Slashdot Mirror

← Back to Stories (view on slashdot.org)

Schneier: We Need a New Agency For IoT Security (onthewire.io)

Posted by msmash on from the need-of-the-hour dept.

Reader Trailrunner7 writes: The recent DDoS attacks by the Mirai botnet against various targets, including DNS provider Dyn, have drawn the attention of congressional leaders, who say there may be a need for regulation of IoT device security in order to address the problem of vulnerable embedded devices. In a joint hearing on Wednesday, the House Subcommittee on Communications and Technology and the Subcommittee on Commerce, Manufacturing, and Trade delved into the issue of IoT security and several lawmakers said that they were reluctant to get the government involved in regulating this problem, but it may be inevitable. The problem, of course, is that many of the embedded devices that make up the IoT aren't manufactured in the United States, so regulation would have no effect on their security. Another piece of the puzzle is the fact that there's no one federal agency or independent organization that oversees security standards for IoT devices. There are embedded computers in cars, appliances, medical devices, and hundreds of other kinds of devices. That cuts across many different industries and regulatory fields, a problem that the federal government is not set up to handle. "I actually think we need a new agency. We can't have different rules if a computer makes calls, or a computer has wheels, or is in your body," said cryptographer Bruce Schneier, another witness during the hearing. "The government is getting involved here regardless, because the stakes are too high. The choice isn't between government involvement and no government involvement. It's between good government involvement and stupid government involvement. I'm not a regulatory fan but this is a world of dangerous things."

118 of 165 comments (clear)

  1. It all boils down to IPv6 security by unixisc · · Score: 3, Informative

    Say what you will about IoT, bottom line is that it would be impossible on the scale being discussed w/o IPv6. That's not something that works fluently w/ NAT, especially given that for a lot of these things, auto-configuration would be required.

    So far from any 'agency', what is required is expertise in IPv6 security. Especially how to keep IPv6 nodes either secure, and/or undetectable to anything but approved agents. This would have to work in tandem w/ access controls as well as IPv6 address management mechanisms

    1. Re:It all boils down to IPv6 security by drinkypoo · · Score: 1

      What we need are ISPs willing to shut down participants in botnets.

      The other thing we need is a mesh network to permit the internet to actually route around censorship.

      And then we're probably going to need yet another new protocol to handle that kind of chaos.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:It all boils down to IPv6 security by unixisc · · Score: 1

      Or we could just enhance IPSEC around that

    3. Re:It all boils down to IPv6 security by thegarbz · · Score: 1

      What we need are ISPs willing to shut down participants in botnets.

      And how do we do that? Was my smoke detector DoSing the ABS website when the Australian census was last due? Or was I at my computer trying to access the damn website?

      This is not a problem that is easily solved. It's difficult to tell this traffic apart from legitimate traffic. If you can route around the problem, so can the attack rendering the new node useless. A new protocol sounds like it may be able to incorporate something in this. I look forward to implementing it in 2045.

    4. Re:It all boils down to IPv6 security by unixisc · · Score: 1

      No, filtering would very much be there - to access any device on IPv6, one would have to reach it via a gateway i.e. a firewall, which has the capability to drop the packets if they're not from an authorized source. The bigger issue is there not being a globally available list of legitimate servers/nodes vs botnet agents

  2. What?! by Marsoupial · · Score: 1

    We can't have different rules if a computer makes calls or a computer is in your body? I hope there are different rules. More generally it would seem that since computers are used everywhere, this new department would usurp power from every previously established regulatory body. The way this works everywhere else is that a standards body comes up with standards and they are adopted by different government agencies.

  3. DSS? by K.+S.+Kyosuke · · Score: 1

    Department of Stuff Security? Matches the other silly name...

    --
    Ezekiel 23:20
    1. Re:DSS? by Fire_Wraith · · Score: 2

      What about Department of Secure Homeland Internet Things?

  4. They should be manufactured in the United States! by Joe_Dragon · · Score: 1

    They should be manufactured in the United States!

    TRUMP TRUMP TRUMP!

  5. Or, you know, we can just not by H3lldr0p · · Score: 5, Insightful

    use this technology.

    Let's be honest. Right now, this stuff doesn't give us anything of real benefit. We don't need an internet connected thermostat. Or lights. Or fridges. Or toaster oven. Or whatever next comes up. Our skateboards reporting how many meters they've covered to some site or another. Useless! The utility of such things are near zero.

    Nifty? Yes. Neat? Yes. Useful? Not in the least. And certainly not outside the developed world.

    It's a distraction. A bad one. And if the recent mega-botnet attacks are any indication it's not good for the health of the internet either. So let's get rid of them before someone in a position of abusable power decides that they're evil and gets rid of them for us. With us doing it, it at least leaves the door open for getting it right next time. Not so certain that others would give the tinkerers a second chance on something like this. I've already had to deal with parents panicking over their children's laptop cameras.

    That wasn't a fun conversation in the least.

    1. Re:Or, you know, we can just not by aaarrrgggh · · Score: 1

      The problem is you have no way of knowing if the devices are "secure" without very advanced knowledge. Consumer level DPI helps to a degree, but you need dedicated monitoring systems too. Pretending it is secure because it is "in the cloud" is pure ignorance, and frankly the point of the issue. By being in the cloud, the prospects of a hack mean that they don't just get one device, they can get thousands. While I might think I deserve an A-/B+ for networking knowledge, IPv6 is still pretty hard for me. That means it is entirely beyond the grasp of 99.9% of the people out there. There needs to be a way to improve this picture.

    2. Re:Or, you know, we can just not by tlhIngan · · Score: 1, Flamebait

      use this technology.

      Let's be honest. Right now, this stuff doesn't give us anything of real benefit. We don't need an internet connected thermostat. Or lights. Or fridges. Or toaster oven. Or whatever next comes up. Our skateboards reporting how many meters they've covered to some site or another. Useless! The utility of such things are near zero.

      Nifty? Yes. Neat? Yes. Useful? Not in the least. And certainly not outside the developed world.

      It's a distraction. A bad one. And if the recent mega-botnet attacks are any indication it's not good for the health of the internet either. So let's get rid of them before someone in a position of abusable power decides that they're evil and gets rid of them for us. With us doing it, it at least leaves the door open for getting it right next time. Not so certain that others would give the tinkerers a second chance on something like this. I've already had to deal with parents panicking over their children's laptop cameras.

      That wasn't a fun conversation in the least.

      Just because YOU don't see a need doesn't mean it isn't useful. In fact, you omitted the most useful IoT devices out there, interestingly enough.

