Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates • Hacker News Board

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#401

Post by prognu » Tue, Sep 05, 2023, 6:32 PM UTC

parentheses wrote: post #146

prognu wrote: post #32

Simple. Give the manufacturers the choice: either they must provide full (FLOSS) source code and documentation (full schematics) to the user to enable them to maintain, patch and thus secure their devices (see also: right to repair), OR they are liable for all damages (direct, indirect) for a 30 year expected lifetime that arise from security issues with the device AND must have insurance to cover those damages (so t…

30 years of expected support is pretty unreasonable. Stating a requirement like this makes the discussion about competing dogmas. Rather, it's about the right way to keep devices operational as long as possible while also allowing companies to remain possible. 30 years of support expectations immediately makes the cost of any device go up to hedge against the risk of fines during the entire 30 years. It also makes it…

Sorry, but some people will run routers (and other IoT devices) for > 10 years, and long past some random 2 year EOL a manufacturer may set. We need less e-waste, and if manufacturers have to warrant security for 30 years, they may also invest enough to make the hardware itself last longer. More expensive is totally fine if the product is useful for longer! Oh, and please double-check if you really have no 1st generation Raspberry PI anywhere, or maybe some ancient Arduino? What about your washer? Modern washers are IoT devices. My (admittedly not yet IoT washer) is > 10 years old. Or take your car. Sure, you may buy a new one every 10 years, but there are plenty of cars > 10 years on the road. Do you want all of them to be vulnerable and out of warranty in the future?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#402

Post by geuis » Tue, Sep 05, 2023, 6:33 PM UTC

Your solution is a sticker? Seriously?

It does absolutely nothing. It will simply be ignored. At most it will be an excuse for manufacturers to increase the price of a product simply because it has some "FCC APPROVED" sticker, while not costing any more to manufacture.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#403

Post by meltyness » Tue, Sep 05, 2023, 6:33 PM UTC

When are you going to rip out the Lazy Susan that manufacturers use to EoL equipment on an unbelievably aggressive timeline and force governments, agencies, and state universities to throw away perfectly good equipment that is no longer "supported"?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#404

Post by SimingtonFCC » Tue, Sep 05, 2023, 6:34 PM UTC

realo wrote: post #75

What about industrial IoT? Even if a manufacturer publishes updates, the clients would likely not want to change anything, often. If you have a plant with 1,000 units of gizmo-A and update them during a week-end and now 200 of them do not do the thing they used to do anymore... you have a big problem. There is a genuine fear to update anything in many industries and I am not sure how this can be overcome.

Comments against push updates and highlighting industrial applications would be a very important part of record development. I would expect industrial buyers to have very different needs from commodity consumer hardware buyers and it would be great if they (and their vendors) were represented on the record!

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#405

Post by dmurray » Tue, Sep 05, 2023, 6:35 PM UTC

rollcat wrote: post #228

tkfu wrote: post #93

One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter. Th…

> There are also often practical issues related to security patching embedded devices: for example, a downstream supplier's driver can make it impossible to upgrade a kernel unless/until the supplier provides a fix. Of course, strong regulation here could help to drive bad practices like that out of the industry, but I'm not going to hold my breath on that one. The effect of regulation like this would make it harder…

Under sensible regulation you wouldn't get to blame a third party here. You would have signed a contract with your vendor to give you updates in line with what the regulation demands, and your insurance company would cover your liability if the vendor goes out of business and you have to pay through the nose to replace them or settle a class action lawsuit. Your expenses would go up and those would be passed on to the consumer, but everyone cheering for this regulation is OK with that. Hopefully the marginal cost of insurance and better vendors would be only slightly above the cost of providing this kind of long term support.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#406

Post by autoexec » Tue, Sep 05, 2023, 6:35 PM UTC

landemva wrote: post #394

autoexec wrote: post #381

Earlier quoted context omitted.

> These regulations put us on the path of trusting religious-like in government. We don't need to have religious-like faith in government because we can vote for people who will do what we want them to and we can vote out the people who refuse to do their job. It doesn't happen without the people getting involved and holding their government accountable though. You don't have to pray when you can vote. Without regula…

How well did that work for bank oversight in 2008, and again in 2023 with SVB? The accountability of "my one vote will remove government's failed regulators" fails on the scale of $billions.

Your examples are situations were deregulation/lack of regulation caused problems. Without regulations, prayer didn't work out so well. We all know IoT security is a problem, but after decades of that problem existing prayer hasn't worked there either. No one person's vote can fix government but collectively we have the option to enact change. I'll take having the ability to make changes over being powerless to make changes every time.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#407

Post by SimingtonFCC » Tue, Sep 05, 2023, 6:35 PM UTC

numpad0 wrote: post #399

Kim_Bruning wrote: post #246

Earlier quoted context omitted.

I'm not sure it should be overcome. Updating software is not a panacea and not always the best thing to do. In industrial hardware it's often better to have a known quantity. Especially with equipment that can cause damage or even kill people. Even if it isn't quite that high stakes, dealing with constant random updates is a cost factor with no clear commercial gain. This doesn't mean there can't be updates, but they…

Yeah, I don't operate software controlled heavy machineries, but it's not comforting when I update a physically moving machine and it makes different sounds than before due to altered algorithms and parameters. Also, it's not considered a huge issue in smartphones and laptop computers, but updating firmware on Flash ROM degrades its performance such as data retention periods. Firmware updates are not always a rocket…

Flash ROM comment noted. It would be bad if getting a label required a manufacturer to do something objectively anti-user.

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#408

Post by fuddle » Tue, Sep 05, 2023, 6:38 PM UTC

Marco Peraza, Not related to regulation of IoT security updates but since this is an AMA. How did you transition from software engineer into a cybersecurity lawyer?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#409

Post by thfuran » Tue, Sep 05, 2023, 6:38 PM UTC

avsteele wrote: post #393

I think this is a bad idea which will lead to fewer and more expensive devices. I do not want the FCC regulating this. It is much more reasonable to have the market impose some discipline on manufacturers and their level of support. Plenty of consumers would favor less costly, less-supported devices.

Are you in favor of seat belt and airbag requirements? What about the bans on asbestos and lead paint?

Re: Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

#410

Post by baby_souffle » Tue, Sep 05, 2023, 6:39 PM UTC

ryukoposting wrote: post #378

As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here. How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing? Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the…

> Even if the owner can't control exactly what is in an update, they absolutely MUST be able to control when an update occurs.

+1 for this at the consumer level. My oven may have a critical update, but - for right now - *nothing* is more critical than finishing dinner. I'll let the update apply the day after thanksgiving when I'm doing the dishes.

There are a few connected appliances brands that do this well: updates are broken down into two classes - "critical/security" updates and "all the other updates" - and I get to pick from "do nothing, notify, notify and download, notify, schedule/auto-apply" for both channels. Unfortunately this is not common because it takes planning and more than the bare minimum to pull off.