11–20 of 95 posts
Yet, here we are, rushing headlong into the "IoT". We ought to recognize this for what it is: pursuit of profit from uninformed purchasers.
I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…
I don't know what the solution is but I really can't imagine a government body able to audit all that code in any meaningful way.
I think rather (and please punch holes in this idea) ... maybe fines if something isn't secure? I can't see how that would work either though. Not even the big guys have secure software as new issues are found all the time.
Basically it seems like you need to shun companies that get caught which will hopefully send a message. Also possibly take precautions. Put your internet of things devices on their own networks etc., don't let them on the net directly, ...?
I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…
I'd much rather have strong penalties to companies selling unreasonably insecure devices, with reimbursements to clients and rewards to the reporters of security flaws.
I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…
I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…
What we need is an obligation for the manufacturers to provide an automatic update mechanism and updates fixing security critical bugs for several years.
I continue to fail to see how connecting appliances or small electronics to a network adds actual value. Simply throwing technology at a thing doesn't automatically make it better. Yet, here we are, rushing headlong into the "IoT". We ought to recognize this for what it is: pursuit of profit from uninformed purchasers.
Still it would make sense to have an possibility to connect them to local network.
I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…
Security certification doesn't work and can't guarantee products to be free from security holes. What we need is an obligation for the manufacturers to provide an automatic update mechanism and updates fixing security critical bugs for several years.
Earlier quoted context omitted.
Security certification doesn't work and can't guarantee products to be free from security holes. What we need is an obligation for the manufacturers to provide an automatic update mechanism and updates fixing security critical bugs for several years.
Sometimes "upgrades" breaks things for users, and they are reluctant to apply them. Users are trained to not apply upgrades. Ideally you'd need law that manufactors not do that.
What is required is a multi track maintenance scheme, similar to LTS releases etc.
I continue to fail to see how connecting appliances or small electronics to a network adds actual value. Simply throwing technology at a thing doesn't automatically make it better. Yet, here we are, rushing headlong into the "IoT". We ought to recognize this for what it is: pursuit of profit from uninformed purchasers.
One approach to this is to build new tools and components that incorporate security & privacy by design. Discarding elements that are not required for a particular use case is also beneficial as there's less a hacker can do if they do manage to get in.
These approaches are captured in ideas behind unikernels, such as MirageOS [1], which themselves can be part of a larger stack [2]. I work on both of these and we even put together a contest (Bitcoin Piñata) to incentive a search for weak spots (and a bit of fun) [3]. I honestly think that only new software stacks or government regulations can fix these issues. Given mass-surveillance, I don't hold out much hope for the latter.
[1] http://mirage.io
[2] http://amirchaudhry.com/brewing-miso-to-serve-nymote/
[3] http://amirchaudhry.com/bitcoin-pinata/ and https://news.ycombinator.com/item?id=9027743