Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What If We Put Warnings on IoT Devices?

troyhunt.com

Post reply on HN
Print view View original

121–130 of 159 posts

Re: What If We Put Warnings on IoT Devices?

#121

Post by seanmcdirmid »

sandworm101 wrote: post #81
freehunter wrote: post #41

Earlier quoted context omitted.

The problem I've always found with the California warnings is that they're so damn generic. There's nothing forcing companies to tell you what compound is harmful, where it is, or what it's used for.. A fishing sinker made from lead is pretty obvious when you see that warning. There's only one ingredient, lead, and it's obvious why it's harmful. But when you buy a complex product that says "this product contains chem…

Some warnings speak of "specific birth defects" which is something greater than a may/might do something. Normally this is reserved for the class of chemicals and drugs that post-thalidomide are known to cause limb-reduction defects.

Funny story, we moved from china to California last year because my wife was pregnant and the environment over there is pretty pllluted. When she saw this warning at the entrance of our new apartment, she began doubting our move (they don't have that in china!).

Kid was born without defects.

Re: What If We Put Warnings on IoT Devices?

#122

Post by TeMPOraL »

finnn wrote: post #110
659087 wrote: post #104

Earlier quoted context omitted.

It also notifies that central host every time someone visits your home, and provides them with video and audio of that person. That doesn't seem like a "neat idea" at all. "By visiting my front door, you agree to Doorbird's privacy policy"

Couldn't the same be said about all the other shitty cloud-connected surveillance cameras? Not saying that justifies it, just that this is a bigger problem then just those awful internet of doorbells

Of course it can be. It's all shitty engineering - making roundtrip through cloud with data that should only ever touch your personal devices.

Re: What If We Put Warnings on IoT Devices?

#123

Post by TeMPOraL »

npsimons wrote: post #64
throw2016 wrote: post #53

Earlier quoted context omitted.

This self serving 'general public don't care' argument by software folks is becoming tired and cliched. The general public doesn't care about freedom of press. Let's take that away. The general public doesn't care about elections. Let's take that away. People use these self serving assumptions of ignorance to empower themselves. You have a ton of devices and things you use in your everyday life. Why should a doctor o…

> That's why you need standards, so vague terms like the 'general public don't care' are not used to abuse them. I wouldn't argue so much for standards of technology, as for standards of conduct. It's funny you mention doctors and civil engineers, two professions with high ethical standards precisely because they went through the same painful growth the software industry is going through now. The 'general public', qu…

> two professions with high ethical standards precisely because they went through the same painful growth the software industry is going through now.

High ethical standards enforced by a court of your peer professionals, who can ruin your career if you break the code of conduct. The last part is, unfortunately, crucial, because ethics can quickly go out of the window when people face monetary pressures.

> It is incumbent upon us, the knowledgeable and ethical practicioners of our field, to hold not just ourselves, but our whole industry to a higher standard. Thus, discussions such as this one on HN where we point out that IoT devices could cause a world of hurt because of all the make-a-quick-buck hucksters who couldn't be arsed to do due diligience.

I strongly agree. And I feel there should be loud naming and shaming of companies with anti-consumer practices like these.

One thing I feel we can teach the general public, though, is the distrust towards the cloud and SaaS model. IoT devices can, and should, communicate point-to-point or in your LAN. If a device needs an Internet connection to work and doesn't have a damn good reason for that, one should avoid it.

Re: What If We Put Warnings on IoT Devices?

#124

Post by TeMPOraL »

michaelfeathers wrote: post #15

It would be interesting to have a word for devices that is sort of like 'organic' for food. It would indicate that the device is self-contained and has no connectivity.

Unfortunately, "organic" today mostly means overpriced crap for eco-freaks that's about as bad or even worse[0] than regular food. Hell, sometimes the same companies makes both regular and "organic" stuff.

But I get your point. Now I would like to have some "smart" devices, though, so beyond your label for self-contained devices I kindly ask for a label for devices that stay on local network.

--

[0] - industrial pesticides are better than "pesticides" that still let you claim the "organic" label.

Re: What If We Put Warnings on IoT Devices?

#125

Post by TeMPOraL »

vannevar wrote: post #91

If there is such a warning, it should be along the lines of: "This device is inherently insecure and could be remotely operated by persons unknown anywhere in the world."

Also: "This device collects data to be processed by the vendor and possibly resold to third parties."

Also maybe they should be honest and just write: "This device will stop working at any time the company behind it gets bought and/or decides to abandon the product line."

Re: What If We Put Warnings on IoT Devices?

#126

Post by TeMPOraL »

JustSomeNobody wrote: post #86
krapp wrote: post #27

Earlier quoted context omitted.

> Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. That's a good rule, but good luck opting out once most manufacturers no longer give you an option.

> That's a good rule, but good luck opting out once most manufacturers no longer give you an option. The irony is that this is Hacker News and so many people building those things hang out here. If we want to make a difference, we have to start making a difference.

Well, I strongly hope those many people involved in these things can feel the peer pressure here, and subsequently push for changes at their workplaces.

Re: What If We Put Warnings on IoT Devices?

#127

Post by TeMPOraL »

mnw21cam wrote: post #89
jacquesm wrote: post #10

Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. None of those grafted on services for me, I really have yet to see anything that was so compelling that I would give up and consent to essentially renting a device and having an account with some service to make it useful. That way you also don't need to warn anybody about the lousy security, I'm…

> Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. While this sounds like a wonderful idea (and one I would subscribe to), it doesn't address the fundamental problem with IoT security. Most operating systems have updates made available on a monthly, weekly, or even daily basis, in order to keep them secure. Mostly, we know how to do this, the op…

Well, but that's the point: don't connect it to the Internet. 99% of the IoT stuff should never ever have to work outside of your local network (including VPNing to your phone if you're outside).

Re: What If We Put Warnings on IoT Devices?

#128

Post by TeMPOraL »

lucb1e wrote: post #63
jacquesm wrote: post #10

Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. None of those grafted on services for me, I really have yet to see anything that was so compelling that I would give up and consent to essentially renting a device and having an account with some service to make it useful. That way you also don't need to warn anybody about the lousy security, I'm…

> it should not need an external service to operate. If it does then I'm not buying it. And how do you know, pre-purchase, whether it does?

It's usually on the box, because manufacturers think the cloud is a feature, not a problem.

Re: What If We Put Warnings on IoT Devices?

#129

Post by zokier »

mar77i wrote: post #58

Urm, you know, people got used to IoS. Telling other people how to make their choices is telling other people what to do. It's not always nice, and frankly, never actually works.

People also got used to smoking. Telling people not to smoke might not have been nice, but it definitely has been working.

Re: What If We Put Warnings on IoT Devices?

#130

Post by TeMPOraL »

jacquesm wrote: post #10

Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it. None of those grafted on services for me, I really have yet to see anything that was so compelling that I would give up and consent to essentially renting a device and having an account with some service to make it useful. That way you also don't need to warn anybody about the lousy security, I'm…

Strongly with you on that. I too avoid both hardware and software that uses external services as much as I can. Every day this becomes harder, though. For me it's not even about security - it's about reliability (having the stuff work off-line), longevity (not losing a device or software because a startup reaches the end of its incredible journey) and plain old respect for good engineering. Shuttling bits around half of the planet to move them between devices that are physically next to each other is just shitty engineering.
Post reply on HN