      IP cameras and DVRs. These have real uses and real benefits to users - checking up on the house or business. Often times we'd get an alert from the alarm company and instead of having to driving down to the office to check it out, we can look at the surveillance video OVER THE INTERNET, and see it was just an employee working late who used the wrong door. Heck, most good sysadmins have remote access to their environmental monitors in the data center and can remotely check stuff out for the same reason

      Oh, and you know what devices were most vulnerable in the DYN attack? IP cameras and DVRs.

      Internet controlled thermostats are nifty, and it's nice to be able to go on vacation, turn the A/C to just keep it from broiling, and then on the return, turn on the A/C to bring it back from desert day to human comfort. (Same goes with heat, too). Sure it's not a necessity, but it's a nicety

      Then there's the door minders that let you know when someone is at the door when you're at the office, and you can let them put your packages in the garage rather than sitting on the front stoop inviting theft.

    3. Re:Or, you know, we can just not by mink · · Score: 1

      I require any device wanting to access my security system or other items I might want to monitor to be in my network via VPN.

      --
      Well I've wrestled with reality for thirty five years doctor, and I'm happy to say I finally won out over it.
    4. Re:Or, you know, we can just not by AmiMoJo · · Score: 1

      You are only seeing the consumer side. On the infrastructure and business side, IoT is huge. From asset tracking, to remote metering (why send people round to read every meter in the country when they can just self report once a month?) to monitoring applications (how much stress is that bridge under, are all my street light bulbs working?) there are many very useful, practical applications for IoT devices.

      And that's where the real risk is. Fridge botnets are one thing, taking out infrastructure is another.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  6. Re:The course is clear by lgw · · Score: 5, Insightful

    The choice isn't between government involvement and no government involvement. It's between good government involvement and stupid government involvement.

    The people have spoken. The desire for stupid government is strong. Stupid government involvement is the only allowable course.

    The right answer here is a non-governmental agency like UL. That can have greater reach (and, frankly, more credibility) than anything US government-specific. This would have to be coupled with a firm stance from the sever side of IOT (like AWS) requiring the certification.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  7. We don't need an 'agency', I'll TELL what we need: by Rick+Schumann · · Score: 2

    Short answer: We need manufacturers of so-called 'Internet of Things' to get their HEADS out of their ASSES and stop skimping on (or skipping altogether!) security of their gods-be-damned devices! It would also be nice if they didn't make every damned thing to use 'the cloud' or otherwise require connection to one of their damned servers in order to work AT ALL.

  8. Wrong by Hognoxious · · Score: 4, Insightful

    We totally don't. Just fuck off already.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    1. Re:Wrong by 110010001000 · · Score: 1

      100% correct. But that is where we are headed. Enjoy your locked down Internet, people! You deserve it.

    2. Re:Wrong by rectalfeeding · · Score: 1

      100% correct. But that is where we are headed. Enjoy your locked down Internet, people! You deserve it.

      No, it's more like "if the government outlaws guns, only the outlaws will have guns". The DDoS zombie masters will route around the damage. Those people already spent way more IQ point-hours on the subject than the government ever will.

      Let me be the first to predict- that fairly shortly after any such agency claims to have a policy that will 'fix' the IoT problems, we will see the exact same problems bubble up. Then we will see a cat and mouse game that, if my speculation is correct, will make this new hypothetical government agency the butt of many jokes.

  9. You know which answer is nearly always wrong? by SecurityGuy · · Score: 1

    I really like Schneier's work in general, but if there's one answer that has to be nearly always wrong it's "We need a new government agency."

    It's also patently false that because a thing isn't manufactured here, we can't regulate it. We can (and do) regulate the import of things that aren't manufactured here. If he's talking about regulating things that are manufactured, sold, and used elsewhere but also happen to be on the internet, then we just shouldn't be doing that at all anyway.

  10. Another way by MobyDisk · · Score: 5, Insightful

    Most electronics in the United States are (Underwriters Laboratory) UL approved. That is because there are various non-governmental rules that strongly influence people into buying UL approved products. One is that vendors often refuse to stock products that are not approved by some standards body, because otherwise they may face liability for the product. Another is that homeowners insurance will not cover you if a non-UL approved device started the fire. Hospitals and laboratories will not buy medical devices that are not UL approved.

    We need something like UL for security.

    It would be great to have a system like that in place, rather than to have the government directly involved. The toughest part is that so much electronics is purchased online, from overseas manufacturers, that this free-market solution may not work. Really, the free market is optimizing around it. It would be awesome to see Amazon and Newegg refuse to sell products unless they had some kind of security approval.

    1. Re:Another way by Anonymous Coward · · Score: 1

      And these days UL requirements (generally needed in the U.S.A.) and CE requirements (definitely needed in Europe) mostly line up!
      This highlights another potential pitfall, but also goes to show that both the government and private-industry routes have been pretty successful.

      I'd lean towards a government approach in this case though (and we have examples of this like Energy Star certification) because there's not the same private incentive. You don't want an insurance claim denied because a non-UL device caught fire and burned down your house, but if your insecure IoT device is one out of millions that are part of a botnet you're not going to be impacted in any meaningful way. So getting some kind of incentive to have devices certified seems like it will be difficult.

    2. Re:Another way by argStyopa · · Score: 1

      "this free-market solution may not work"

      If not, then it's not that important, really.

      I admit, I'd pay extra for devices I KNEW had been tested; the problem is what is a "successful test"? I mean, obviously the mfg are going to game around it. Besides that, what about devices that legitimately need to phone home? For example that stupid IoT thermostat that was connected to some Google server. Stupid design, yes. "Failure" (assuming it's not sending personal data) ?

      Clippy: "Oh, I see you're on a test bench with no internet access, then don't phone home for 37 days"

      --
      -Styopa
    3. Re:Another way by MobyDisk · · Score: 1

      So getting some kind of incentive to have devices certified seems like it will be difficult.

      Agreed! So to make this work, we need liability.

      So how about this: if your device is part of a botnet, or infects another computer - you are liable unless the device was certified by the testing agency. Hmmmm...no, that won't work. The problem there is finding out the source. If there is a DDOS from 5 million devices, nobody is going to sue 5 million people.

      So how about this: Hold manufacturer liable. We've been asking for companies (banks, etc.) to be liable for security breaches, and for software companies to be liable for making totally insecure software. So applying such thinking to IOT devices makes prefect sense.

    4. Re:Another way by MobyDisk · · Score: 1

      the problem is what is a "successful test"?

      That is what the 3rd-party testing lab determines. It's not up to the manufacturer to test it.

      what about devices that legitimately need to phone home

      The testing agency should not have a problem with a device that needed to phone home. That's a legitimate feature. The testing agency would make sure that the data was encrypted, that failed pasword attempts are limited, that there isn't a single shared password on each device, etc.

