Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

news.ycombinator.com

Post reply on HN
Print view View original

911–920 of 944 posts

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#911

Post by baby_wipe »

wolverine876 wrote: post #280
baby_wipe wrote: post #223

[Update: I did not read the original proposal carefully. I mistakenly believed this was a mandated regulation and not a voluntary one, so some of the points in my post do not apply. However, I still oppose it for mostly the same reason: if consumers wanted this type of label on their products, then we we would likely already see it. I am also skeptical that this is being initially proposed as a voluntary program, but…

Consumer don't have time, knowledge, or resources to demand all these things they use. When I buy a car, I want it to be safe. I spend zero time evaluating its technology and demanding labels. I already have a job.

That's true. Consumers rely on things like brand name, word of mouth, customer reviews, etc.

Another label like this will likely do nothing.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#912

Post by baby_wipe »

zamadatix wrote: post #237
baby_wipe wrote: post #223

[Update: I did not read the original proposal carefully. I mistakenly believed this was a mandated regulation and not a voluntary one, so some of the points in my post do not apply. However, I still oppose it for mostly the same reason: if consumers wanted this type of label on their products, then we we would likely already see it. I am also skeptical that this is being initially proposed as a voluntary program, but…

The proposal in question is a voluntary labeling program. If a company did not want to participate they would not have to.

You are correct. I was mistaken. I updated my original post.

I will note though I am suspicious this will be used as a framework for future mandated regulation.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#913

Post by baby_wipe »

zzzeek wrote: post #253
baby_wipe wrote: post #223

[Update: I did not read the original proposal carefully. I mistakenly believed this was a mandated regulation and not a voluntary one, so some of the points in my post do not apply. However, I still oppose it for mostly the same reason: if consumers wanted this type of label on their products, then we we would likely already see it. I am also skeptical that this is being initially proposed as a voluntary program, but…

And here's the political angle. Letting a bunch of insecure iot devices into your home actually harms other people by allowing your devices to enable subsequent exploits of your neighbors, both on the next block over as well as the next country over. Therefore iot devices most certainly should be regulated as this is a critical issue for the public good as well as national security.

I responded to a similar post above. I have not thought through the externality argument very much.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#914

Post by ClumsyPilot »

landemva wrote: post #872
ClumsyPilot wrote: post #806

Earlier quoted context omitted.

Okay, let look at the reverse situation If my ISP charges me for 100 mbps but provides 10, can I enact punishment without government interfering and protecting ISP from my punishment?

Using rule of law and courts, it depends on your contract. Many residential providers have service as a best effort. Guaranteed service with penalties are typically possible, if you are willing to pay significantly more.

This is textbook definition of hypocrisy.

ISP does whatever they want without any qualifiers about contract and without any need to go to court.n

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#915

Post by eru »

chromoblob wrote: post #792
eru wrote: post #700

Earlier quoted context omitted.

What do you mean by less power? It's different. One manufacturer can't force you to buy stuff you don't want, nor ban you from buying from a different manufacturer that does what you want. (In contrast with the FCC, which has a lot of power over you, by banning you from buying what you want.)

What if no or very few manufacturers produce a thing, yet the thing would be very beneficial to many owners? Why would one want specifically to buy a product not conforming to the choice described in the first-level comment?

> What if no or very few manufacturers produce a thing, yet the thing would be very beneficial to many owners?

If it's useful enough, and the existing manufacturers leave significant customer needs unfilled, competing suppliers can step in.

> Why would one want specifically to buy a product not conforming to the choice described in the first-level comment?

All kinds of reasons. It might be cheaper, for example.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#916

Post by tylercrompton »

systemvoltage wrote: post #774
WaitWaitWha wrote: post #725

Thanks for reaching out to the community. Instead of mandatory updates, there are lower hanging fruits you can win, and will have just as much, if not more positive security impact. 1. No default password, one must be set at initial configuration 2. Devices must function without public internet connection (unless it is one of the device's primary function to transmit out) 3. Devices must function without centralized…

By default, no telemetry. NO DATA OUT OF MY HOUSE WITHOUT EXPLICIT PERMISSION.

Out of curiosity, in what context has IoT telemetry been meaningful to the consumer? In other words, what data has been gathered that can be sold or otherwise abused? I personally don't see a reason to be concerned about a manufacturer wanting to track which features are being used and how those features are being used.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#917

Post by treyd »

posix86 wrote: post #805
treyd wrote: post #193

Earlier quoted context omitted.

> 3.3 IoT should not accept inbound communication without authentication. Ideally the user should have to specifically consent to inbound communication on an instance-by-instance basis, even from the manufacturer . There's many cases where forced updates are triggered that change/limit functionality unexpectedly. There's numerous anecdotes of people's devices being required to update to be used while they have some p…

That's not what regulation is for though. The marker will regulate companies making bad products. Regulation should only grip where the market doesn't.

That's an overly rosy view of what markets are capable of self-regulating in a situation where network effects are very strong and it's difficult to stop being a customer once you are.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#918

Post by KyleBerezin »

My biggest issue as an IoT developer is many systems want to exist in a internet DISCONNECTED state. That is, a local ad-hoc mesh of devices. They are secure because they are air-barriered to the internet, and often are set up miles away from a point where they could connect to the internet.

The problem is, due to security rules imposed by browsers and apple, these devices must be constantly given new certificates to keep them operating. Without these certificates, no ssl, no secure web-sockets. This effectively makes it so that every-single-device has to be internet facing. These security measures were intended to help, yet everyone always asks "Why did my light switch even have a connection to the internet?" and this is why.

What I hear from your proposal is even more of the same, more internet traffic from every little trinket, more apps needed to activate simple devices. And making it even harder to have a devices simply communicate over a protected lan.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#919

Post by solidsnack9000 »

EricMausler wrote: post #855
solidsnack9000 wrote: post #823

Earlier quoted context omitted.

What do you think about a person who bought a house and documented all the ways to rob it that they could find? As far as I am aware, there is no law against that; and that is more comparable to what security researchers are actually doing.

If they bought a prefab house which was sold to many people in the neighborhood, and part of the terms and conditions were do not open up the walls, and the owner opened up all the walls to find out weakspots it can be robbed, then that does seem criminal, no? However, the owner should still have a right to validate the security of his house - so he should be able to request for permission to break the terms of his c…

At present, I'm not sure it's actually possible to sell someone a house with terms like that, since it would interfere with ordinary, even essential aspects of maintaining a liveable dwelling. It does highlight the oddity of the situation we are in with many IoT devices.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#920

Post by KyleBerezin »

iandanforth wrote: post #383

I think the most valuable security feature for IoT devices is being able to work without contact with a central service. If the value of a device is tied to opening a connection to and occasionally retrieving code from a third party it is inherently insecure . All I have to do is buy the company that owns the central server (or compromise it in some other less visible way) and I now have the ability to introduce mali…

This is virtually impossible due to certs. If you want your device to keep its traffic secure with ssl or wss, you have to have valid certs. Thanks to apple, that either means a device with a 1 year expiration date, or an internet connection so you can periodically provide the device with new certs.
Post reply on HN