Live data from Hacker News

What If We Put Warnings on IoT Devices?

troyhunt.com

31–40 of 159 posts

Re: What If We Put Warnings on IoT Devices?

#31

In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless. This feels kind of like that.

Also like the pervasive “this site uses cookies” warnings in Europe.

Re: What If We Put Warnings on IoT Devices?

#32

In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless. This feels kind of like that.

> This feels kind of like that. It might feel like that, but it isn't. Everything[1] causes cancer. Not everything needs to have an Internet connection to a service to function, not essentially at least. It's only these people looking to monetize or "h0ok all teh th7ngs up!!1!eleven!" that are shoveling crap that no one asked for, but everyone is too lazy to object to. I've got a pair of wireless earbuds, completely…

Everything connected to the internet is a potential security and privacy risk. If they had a law requiring warning labels, then all products would just have to have that warning, regardless of whatever good design was applied to it (which is subjective and hard to judge, especially in the legal sense).

But ya, take out the internet connection, and no more problems. Take out the battery and the risk of fire/explosion also goes away.

Re: What If We Put Warnings on IoT Devices?

#33
post #24

In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless. This feels kind of like that.

Edit: I might be wrong and I have to go before I can get sources on it.

How did you arrive at this idea? I looked into it and it seems the list has very formal requirements for inclusion and they give the specific reason for inclusion for each chemical https://oehha.ca.gov/chemicals I guess that technically under the law the governor decides the final list but the actual compilation of the list has been delegated to oehha which has created formal requirements for inclusion.

What chemicals do you think have been included without scientific basis?

Re: What If We Put Warnings on IoT Devices?

#34

I'm of the opinion that products which require a separate service to perform their advertised functions (i.e. a "cloud" service-- be it "free" with the product or subscription-based) should be clearly labeled as such. I know that I don't actually own anything that I can't self-host (or pay whoever I want to host it), but it's clear that most people don't. Public education on this front seems valuable to me (but, then…

Yes. There's this doorbell (400-1500 USD) that connects via internet to a central host, and then notifies you on your smartphone. Seems sort of a neat idea, but a house lasts several decades - is that startup and its server going to be around that long?

http://www.doorbird.com

Re: What If We Put Warnings on IoT Devices?

#36

In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless. This feels kind of like that.

I think you missed the satire in the post. Obviously these warnings couldn't be used in practice since they list exploits that would've been fixed upstream if the companies had found them before release.

One exception might be the vibrator spyware "feature" which was clearly on purpose.

I took it more as a jab at the terrible software practices in this IoT goldrush than a serious proposal to add actual warning labels to their packaging.

Re: What If We Put Warnings on IoT Devices?

#37

I'm of the opinion that products which require a separate service to perform their advertised functions (i.e. a "cloud" service-- be it "free" with the product or subscription-based) should be clearly labeled as such. I know that I don't actually own anything that I can't self-host (or pay whoever I want to host it), but it's clear that most people don't. Public education on this front seems valuable to me (but, then…

> I'm one of those crazy people who believes in standards-based protocols and commodity hosting service). If that counts as crazy, then lock me up, because I'm crazy too. I'll second everything you said, but I'm not so sure it's entirely ignorance - I believe a large number of people just don't care (which is ignorance of another kind).

> standards-based protocols

Ok seeing we talking IoT what standard: of the top of my head mqtt, coap, http/rest, soap? Those are just communication protocols. Now we still need to standardize the application data layer jsonschema, swagger/openapi, wsdl? and most of the time the vendor wants to own the application for their benefit. Also the classic xkcd of standards leading to more standards is so true.

As you mentioned the problem lies with the general public, don't care attitude. Hopefully there is enough that will try to educate and help their peers.

But a lot of us is going to learn the hard way how criminals used our iot devices against us to rob us blind and only then change will truly start to take place.

Re: What If We Put Warnings on IoT Devices?

#38

NOTE: This packet is sold by wait, not by volume. Packed as full as practicable by modern automatic equipment, it was delayed the full net wait indicated. If it does not appear full when opened, it is because contents have been compressed during shipping and handling. http://www.directionsforme.org/item/315569

weight...

> This package is sold by weight, not by volume. Packed as full as practicable by modern automatic equipment, it contains full net weight indicated. If it does not appear full when opened, it is because contents have settled during shipping and handling.

Not entirely unreasonable note, but nothing to do with IoT

Re: What If We Put Warnings on IoT Devices?

#39

It would be interesting to have a word for devices that is sort of like 'organic' for food. It would indicate that the device is self-contained and has no connectivity.

I totally agree with the idea. However, the "has no connectivity" bothers me. It's OK for devices to have connectivity as part of their feature set. I'd be very unhappy if my iPad couldn't connect to the Internet at large. However, it requiring even occasional connection to some specific service in order to perform its functions is the red flag.

Re: What If We Put Warnings on IoT Devices?

#40

I'm of the opinion that products which require a separate service to perform their advertised functions (i.e. a "cloud" service-- be it "free" with the product or subscription-based) should be clearly labeled as such. I know that I don't actually own anything that I can't self-host (or pay whoever I want to host it), but it's clear that most people don't. Public education on this front seems valuable to me (but, then…

I'd like to go further and require the seller to pay for insurance to give an extended server life in the event the company folds OR release code for public servers that work all advertised features of the device.
Post reply on HN