Live data from Hacker News

The Internet of Onions

lwn.net

11–20 of 38 posts

Re: The Internet of Onions

#11
post #6

Earlier quoted context omitted.

Supporting Tor is a niche thing, but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. Every device that reaches back to the mothership with a proprietary protocol is another device which gets discarded when the mothership loses interest in su…

What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic incentives. Having and supporting open protocols is more work than internal only. Often times the mothership is using other products to provide the service which are proprietary and paid for, so nothing is free (as in beer) or free (as in speech). "Do more wor…

> Customers aren't witholding money from products

I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who can say that as of right now?

Compare this to other industries. For cars, you have companies with varying levels of reputation (and that ebbs and flows over time). A big part of this is that car companies (and dealerships) aren't continually forcing you into using their related services. Oh, they'll encourage you and try to set up situations where it's strongly encouraged, but they know that many people will refuse to buy if they had no choice but to service their vehicle at the dealership they bought it from. What do you think would happen if Honda decided that for the next model year all fasteners were going to be non-standard sizes and with proprietary heads (think locking wheel nuts for for everything)? After the first few horror stories, Honda would deservedly start getting a reputation for being much harder to deal with, and lots of hidden costs.

Right now we are moving towards a situation where all the IoT companies work like this, but they are all so new, and changing so often, that there's no benefit to a good reputation because there's no associated history to go with it.

What we need are standards. Google and other major video platforms could help with part of this. Adopt a github type model for youtube or some service like it, where it works as it does now but if you want a private device-driven stream of video to be accepted, there's a standard for that and you can pay a small monthly fee (or it's free. The standard is the important part). Similarly, a standard for how to change settings for devices would be useful. HTML obviously works, but being so general may not be the best solution for what amounts to simple needs. A REST endpoint that supports a few well defined routes for discovery of routes and descriptions of them, as well as a route to return the entire configuration for backup, might work better, especially as it could easily be embedded in a larger dashboard for other devices (such as a "home" dashboard).

Re: The Internet of Onions

#12
post #10
post #6

Earlier quoted context omitted.

Supporting Tor is a niche thing, but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. Every device that reaches back to the mothership with a proprietary protocol is another device which gets discarded when the mothership loses interest in su…

I'm not sure what you mean by "persuaded", since unless the IoT device has its own cellular connection, it can't prevent being passed through a consumer-controlled device. Do you have such a device right now that is being bypassed? Because if the answer is no, that's your real problem.

Sure, but with any device that's doing security correctly right now, the only thing you get to control is whether you let it connect to the service it wants to use or not. It's not like you can re-target it connection and choose which types of calls make it through and which don't. And at that point you might as well just choose to not plug it in to the network (or give it your wifi credentials or whatever).

Re: The Internet of Onions

#13
post #2

I work for a large IoT PaaS provider. Would this be valuable for customers on our platform if we supported something like this? I'm trying to think through all the problems with this and while I think the redesign of our platform will actually make this harder, there's no reason it wouldn't be possible . I also don't really understand how Tor works. Does this break anything like persistent connections or letting scre…

Please fight for this. the more providers supporting turnkey (or on-by-default) tor routing, the better IoT will end up being.

If I can be a tad more hyperbolic, this is probably the most important thing a provider can do to ensure security of the devices within.

Re: The Internet of Onions

#14
post #11

Earlier quoted context omitted.

What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic incentives. Having and supporting open protocols is more work than internal only. Often times the mothership is using other products to provide the service which are proprietary and paid for, so nothing is free (as in beer) or free (as in speech). "Do more wor…

> Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who…

Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc.

As for the last paragraph, perhaps certification instead of standards? The equivalent of UL (Underwriters Laboratory) would work, but it would need to suit the nature, prices and timelines of these products. At least consumers would then know to look for the logo.

While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them. Additionally making them robust against general clients versus only in-house ones is a lot more work. The general ones would attempt to do nonsensical or potentially even harmful settings, and so would require more engineering spend to protect against.

Re: The Internet of Onions

#15
post #6
post #2

I work for a large IoT PaaS provider. Would this be valuable for customers on our platform if we supported something like this? I'm trying to think through all the problems with this and while I think the redesign of our platform will actually make this harder, there's no reason it wouldn't be possible . I also don't really understand how Tor works. Does this break anything like persistent connections or letting scre…

Supporting Tor is a niche thing, but... it would be very very helpful if everything in the IoT could be persuaded to go through a customer-controlled local gateway, which could proxy, rate-limit, redirect, and firewall connections according to the owner's policy. Every device that reaches back to the mothership with a proprietary protocol is another device which gets discarded when the mothership loses interest in su…

I am imagining a world where a local gateway isn't even needed thanks to Tor's decentralized (and secure) ability to do NAT traversal. You could make your phone the hub.

If IoT accessories connected directly to Tor, you could go through a pairing process once on your phone (via Bluetooth or whatnot), and access the device from anywhere in the world – no hub and no mothership required.