      For example that stupid IoT thermostat

      Yes!!! That's what we are trying to prevent! It had no encryption, send the user's personal information (email account, password, wifi SSID, wifi password). It had no limit to the number of password attempts. This is really low-hanging fruit that any testing would have uncovered.

    5. Re:Another way by 110010001000 · · Score: 1

      So Dell is liable because your Dell computer got infected and is part of a botnet? It only makes sense to you because you are an idiot. There is no difference between an "IOT device" and a Linux or Windows computer you install software on.

    6. Re:Another way by MobyDisk · · Score: 1

      So Dell is liable because your Dell computer got infected and is part of a botnet?

      If Dell installed an insecure piece of software on it, then yes, they can be.

      It only makes sense to you because you are an idiot.

      LOL, nice burn dawg.

      There is no difference between an "IOT device" and a Linux or Windows computer you install software on.

      One key difference is: who installed the vulnerable software and firmware onto the device? With a Dell Laptop, the owner can install whatever they want on it, so *maybe* it was the owner's fault not the manufacturer's. With a Frigidaire refrigerator, or a Honeywell thermostat, or an XBOX 360, or a Shenzhen-Guowei security camera, the owner probably can't install software on it. That's a crucial difference. With the laptop, one could argue that it is my fault because I installed the virus. But if my refrigerator gets infected because the manufacturer's firmware allowed anyone to remote into it, that is definitely the manufacturer's fault.

  11. I warned you by 110010001000 · · Score: 1

    I warned everyone years ago that we were coming to a time when only GOVERNMENT APPROVED devices would be allowed to connect to the Internet. Everyone scoffed, but this is the first step. Truly the end of personal computing is coming, fast.

  12. Re:We don't need an 'agency', I'll TELL what we ne by DarkOx · · Score: 1

    Short answer is we need to hold people accountable. This is a case where there absolutely should be not quite a strict liability situation but maybe negligence level where you are responsible for shit that a computer you own does unless you can show you took appropriate and reasonable precautions.

    Once that is True people will install patches, they will learn to install and configure firewalls, or they will turn the shit off and unplug the Ethernet wire from the smart tv because its to much hassle to deal with.

    Once that happens people will stop buying shit for the manufacturers who A) don't bother with security and B) abandon products well inside their useful lives. Nobody is going to want drop 1K on a fancy TV and then be afraid to use it lest they get sued or prosecuted because it became a bot and they had no idea.

    --
    Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
  13. Does Not Have to be Government by Tokolosh · · Score: 2

    Government involvement is not needed and will be counterproductive. Something like UL (https://en.wikipedia.org/wiki/UL_(safety_organization) ) will be appropriate. There are a number of analogous examples that work well, like the ANSI, API, ICANN, IMO.

    --
    Prove anything by multiplying Huge Number times Tiny Number
    1. Re:Does Not Have to be Government by unixisc · · Score: 1

      Actually, rather than ICANN, this sort of thing should be done by the IETF - that would fall under their 'jurisdiction', or area of both expertise and responsibility

    2. Re:Does Not Have to be Government by R3d+M3rcury · · Score: 1

      Something like UL (https://en.wikipedia.org/wiki/UL_(safety_organization) ) will be appropriate.

      I've heard this a few times. I'm not convinced.

      UL is "Underwriters' Laboratories." One of the things they do is look at electric devices and make sure that they won't catch fire in most conditions. This is a good thing and they have the backing of insurance companies. So if you plug in that extension cord that your brother made and it causes an electrical fire which burns down your house, when you go to your insurance company, they'll say, "Nope! We're not paying out because the extension cord wasn't UL certified. You're hosed. Have a nice day."

      Which is a good reason to only buy UL-certified devices. No government involvement needed, right? I can choose not to use UL-certified devices and run the risk of making my fire insurance useless. Freedom!

      Now how does this work with Internet-enabled lightbulbs? If my lightbulb gets hacked and put on a botnet which is then used to attack some company, am I responsible? Of course, I would turn around and sue the company that made the lightbulbs. Unfortunately, they just went bankrupt or they're in some foreign country where I can't really sue them. I guess I'm on the hook for a piece of the billion dollars that the company that got attacked is suing over.

      That would certainly give me some incentive to by only "approved" lightbulbs.

      The reason the UL-type system works is that I, as a consumer, have a definitely incentive to buy UL-certified device in that if I don't, and something goes wrong, I suffer. In the case of Internet Things like this, though, I don't suffer--someone else does. If someone hacks my lightbulbs to do a DDOS attack on you, I haven't really suffered that much. As the recipient, you suffered quite a bit.

      For a UL-type system to work, I have to be responsible for attacks that emanate from the devices I own.

    3. Re:Does Not Have to be Government by david_thornley · · Score: 1

      In a liability situation, why would UL help? Suppose you used UL-certified light bulbs, and they were used in a major DDoS attack. You get named in the suit, and when you try to pass the liability on back the company has disappeared or gone bankrupt or is out of the country or something. The UL isn't going to indemnify me. Lots of people will have some IoT-type devices without insurance, since (at least in the US) renter's insurance wasn't all that common when I still rented. Unless people have some sort of legal immunity for buying UL, it won't help.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    4. Re:Does Not Have to be Government by R3d+M3rcury · · Score: 1

      You miss the point. I suppose I got a bit wordy.

      Why do you buy UL-certified electric devices? Because if you use them and one of them causes your house to burn down, your fire insurance will cover you. If you use a non-UL-certified electric device and it causes your house to burn down, your fire insurance won't pay.

      Thus, I have an incentive to buy UL-certified devices. Uncle Sam does not need to get involved. This is, arguably, a good thing.

      Many people are saying that IoT devices need something akin to UL labs. The problem is that UL labs get their power from insurance companies. You don't have to buy UL-certified devices, but there's a pretty big downside to not doing so. So what is the equivalent downside to not using ICANN-certified (for example) IoT devices? At the moment, there isn't one.

  14. Re:The course is clear by Archangel+Michael · · Score: 3, Interesting

    When Government agency fails, or is wasteful, what happens? "Hey, lets toss more money at the problem"

    When Private entity fails, it goes away, and is either replaced or is no longer needed. Waste is generally frowned upon.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  15. Re:We don't need an 'agency', I'll TELL what we ne by unixisc · · Score: 1

    Security of things that can be connected to the internet can't be done until they actually are connected to the internet. How does an internet enabled home security system know whether it's being accessed by a legitimate controller or an intruding agent? This job needs to belong to the Firewall/Gateway

  16. Re:The course is clear by 110010001000 · · Score: 1

    So basically every device you connect to the Internet would need to be pre-approved by this new non-governmental agency. Even things you built yourself. So where this is headed?

