Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tougher rules for sellers of internet-enabled devices in the UK

bbc.co.uk

Post reply on HN
Print view View original

31–40 of 71 posts

Re: Tougher rules for sellers of internet-enabled devices in the UK

#31

Post by rcxdude »

leoedin wrote: post #30

The law itself says very little about what products do - it works similarly to other laws around machines and devices, where the heavy lifting is relegated to industry accepted standards. This is how CE marking (and the somewhat stalled UKCA mark) works - the law says you have to show that your device complies with industry standards, you produce a bunch of documentation showing this, you can give it a CE mark. It's…

I think the law itself only mandates a very small section of that standard: more or less 'no common default passwords' and 'have a means of reporting security bugs'.

Re: Tougher rules for sellers of internet-enabled devices in the UK

#32

Post by gnfargbl »

askvictor wrote: post #4

We had to recently look at this as we sell our product in the UK. The rules are really quite pissweak. From the article: * that password procedures are more secure, including ensuring any set by the manufacturer are not left blank or using easy-to-guess choices like "12345" or "admin" Reasonable. But that's a _really_ low bar. * that there is clarity around how to report "bugs" or security problems that arise i.e. an…

> The rules are really quite pissweak.

Ah, but you need to look at how the UK government has implemented this [1].

The law itself is the Product Security and Telecommunications Infrastructure Act 2022. That law makes reference to "security requirements" with which manufacturers must comply. Importantly however, the actual security requirements aren't specified in the Act itself. Instead, they're specified as regulations set by the Secretary of State. As I understand it, regulations are easier to update than acts, and here the government is actually obliged to review the suitability of the regulations at least every five years [2].

In theory this allows the government to apply salami tactics: start with some regulations (the 2023 version) which are indeed so weak that no manufacturer could have reasonably objected to them, but then to add more requirements over time, hopefully ending up at a point where we have some more impactful requirements placed on this stuff. Whether the government actually does that, and over what timescales, remains to be seen.

[1] https://www.gov.uk/government/publications/the-uk-product-se...

[2] https://www.legislation.gov.uk/uksi/2023/1007/regulation/10/...

Re: Tougher rules for sellers of internet-enabled devices in the UK

#33

Post by maccard »

irjoe wrote: post #28
immibis wrote: post #26

Earlier quoted context omitted.

It was about brown people. Always is. They aren't bothered by white immigrants.

I'm not sure that's entirely true in the UK. The Polish plumber taking British jobs is a fairly common trope in far-right discourse. I believe this is prevalent across Western Europe in general.

I think that was true 10 years ago, but now it seems to have evened off a bit. Generally speaking (in my circles and the circles I see around me with family etc) there’s an acceptance of the “polish plumber” as a hard working person getting by these days.

Re: Tougher rules for sellers of internet-enabled devices in the UK

#34

Post by gnfargbl »

petepete wrote: post #2

While this move is clearly sensible the number of people importing absolute junk from Temu/AliExpress/Shein means millions of homes will be exploitable regardless.

> Most smart devices are manufactured outside the UK, but the PSTI act also applies to all organisations importing or retailing products for the UK market. Failure to comply with the act is a criminal offence, with fines up to £10 million or 4% of qualifying worldwide revenue (whichever is higher).

-- https://www.ncsc.gov.uk/blog-post/smart-devices-law

Will the government actually go after AliExpress/Shein/Temu? Dunno, but they have the option.

Re: Tougher rules for sellers of internet-enabled devices in the UK

#35

Post by Dalewyn »

hyperman1 wrote: post #17
petepete wrote: post #2

While this move is clearly sensible the number of people importing absolute junk from Temu/AliExpress/Shein means millions of homes will be exploitable regardless.

I regularly see the same product on AliExpress and in cheap EU shops. Most Ali things have a CE mark. Most of my electronics has an FCC mark, even if it means nothing here. (I presume USA inhabitants see CE marks?) Globalization means it's cheaper to make 1 product, compliant with US and EU, then sell it from AliExpress too. This is exactly what the EU is counting on.

As far as Suspicious Chinese(tm) goods are concerned, I always just assume any claimed certifications are fake with no citable basis.

Re: Tougher rules for sellers of internet-enabled devices in the UK

#36

Post by jkaplowitz »

irjoe wrote: post #28
immibis wrote: post #26

Earlier quoted context omitted.

It was about brown people. Always is. They aren't bothered by white immigrants.

I'm not sure that's entirely true in the UK. The Polish plumber taking British jobs is a fairly common trope in far-right discourse. I believe this is prevalent across Western Europe in general.

I’m not convinced that the adherents of the UK and Western European far-right count Polish people as white, despite the typical Polish skin color. This is like how Italian and Irish people were often not considered white in the late 19th and early 20th century in the US, and probably in the UK too although I’m less familiar with that.

Re: Tougher rules for sellers of internet-enabled devices in the UK

#37

Post by planede »

immibis wrote: post #26
switch007 wrote: post #20

Earlier quoted context omitted.

It was 95%* about immigration so none of those arguments mattered * number pulled from my behind. But it was surely very high

It was about brown people. Always is. They aren't bothered by white immigrants.

I would think that the majority of immigrants that are not white are also not from the EU, but I don't know that statistics.

Re: Tougher rules for sellers of internet-enabled devices in the UK

#38

Post by globular-toast »

pjc50 wrote: post #12
petepete wrote: post #2

While this move is clearly sensible the number of people importing absolute junk from Temu/AliExpress/Shein means millions of homes will be exploitable regardless.

Much of the time the Aliexpress products provide the same functionality for far less than Western brands. Sometimes even a bit more functionality. But I'm still a bit wary of mains-connected ones.

> But I'm still a bit wary of mains-connected ones.

That is wise. YouTubers like BigClive regularly tear down Chinese products and you can bet on things like unconnected earth wires and poor separation between high/low voltage parts. Anything that plugs into mains should come from a known manufacturer and a reputable dealer (not Amazon, AliExpress etc.)

Re: Tougher rules for sellers of internet-enabled devices in the UK

#40

Post by matt-p »

askvictor wrote: post #4

We had to recently look at this as we sell our product in the UK. The rules are really quite pissweak. From the article: * that password procedures are more secure, including ensuring any set by the manufacturer are not left blank or using easy-to-guess choices like "12345" or "admin" Reasonable. But that's a _really_ low bar. * that there is clarity around how to report "bugs" or security problems that arise i.e. an…

This is V0, the actual requirements are regulations, which can be updated really easily. Much easier to pass a law with very basic requirements and increase them later.

This is much better than nothing, which is what most countries have.

Post reply on HN