Re: The Internet of Onions

#16
post #11

Earlier quoted context omitted.

> Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who…

Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhap…

> Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside).

I think that's inherently a feature of them being too closely linked with the companies that provide them. Phones are the extreme case of what IoT devices could become. Once the phone OS is no longer supported by provider, keeping it is both a liability, and increasingly problematic as things stop working. Compare to old Nokia bumb brick phones. People still use those.

While the close control over phones has yielded some advantages (a boost to their markets and security, for one), a phone is generally much more complex than the average IoT device, and is closer to a general purpose device.

> As for the last paragraph, perhaps certification instead of standards?

Certification doesn't prevent a service from going away a year later. We need a way to hook the device up to another service. If it's a standard, there's nothing to prevent an open source product that you can install on your own server, local or remote.

> While there could be conventions for REST endpoints, I'm sceptical they would be of any use. The devices by their nature are special purpose (rather than general) so there would be a lot more domain knowledge needed to make sense of them.

I would be interested in exploring some specific examples. What, besides aggregation of audio, video, or stats, and configuration options is there that would be hard to support? Also, I'm not saying we can't or shouldn't have specialized services where it makes sense, just that we should have open standards that companies can work to implement if they choose.

> Additionally making them robust against general clients versus only in-house ones is a lot more work.

They always need to be robust against general clients. Allowing companies to think they can get away with ignoring this will be very problematic in the future. Having a well defined standard and likely off-the-shelf software to help implement it will probably do quite a bit towards making things more secure, not less. See home routers and the use of openWRT, Tomato, etc. I think this would more than likely raise the lowest common denominator when it comes to security of IoT devices.

Re: The Internet of Onions

#17
post #11

Earlier quoted context omitted.

What do you propose manufacturers do? (This is a serious question.) Customers aren't witholding money from products, so there isn't much in the way of economic incentives. Having and supporting open protocols is more work than internal only. Often times the mothership is using other products to provide the service which are proprietary and paid for, so nothing is free (as in beer) or free (as in speech). "Do more wor…

> Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who…

> A REST endpoint that supports a few well defined routes for discovery of routes and descriptions of them, as well as a route to return the entire configuration for backup, might work better

We called that SNMP. Unfortunately, it was embraced and extended to death. It wasn't a bad idea though.

The trick is, how do you get everyone to play fair, when there's incentive not to?

Re: The Internet of Onions

#18
post #11

Earlier quoted context omitted.

> Customers aren't witholding money from products I think part of the problem here is that everything is so new, relatively speaking, that almost no company can actually trade on their reputation. If today a company was able to advertise on having sold internet connected devices for a decade and their earlier devices still worked well in some manner, then people might actually use that in their purchase criteria. Who…

Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhap…

"Underwriters Laboratory" for devices is such a good idea. This is a world I want to live in.

I can imagine warnings like "mothership required", "Uses personal information", etc.

Re: The Internet of Onions

#19
post #16

Earlier quoted context omitted.

Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhap…

> Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). I think that's inherently a feature of them being too closely linked with the companies that provide them. Phones are the extreme case of what IoT devices could become. Once the phone OS is no longer supported by provider, keeping it is both a liability, and increasingly problematic as things stop workin…

Note that certification could also include verifying there is a plan in place for whatever period of support is reasonable. (We could dig deeper on this.)

Configuration options are hard to support. Say for example a "power level" setting is exposed (how much power is consumed to provide the device functionality). But it is also the case that more power shortens the lifespan of the device. A general client can end up setting that to 100% but won't know about the consequent lifespan issues, or too low a level results in half the functionality being switched off. By robustness I don't mean malformed inputs etc, but rather what is done with valid values. A general client will be oblivious, but an in house could present only part of the power range (the rest behind an "advanced" section). Settings will also interact with each other in device specific ways (eg power would affect maximum volume for an audio device). Pretty soon you'll need a complicated highly featured description language for the settings, interactions, cautions, effects etc. Also would you want to take support calls if external tools have been modifying the configuration, given that a single support call costs the same or more than the profit on the device?

That all said, I see nothing wrong with someone publishing and maintaining a set of best practises. IMHO it is the route most likely to get traction and improvement in devices.

Re: The Internet of Onions

#20

Earlier quoted context omitted.

Cars are also relatively expensive. iot products seem more in the disposable and non-essential space. You can always just throw it away without much inconvenience, so why put a lot of effort into the purchase process? Heck people don't even seem to care much about cell phones and keeping them up to date (iPhone and Nexus aside). And cell phones are far more important than lights etc. As for the last paragraph, perhap…

"Underwriters Laboratory" for devices is such a good idea. This is a world I want to live in. I can imagine warnings like "mothership required", "Uses personal information", etc.

How about positives too, like "uses best practises for updates", "uses appropriate authentication and authorisation for its function", "uses a reasonable amount of power" etc
Post reply on HN