  17. UL is a great model, created by insurance companie by raymorris · · Score: 1

    Something like UL, but focused on security, would be great.
    Insurance companies established Underwriters Laboratories and the National Fire Protection Association in order to reduce their costs stemming from fires, injuries, and death. I don't see an obviously similar group for information security. Google, Amazon, and Comcast would all benefit from reducing attacks, so perhaps they could found an organition similar to Underwriters Laboratories.

  18. Re:The course is clear by edittard · · Score: 4, Insightful

    When Private entity fails, it goes away

    Not if it's a bank.

    --
    At the bottom of the /. main page it says 'Yesterday's News'. Well they got that right.
  19. Re:The course is clear by viperidaenz · · Score: 2

    More like everything you want to sell to the general public should be approved.
    Anything you want to build yourself, you build it yourself as usual.

  20. Re:UL is a great model, created by insurance compa by 110010001000 · · Score: 1

    So every device that connects to the Internet would need to pre-approved by a group founded by Google, Amazon and Comcast? And you think this is a good idea?

  21. Yeah that was a dumb thing to say by raymorris · · Score: 1

    Agreed, that was a stupid comment. Of course an autonomous car, which os hurling toward me at 75 MPH, should have different standards than an IoT refrigerator, and biomedical devices implanted in my body should another set of standards. Perhaps the standards for biomedical implants could include also the standards for consumer electronics by reference - "In addition to the 60 points listed below, medical devices must also meet consumer electronics standard #1235 ".

  22. Re:The course is clear by 110010001000 · · Score: 1

    And THAT is the engame here: only locked down, pre-approved devices will be allowed to be connected to the Internet. I said that was going to happen 10 years ago, but it sounds like people are OK with it now.

  23. Operational allocation isn't a new thing by Anonymous Coward · · Score: 1

    Just like electronic devices must be certified to operate within FCC or CRTC guidelines, these kinds of products should pass through a similar system to ensure compliance. All IoT devices should also conform to some network management scheme for enumeration and auditing. This just a new twist on an old system that has worked well for some forty plus years.

  24. Re: The course is clear by ArmoredDragon · · Score: 1

    Or a major auto manufacturer.

  25. current govt = fail by sdinfoserv · · Score: 1

    And the existing government is sooo exceptional at following it's current policy and security (re: OPM ) that we need yet ANOTHER layer of confusing, cross responsibility, finger pointing bureaucracy... ya that will solve it.

  26. Re:The course is clear, mostly by davecb · · Score: 2

    Governments are predominantly good at policing things: regulation is someting of a misnomer (regulators keep voltages stable: police arrest people).

    The UL-like body need to be backed up by real police powers, like the power to have the local police seize dangerous goods, and be financially independant of the people who make the products being certified as safe to import and use.

    Ontario famously tried to get the crooks (waterworks operators) pay for the police (drinking-water inspectors). That promptly killed seven people and infected thousands in the Walkerton E Coli outbreak, so simple user-pays is not a good model.

    Probably a fixed fee for the first one licenced, paid to customs, and a tiny one per each 1000 additional devices of the same type. Then add a sampling process to make sure the manufacturer had not changed what's inside the box. Sampling is done at the retail store as well as at the border or plant. Customs pays the UL-like body, and if something is dangerous, customs and the police impound them.

    All seizures require a warrent, and the courts handle appeals against the decision to seize.

    --
    davecb@spamcop.net
  27. Re: The course is clear by dnaumov · · Score: 1

    Precisely. You don't get to operate an unapproved motor vehicle on public roads. Why should the internet be any different?

  28. Re:The course is clear by suutar · · Score: 2

    I don't see how viperidaenz's statement leads from your question to your answer. "if you're selling it get it approved; if you're not don't" doesn't read to me "keep it off the internet". How would that be enforced? It seems like it would be difficult for the rest of the internet to tell whether your device is certified...

  29. Re:We don't need an 'agency', I'll TELL what we ne by suutar · · Score: 1

    The router/gateway has a part to play too. However regardless of whether the user accessing the system is legitimate, buffers should not overflow, sql should not get injected, etc. Defense in depth.

  30. Don't Hook Crap to The Internet Unless You Need To by BrendaEM · · Score: 1

    Duh.

    --
    https://www.youtube.com/c/BrendaEM
  31. Re: The course is clear by lgw · · Score: 1

    The bar is very low for a car you build yourself though.

    Pwnt IoT devices are a problem because of scale. I'm not sure there will ever be enough hand-built "things" to matter.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  32. Re:The course is clear by 110010001000 · · Score: 1

    It is the first step. Every computer/device would now need to be pre-approved by some agency/consortium before being allowed to be put on the Internet. You would need to approve the software too of course, all of it. Because software is what is the issue, not the hardware. Are you guys not thinking clearly here? This is the intent, and this is the future. So long to the personal computer!

  33. Re: The course is clear by 110010001000 · · Score: 1

    So you are ready to make sure that EVERY software package you put on YOUR COMPUTER OR DEVICE is pre-approved by some agency? Because that is what would be required. I'm just making sure you guys are OK with that. It sounds like you are. So it is the end of personal computing as we know it.

  34. Re:The course is clear, mostly by lgw · · Score: 1

    Why? UL isn't, and fire is a more serious problem than the IoT running amok. Liability for manufacturers would sort this out, just as it did for fire safety.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  35. Re:We don't need an 'agency', I'll TELL what we ne by aaarrrgggh · · Score: 1

    Most people have trouble just putting the SSID and password in for their equipment. Talking about VLANs and firewalls is a lost cause. Then you have mischievous devices that try to use open wifi systems to at least phone home to allow remote configuration as a fallback. The only thing that works is making things secure by default, and even that is easy to screw up. Also, who are you trying to secure it from... because it is all relative.

  36. Re: The course is clear by 110010001000 · · Score: 1

    What is the difference between an IoT device and a Linux computer connected to the Internet? Nothing. You guys aren't thinking clearly.

  37. Re:They should be manufactured in the United State by Tablizer · · Score: 1

    Trump: "It'll be a Yuuuuuge agency, and we'll make the Internets pay for it!"

    --
    Table-ized A.I.
  38. Re:The course is clear by Dutch+Gun · · Score: 1

    Here's a list of 547 banks that have failed since 2000.

    Maybe it's just the ones that didn't donate enough to those in political power. You know... the ones that weren't too big to fail.

    --
    Irony: Agile development has too much intertia to be abandoned now.
  39. And this is why we can't have nice things by rickb928 · · Score: 1

    We do NOT need a 'new agency'. Indeed, perhaps, maybe, we can use legislation to establish FTC or other regulations that require Internet-connected devices be minimally secure, as in requiring a nontrivial admin password be set, that they not be susceptible to 'trivial' attacks, and that they be manageable by owners to reestablish control.

    All of this is, sadly, patchwork, and will not solve the real problems, and establishing financial penalties will just drive manufacturers offshore where we can't reach them.

