should fix that. I tried the Web browser Brave and then didn't get the ads. Hmm ....

===>>> Updates

On "updates", I get lots of those from Microsoft for Windows 10, whether I want the updates or not. Maybe their next update will fix the USB popup window problem.

Firefox pesters me like a flock of flying insects to download an "update". I have a lot of Firefox options set and no good list of those options independent of Firefox. So I'm concerned that an update might change my option settings, and fixing that could take a few hours -- bummer. So, one update each six months, maybe one a year, should be often enough.

I like Windows 7 Professional, and apparently some security updates are still available. Are there really some new security threats not handled by the latest security updates to Windows 7 Professional?

I intend to move to Windows Server 2019 and suspect that there Microsoft will be very careful about updates.

My computer running Windows 10 is a laptop from Hewlett-Packard, HP, and they offer various updates frequently, continually.

So, I do get some updates, really more updates than I want.

===>>> Security

I still like Windows 7 Professional. Since the main concern here is security, are there some serious security problems with Windows 7? Windows 10? The cable modem? What serious computer security problems are we talking about?

===>>> The Other Side

I'm reminded of various possible consequences:

"Ah, we got concerns, right here in River City. Concerns starts with a 'C', and that rhymes with a 'T', and that stands for things as in IoT."

Ah, there is this really big threat, and you need Federal Government officials and lawyers to save you??? Hmm, ..., really???

"I'm from the Federal Government, and I'm here to help you."

Two very old, very broad items of advice:

(A) Always look for the hidden agenda.

(B) Follow the money.

So, here in the security and updates of IoTs, what now or soon how might we apply (A) and (B)?

Well, there is "regulatory capture" where the businesses being regulated use the power of the government and lawyers to help the business make money.

Regulations tend to make products more complicated and expensive.

Laws involve lawyers: Then can spend many thousands, or even millions, of dollars in legal fees and years in legal fights just to argue over some issue that, really, has much easier resolutions.

My experience is that lawyers mess up everything. In a legal fight, only the lawyers do well. E.g., recently some lawyers talked my main bank into demanding that I drive from TN to NY and bring a death certificate for my wife who died in 1992. I've been with that bank since before 1992.

I reminded the bank that I'd been a good customer for 30+ years, wanted to remain a customer, and am happy to discuss solutions to any concerns they have, but I'm NOT driving from TN to NY, do NOT have a death certificate for my late wife's death, and as soon as they involve a lawyer I'm closing out my account and moving to another bank. Right away they regained some common sense. Uh, with lawyers and DC regulations, common sense can be in short supply.

With regulations, can need a trained, certified, licensed, insured professional to spend half a day and $2000+ just to turn a screw.

===>>> US Free Economy

Generally the US runs on a free economy. One of the pillars of that economy is competition. So, if one product causes trouble, then the customer might switch to another product from a competitor.

Soooo, for IoTs, what "trouble" are we considering???

Quote from one [0] of the articles at the linked Ars Technica index page:

«A ragtag bunch of amateur hackers, many of them teenagers with little technical training, have been so adept at breaching large targets, including Microsoft, Okta, Nvidia, and Globant, that the federal government is studying their methods to get a better grounding in cybersecurity.»

My opinion is that we fail completely to build secure systems in a forward thinking way and the fact that we manage to stop threat actors that exploit holes that are already known to us is insignificant.

[0]: https://arstechnica.com/security/2023/08/homeland-security-d...

I don't understand what are you trying to imply here? That we should be punished for building a prototype? Or that had we shipped it in its current state, upstream vendor should be punished for stalling on updates?

> These devices are designed to work for hours with minimal supervision.

I wish. A while back, I put some (food) stuff to dry in the oven on a very low heat, knowing it would take all night to dry fully. After six hours, the oven decided that I must have accidentally left it on by mistake, and switched off automatically, and that stuff was wrecked when I got up in the morning and checked on it.