    But some minimal security requirements in law may, may make it harder. And I've failed. 'Harder' is not a fix for a security issue.

    --
    deleting the extra space after periods so i can stay relevant, yeah.
    1. Re:And this is why we can't have nice things by 110010001000 · · Score: 1

      "as in requiring a nontrivial admin password be set, that they not be susceptible to 'trivial' attacks, and that they be manageable by owners to reestablish control"

      So everyone who creates software would now need to be able to prove that to a governmental agency? Or you wouldn't allow software to be installed on Internet-connected devices unless it was pre-approved? So you couldn't attach your Linux computer (or Windows or Mac) or phone or whatever to the Internet unless it was running this pre-approved software? Think about it. An "IoT" device is just a computer running software.

    2. Re: And this is why we can't have nice things by rickb928 · · Score: 1

      I was focused on the device. The software makes this possible...

      --
      deleting the extra space after periods so i can stay relevant, yeah.
  40. Re:The course is clear, mostly by davecb · · Score: 1

    Pacemakers.

    --
    davecb@spamcop.net
  41. Re: The course is clear by Hylandr · · Score: 1

    Sounds like a job the Dept of Homeland Security could handle.

    What could go wrong?

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  42. Re:They should be manufactured in the United State by Tablizer · · Score: 1

    Rats, I forgot the word "beautiful". My Trumpology slipped

    --
    Table-ized A.I.
  43. Re:The course is clear by MyFirstNameIsPaul · · Score: 1

    Let's be a little more precise: Every computer/device for sale in the United States.

    The more obvious result is that it does next to nothing to curb the issues related to security while greatly increasing the barrier to entry, plus costing the taxpayers a whole bunch of money.

    --

    I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.

  44. Re:The course is clear, mostly by lgw · · Score: 1

    Speaking of non-sequiturs.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  45. Re:The course is clear by 110010001000 · · Score: 1

    So ever computer/device for sale in the United States that is to be connected to the Internet MUST run only pre-approved software? Think about it guys: this would be the end of personal computing. I guess people don't care at this point though.

  46. Re:The course is clear by Hylandr · · Score: 1

    You wish.

    All hardware is required to be NRTL approved before it can be sold *commercially*. The buyer or builder accepts all liability

    Here's a good read on it.

    http://electronics.stackexchan...

    The problem isn't the software so much as the purchaser that rarely bothers to change default passwords or settings. Manufacturers are somewhat to blame for trying to make things as simple as possible and people are lazy.

    The bottom line here is the consumer generally has no concept of the risk and everyone operates on the attitude 'I saw it on the news so it can't *possibly* happen to me. In reality the ISP should be blocking all RFC 1918, and spoofed traffic from a subscriber.

    https://tools.ietf.org/html/rf...

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  47. Re:The course is clear by 110010001000 · · Score: 1

    "The problem isn't the software so much"
    Wrong. The problem IS THE SOFTWARE. That is what is insecure. Think about it. If you needed to prove that a system is secure you would need to certify the SOFTWARE AND HARDWARE. And you wouldn't allow new software would be installed, unless THAT was approved as well. Otherwise the system wouldn't be secure. It is really sad people are ready to trade "safety" for a walled garden. But I guess that why Apple is the richest corporation in history.

  48. Re:The course is clear by MyFirstNameIsPaul · · Score: 1

    The "follow the RFC" mantra sounds nice here in a forum, but the admins at ground zero of these issues will tell you a different story.

    --

    I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.

  49. Re:We don't need an 'agency', I'll TELL what we ne by 110010001000 · · Score: 1

    100% correct! Someone gets it...

  50. Re: The course is clear by MyFirstNameIsPaul · · Score: 1

    Because the Internet is a "road" that connects to everywhere in the world, plus satellites. Kind of changes the effectiveness of local legislation.

    --

    I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.

  51. Re:The course is clear by Hylandr · · Score: 1

    Not sure what kind of Axe you have to grind, but the weakest link is *always* the meat-Popsicle.

    Technology is easy. It can be automated and made ubiquitous. It's the person that has to be able to understand and use it with about an 8th grade education.

    I never mentioned Apple, but they do a fantastic job of catering to the least educated and most educated denominator equally. Really impressive actually even if I do hate and refuse to use their products. Mostly because I refuse to accept vendor lock-in.

    Good luck with your cause there.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  52. Re:The course is clear by Hylandr · · Score: 1

    Lets hear those stories.

    If it increases understanding of the issue, lets have it!

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  53. Re:The course is clear by MyFirstNameIsPaul · · Score: 1

    So find one and ask away.

    --

    I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.

  54. Re:The course is clear by toonces33 · · Score: 1

    Brawndo has got what IoT needs.

  55. Seed money, not day-to-day operations. Openstack e by raymorris · · Score: 1

    If there were an organization similar to UL, but testing for safety and security of IT products, it's value would depend on what the group DID, not who provided the initial funding.

    Note again I didn't say these companies would test and approve products. Rather, they have an interest in having the internet secure for everyone, so they might put up some cash to seed an independent testing organization. (Example: IoT ddos attacks flow through Comcast's network, costing them money.

    History shows that they can and do produce valuable, open standards when they work together and agree. See for example OpenStack.

    Would every device be *required* to be tested and certified? No, requirements, forcing people to do things, is the domain of governments. People choose to buy UL listed products because UL has earned their trust. Corporations additionally use UL listed and certified products because they know choosing otherwise is intentionally choosing products that may not be safe - exposing them to liability. People would choose routers, ip cameras, and IoT thermostats certified by Internet Laboratories only if IL earned their trust, like UL has.

  56. Re:The course is clear by anon+mouse-cow-aard · · Score: 1
    The issue isn't government vs. private, it's an issue of monopolies/oligopoly. In a lot of cases, government services have no "competition" because, frankly, there is no money to be made. competition is good, it brings focus.

    When a public service fails, and there are private alternatives, it is compared to them and eventually de-funded.

    When a private oligopoly fails, or is wasteful, what happens? "We'll just raise prices" ...

    Hello PSTN & Cable Co's. I

  57. Re:Don't Hook Crap to The Internet Unless You Need by toonces33 · · Score: 1

    The problem is this though. The people that are attaching these devices are largely unaffected by this. They got some cheap device of some sort that at least somewhat does what the purchaser wants, and their own device isn't attacking their own machines.

    And the manufacturers don't care either. And even if they did, what are the chances that they would have any amount of success getting people to upgrade firmware?

  58. Re:The course is clear by 110010001000 · · Score: 1

    I guess you don't get it. The idea is to increase the security of "IoT" devices by requiring approval from some agency before the device could be sol and connected to the Internet.. How would you do that? You would need to certify the hardware and the software of the device and make sure it is locked down so no modifications could be made to the device to make it insecure. What is an "IoT" device? It is a computer. You figure out the rest.

  59. Re:Seed money, not day-to-day operations. Openstac by 110010001000 · · Score: 1

    Requirements aren't only the domain of governments. So the next step is that every device that connects to Comcasts network must be approved by this "organization similar to the UL", or they won't allow it on. And you can't make any unapproved changes to that device, because any change might make it insecure. It is only logical after all. Are you guys really that dense? What do you think is happening here? At some point you will be only allowed to use a locked down computer running pre-approved software running in the cloud. Don't think it will happen? That is the logical conclusion to this madness.

  60. Re:The course is clear by Hylandr · · Score: 1

    There's a quick and easy answer to that.

    "Oh HELL no."

    If you haven't noticed, there is a very large segment of consumers that go out of their way to find hardware that's customizable, and you cannot legislate that away unless you're a Govt agency in North Korea.

    Keep your fingers out of my hardware Tyvm.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  61. Re:The course is clear by 110010001000 · · Score: 1

    You can "legislate it" if Verizon/Comcast/ATT all required that only "approved" devices are allowed on their network. Most corporations do that already for their internal networks (if they are concerned about security). You don't think that can happen? It will eventually. It sounds like most people here are OK with it too.

  62. Re:The course is clear by Archangel+Michael · · Score: 2

    Well, IMHO (being a Libertarian) I would have let the banks fail. Additionally, I would have locked up the CxO of banks that were practicing fraud, or otherwise weren't doing their do diligence in protecting the assets under their leadership. Heck, I would also go after the Board of Directors.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  63. Re:The course is clear by Hylandr · · Score: 1

    This goes back to that conversation about 3 strikes and ISP's not willing to cut off their customer base and risk going out of business.

    Not going to happen.

    Toodles. It's been fun.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  64. How to fix this without big gov by AHuxley · · Score: 1

    1. Get anti virus software, free and subscription to scan a users networks by default. Find every device and test them with common pw/usernames and see what fails.
    Report that to the user and tell them to replace or update the device until it is safe on any network facing the internet.
    2. Ban the branded control software from cell phone and all app stores. If your device can be used as part of a swarm, its app gets banned and the world told why a brand cant be trusted.
    3. Work with isp. A IoT device broadcasting to an ip with all bandwidth 24/7 on a strange port is worth an automated email to that account.
    Most home user accounts should not be running networks 24/7 pushing data up.
    4. Educate the next generation of designers about crypto, passwords, user gui's to ensure set up is easy and results in a secure network connection.
    5. Name the brands design teams that fail. Promote good brands with really great staff who can code and design to a good standard and keep devices updated.
    6.. Talk to insurance companies. When a policy is offered, have a chat about good anti virus for the computer to scan and secure the IoT in the home.
    7. Create an open website with short video jargon filled clips that show the errors in many of the chips and hardware that caused the IoT issues.
    Is it a chip issues, factory issue, design policy or app and software issue. Educate the designers and developers with fun video clips on what can be done better.
    Find and support the good hardware. The good software and apps. The teams that offered great encryption and support that secure their devices.
    Find the hardware that works and make sure developers globally know about it.

    --
    Domestic spying is now "Benign Information Gathering"
    1. Re:How to fix this without big gov by AHuxley · · Score: 1

      Hi AC, the US seems to want it both ways.
      "CIA Chief: We’ll Spy on You Through Your Dishwasher" (03.15.12)
      https://www.wired.com/2012/03/...
      "All those new online devices are a treasure trove of data if you’re a “person of interest” to the spy community."
      All global AV brands have to do is scan with every common pw/usernames and see what fails. Get users to create their own long pw and unique usernames.
      Or make the gateway to the internet hide or mask what the user is running.

      --
      Domestic spying is now "Benign Information Gathering"
  65. Re:They should be manufactured in the United State by Bing+Tsher+E · · Score: 1

    Hillary: "Can't we just wipe it with a cloth?"

  66. Re: The course is clear by Bing+Tsher+E · · Score: 1

    Further, what's the difference between an IoT device and a $2 8-bit embedded controller that I can push some form of an IP Stack onto? Will it be illegal to plug said controller onto a network? Which network will be illegal?

  67. Re: The course is clear by lgw · · Score: 1

    It all depends on where it's enforced. My suggestion was for the IoT cloud backends to enforce this. IoT-specific that way.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  68. Re:Seed money, not day-to-day operations. Openstac by MobyDisk · · Score: 1

    So the next step is that every device that connects to Comcasts network must be approved by this "organization similar to the UL", or they won't allow it on

    Almost. We are proposing something similar to how it works with electrical devices and telecommunications devices. In those cases, it isn't the power company or the phone company that gets a say, it is the insurance companies and retailers. So no: Comcast would not be able to approve things. They simply have no way to enforce this even if they wanted to.

    And you can't make any unapproved changes to that device, because any change might make it insecure. It is only logical after all.

    No, that is not logical, and it is not how the industry we are comparing it to works.

    At some point you will be only allowed to use a locked down computer running pre-approved software running in the cloud. Don't think it will happen? That is the logical conclusion to this madness.

    If that is the logical conclusion, then why has it not happened already? This is how communications devices and electrical devices work in the at least the US and Europe. Yet people are still allowed to tinker with those devices. Perhaps this is the point of confusion: Your computer is *already* approved by a national testing agency today. Pretty much anything that plugs into a power plug is. All we are saying is that those organizations should also do security testing as well.

  69. past tense by rectalfeeding · · Score: 1

    You can "legislate it" if Verizon/Comcast/ATT all required that only "approved" devices are allowed on their network. Most corporations do that already for their internal networks (if they are concerned about security). You don't think that can happen? It will eventually. It sounds like most people here are OK with it too.

    Read your Verizon/Comcast/ATT terms of service and acceptable use policies. This is already in place. Sure it blatantly contradicts all the flowery language the FCC uses to talk about network neutrality. Oh well, whatever.

    1. Re:past tense by Obfuscant · · Score: 1

      Read your Verizon/Comcast/ATT terms of service and acceptable use policies. This is already in place.

      I see no such terms of service in my Comcast agreement. Can you provide a citation that supports your claim? I am not sure how Comcast could detect unapproved equipment I connect to the network anyway. Once it hits the router/modem and gets NAT, it's all the same MAC and IP address.

    2. Re:past tense by rectalfeeding · · Score: 1

      Read your Verizon/Comcast/ATT terms of service and acceptable use policies. This is already in place.

      I see no such terms of service in my Comcast agreement. Can you provide a citation that supports your claim? I am not sure how Comcast could detect unapproved equipment I connect to the network anyway. Once it hits the router/modem and gets NAT, it's all the same MAC and IP address.

      This sounds relevant- (found via comcast.com, clicking under the mindset of an internet subscriber looking for the ToS/AUP, correct me if you think it is not applicable. emphasis added by me)-

      http://networkmanagement.xfini...

      "These rules pertain to the attachment of devices to our High-Speed Internet network by customers. You can find information concerning the devices approved for use on the network, and the tiers of our service that they are appropriate for at http://mydeviceinfo.comcast.ne..."

    3. Re:past tense by rectalfeeding · · Score: 1

      I am not sure how Comcast could detect unapproved equipment I connect to the network anyway. Once it hits the router/modem and gets NAT, it's all the same MAC and IP address.

      It seems my quote above wasn't entirely applicable as it seems to be about cable modems. However the rest of their ToS/AUP seems to go far enough out of its way to avoid consideration of a home email or web server, that my general feeling hasn't changed. I admit, that Comcast may actually be one of the better ISPs in this regard. My including them in a list was 100% due to quoting the parent comment I replied to.

      That said, I just did take a look, and here is the actual relevant citation under the "Technical Restrictions" of the internet service AUP-

      use or run dedicated, stand-alone equipment or servers from the Premises that provide network content or any other services to anyone outside of your Premises local area network (“Premises LAN”), also commonly referred to as public services or servers. Examples of prohibited equipment and servers include, but are not limited to, email, web hosting, file sharing, and proxy services and servers;

      http://www.xfinity.com/Corpora...

      f34db7369ef535e9442 ec6e828e2356087bf47 b0c2a4202d56de7c70d 4744615b306a53b3799 57c2926f1809d938fab5 450767a578384a083b3 71584e6f24ee3 Acceptable-Use-Policy-forXFINITY-Internet-effective-November-1-2016-ENG.pdf

    4. Re:past tense by Obfuscant · · Score: 1

      It seems my quote above wasn't entirely applicable as it seems to be about cable modems.

      Since the cable modem is the gateway from the home network onto the cable side, I think it's relevant that Comcast needs to approve any devices that attach to THEIR network. Wouldn't it be wonderful if someone was selling cable modems that corrupted the network data for everyone else on that branch? I wouldn't mind a cable modem that I can put into promiscuous mode on the WAN so I can sniff all my neighbor's traffic, but I'd hate to have that same thing accessible to them. This isn't limitation on what devices you can connect on your home network.

      Examples of prohibited equipment and servers include, but are not limited to, email, web hosting, file sharing, and proxy services and servers;

      That's talking about what SERVICES you, as a RESIDENTIAL customer, paying residential rates, may provide to others. It doesn't limit the hardware, only some of the software that can run on it. And it only limits that software when services are provided outside your own home. I have several devices that have web interfaces, and half a dozen file servers.

      They're selling you residential service. If you want to be a commercial provider, you can buy business service and run the servers you want for the pubic.

  70. Re:The course is clear by 110010001000 · · Score: 1

    Famous last words. Oh by the way, 3 strikes is already in place (6 strikes in the US) and being enforced. What an idiot.

  71. Re: The course is clear by 110010001000 · · Score: 1

    Exactly. Unfortunately people here are too shortsighted to recognize this. There is no difference between "IoT" devices and their laptop from a network perspective.

  72. Re: The course is clear by 110010001000 · · Score: 1

    There is no "IoT cloud backends". They are just server computers like any other cloud. There is no difference between an "IoT" device and your computer.

  73. Re:Seed money, not day-to-day operations. Openstac by 110010001000 · · Score: 1

    "They simply have no way to enforce this even if they wanted to." Um, sure they can. Corporate networks already do this.
    "All we are saying is that those organizations should also do security testing as well"
    So some national testing organization is going to test every device that connect to the Internet? And then the device cannot run new software (after all, new software may make it insecure). Really I have a hard time believing people are so stupid here.

  74. Re: The course is clear by lgw · · Score: 1

    Yes, there really are. https://aws.amazon.com/iot/ https://www.microsoft.com/en-u...

    Just throwing some servers up doesn't scale to a billion devices. A secure connection is a very difficult process on a low-end "thing". There's lots of specialist problems still being solved.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  75. Re: The course is clear by 110010001000 · · Score: 1

    Uh, no one has a billion IoT devices. Most IoT "clouds" are a couple of servers in China. The point is there is no difference between "IoT" and your Linux computer. Most "IoT" things are just Linux computers.

  76. Re:The course is clear by Obfuscant · · Score: 2, Insightful
    And in the perfect libertarian world there wouldn't have been the Community Reinvestment Act and similar follow-on legislation that forced banks to make unsecurable loans to people they knew couldn't pay them back, creating a market for bad paper, culminating in a large number of defaults when people who couldn't pay back their loans were faced with balloon payments that they knew from the start they wouldn't be able to meet but they signed up for anyway. So yeah, in this ideal world, I'd go along with the libertarian "lock them up if they commit fraud" idea.

    The CEOs you want to lock up for "practicing fraud", however, were acting in response to community groups using the justice department as a bludgeon to either force the loans or be sued for discrimination. If they didn't have similar percentages of approved loans over their entire service area it was defacto proof of discrimination. The fact that some neighborhoods tend to be working class with people who couldn't afford home loans wasn't relevant, so the rules had to change to allow those loans to be approved anyway. Once those loans were approved, where does the bank get money to make more loans? By selling the ones it has. "Community Reinvestment" stops when the bank has loaned out all it can, unless it sells loans to get more to loan.

    The problem of measuring compliance with anti-discrimination laws using simple statistics is ongoing. For example, it is defacto proof of Title IX violation if the percentage of girls at a school participating in sports is not the same as the percentage of boys. If you run a school where 20% of the boys are on sports teams but only 10% of the girls, then you either need to coerce a lot of girls into joining a sports team or cut your boy's teams in half.

    And similarly, if your bank is approving 50% of the loans from a neighborhood that is predominantly rich people but only 10% of loans from a poorer neighborhood, you either have to lose 2/3 of your loan business by refusing 80% of the "rich people" loans (losing out on the interest payments from well-secured, low-risk loans), or relax the rules so you can approve 40% more of the apps from poor people (increasing your risk by a large amount). And the answer is almost always based on the demands of the local community activists who want more loans to poor people.

  77. Go 1 step further; BOFH mode by knorthern+knight · · Score: 1

    > 1. Get anti virus software, free and subscription to scan a users networks by default.
    > Find every device and test them with common pw/usernames and see what fails.

    Go one step further. Have a government body scan the net and try to pwn and *BRICK* internet-connected everything (IOT/smartphones/tablets/desktop-PCs/servers). If it withstands the break-in attempts, it's secure. If it doesn't withstand the break-in attempts, it had no business being on the net in the first place.

    Before anybody starts yelling-and-screaming, compare the options...

    1) Your desktop gets pwnd and bricked. You're out several hundred dollars for a new machine, or possibly a few hundred paying a consultant to get your machine working again, and a new OS installed.

    2) Police raid your home because your machine is dispensing child-porn, under the control of a foreign bot-herder. Your home gets torn apart by the police "looking for evidence", your name gets dragged through the mud as a "child-porn distributer", and you're unemployable for the rest of your life, even if found not guilty.

    I'd take door #1. Make the consequences of having insecure stuff on the net damn expensive, and damn inconvenient. That's the only thing that'll get people's attention.

    --

    I'm not repeating myself
    I'm an X window user; I'm an ex-Windows user
  78. What's really needed.. by LesserWeevil · · Score: 1

    No, what we need is a new law requiring IOT companies to be liable for the costs of repairing the damage their devices cause, from DDOS to identity theft. Too much of this crap is flooding in and folks have no idea how dangerous it is.

  79. Re: The course is clear by lgw · · Score: 1

    They will pretty soon. What do you think the big names will need as a back end? How many Android phones are there? How many smart TVs are there? There will be 10x as many "things" in a few years, given it's a much cheaper market. Heck, Amazons goofy "dash button" is moving like crazy just for the novelty value.

    AWS and Azure are building out at massive scale now, trying to land contracts with the big names already. And security is definitely part of the pitch - the future liability risk is being taken seriously, though no one has a clear answer yet.

    The point is there's a real difference between a button to re-order Tide and a general purpose Linux computer.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  80. Re:The course is clear by thegarbz · · Score: 1

    UL? I'm glad they stopped the endless stem of fake products which can provide fatal shocks with shoddy engineering and construction. I mean they have the UL logo on them so it must be good right?

    Government regulation, or agencies such as UL won't do anything about a global problem that is caused by a race to the bottom.

  81. Re:The course is clear by currently_awake · · Score: 1

    The right answer is for the FCC to handle the security standards and practices of networked consumer electronics. If you want to sell your webcam in the USA, you must meet a list of rules: passwords, encryption, test of hackability etc.

  82. Re:The course is clear by pnutjam · · Score: 2

    Well, in a perfect world the, the government would not have created ghettos in American cities. Since the did, don't you think they should be obligated to help remove them?

    Citations that will be requested, although I'm sure they will be disregarded:
    http://www.npr.org/2015/05/14/...
    http://www.thedailybeast.com/articles/2014/03/13/how-we-built-the-ghettos.html
    http://www.theatlantic.com/business/archive/2014/05/the-racist-housing-policy-that-made-your-neighborhood/371439/

    Conservatard sources (sorry, my bias is showing, but this fact is not disputed):
    http://www.independentsentinel...
    http://www.deseretnews.com/article/865633377/How-government-policy-created-ghettos-according-to-one-historian.html?pg=all

    --
    Cheap storage VM.
  83. Re: The course is clear by pnutjam · · Score: 1

    Let's not go to the most aggressive policy. That's unlikely.

    What is more probable, is some sort of safe haven that allows ISP's to terminate connections with certain traffic, maybe a clearinghouse for requests, like the DMCA. Maybe some sort of fines.
    It's certainly subject to abuse, but not as worrisome as what your concerned about.

    --
    Cheap storage VM.
  84. Re:The course is clear by Obfuscant · · Score: 1

    Well, in a perfect world the, the government would not have created ghettos in American cities. Since the did,

    Right. Sure.

    Citations that will be requested, although I'm sure they will be disregarded:

    You managed to make only two of those links into actual links, but the three I reviewed were all based on the opinions of one man. "According to one historian" in the last link was a dead giveaway.

    Somehow, I don't think forcing banks to make loans to people who cannot pay them back is a good way of solving the problem you claim the government created. In fact, it is more than "I think". The economic crisis that it created was the obvious result. That obviousness makes it very hard to attribute to stupidity the acts of those who pushed the CRA, denied any brewing trouble with FNMA and Freddie-Mac, and blocked attempts to reregulate those agencies.

  85. Re:The course is clear, mostly by david_thornley · · Score: 1

    Fire is local, and the source can usually be determined. IoT problems are global (literally), and it's going to be more difficult to assign liability. Moreover, appliances are judged on not starting fires during normal use. IoTs would need to be secure from attacks, including attacks nobody's thought of yet.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  86. Re:Seed money, not day-to-day operations. Openstac by MobyDisk · · Score: 1

    Corporate networks already do this.

    No they don't. They wish they could, and they try. Here's how they try:

    First of all, corporate IT has physical access to everything in the building. Comcast has no access to the devices in my house. That's an important difference. Second, corporate IT achieves most of their security by demanding that all devices on the network be Windows boxes that are on their domain. Comcast can't require this either.

    Ultimately though, even corporate IT can'achieve this because they have to allow non-Windows devices onto the network. The fact that I could buy an insecure IOT camera and plug it into the network jack in my cube is what scares the heck out of IT admins. The best they could do is apply mac-address filtering, which would require that I either modify the MAC address, or take the device to IT so they can add it to their whitelist.

    So some national testing organization is going to test every device that connect to the Internet?

    organizations plural. They already do test most of them. They just don't bother to test security. The point about new software is interesting: currently, when companies make hardware changes it is up to them to notify the testing lab and submit it for certification. I suppose it would be the same for software.

    Really I have a hard time believing people are so stupid here.

    This is the 3rd time you've said something like that to me. I reply in the hopes that another person reading the thread will learn something, but I am going to stop replying at this point. I hope you get modded down to -1 on all these. It's annoying to write a paragraph explaining something, and get a single line reply like "That doesn't work and you are an idiot."

  87. IoT, another stupid acronym. by ebvwfbw · · Score: 1

    Should be ICT - Internet Connected Technology.

  88. Re:The course is clear by viperidaenz · · Score: 1

    No...
    It's like mains powered electrical appliances.
    I'm allowed to build my own appliance and plug it in to the mains. I can do what ever I want to stuff I've bought.
    I'm not allowed to sell it to the public unless it passes all relevant safety codes.

  89. Re:The course is clear by pnutjam · · Score: 1

    Thank you for proving me correct, the data is not debated by anyone with a brain. It was clearly a policy of the Fed.

    Likewise, your "forcing people to make loans" has been disproved multiple times. The problem was really too much money without clear investment opportunities. The money, basically thought it found somewhere safe to grow, but it was lies, and not government lies, free market lies.
    Anyway, I'm wasting my time with you.

    --
    Cheap storage VM.
  90. Re:The course is clear by Hylandr · · Score: 1

    Just because you *want* it to happen, doesn't mean it will.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.