Slashdot Mirror
Bruce Schneier Calls for IoT Legislation, Argues The Internet Is Becoming One Giant Robot (linux.com)
"We're building a world-size robot, and we don't even realize it," security expert Bruce Schneier warned the Open Source Leadership Summit. As mobile computing and always-on devices combine with the various network-connected sensors, actuators, and cloud-based AI processing, "We are building an internet that senses, thinks, and acts." An anonymous reader quotes Linux.com:
You can think of it, he says, as an Internet that affects the world in a direct physical manner. This means Internet security becomes everything security. And, as the Internet physically affects our world, the threats become greater. "It's the same computers, it could be the same operating systems, the same apps, the same vulnerability, but there's a fundamental difference between when your spreadsheet crashes, and you lose your data, and when your car crashes and you lose your life," Schneier said...
"I have 20 IoT-security best-practices documents from various organizations. But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning. I know regulation is a dirty word in our industry, but when people start dying, governments will take action. I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation."
"I have 20 IoT-security best-practices documents from various organizations. But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning. I know regulation is a dirty word in our industry, but when people start dying, governments will take action. I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation."
Once again, everyone's threats, concerns, and "dire warnings" mean absolutely zero. It will happen and there is nothing anyone can do about it.
... is an idiot in this instance when it comes to calling for legislation for IoT. The whole problem is humanity did not evolve to make rational decisions in a high tech free market society, no amount of legislation is going to overcome human's old meaty brain. Just like banks got bailouts because they own the government, any legislative body in america will quickly succumb to regulatory capture making the whole thing worthless. Not only that the internet is planet wide, you need co-operation with foreign governments and human beings have problems enough dealing with global warming. The whole regulatory system in america is a clusterfuck especially with trump, is he really expecting trump and his administration to make sound policy? I wouldn't trust trump with my toaster.
Let's just admit, humanity generally at this point in history has accelerated its development before its old monkey brain is able to catch up. Human beings are not evolving as fast as they are developing technology which is the fundamental issue. Human's lack of intelligence, maturity and foresight can't be overcome by adding more burdensome rules especially given the political "don't tread on me" culture of the american people.
>But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning.
I highly doubt regulation will cause many iot companies to take security seriously, unless it has some teeth. And then regulation becomes a barrier to entry for smaller companies, so there would be fewer IoT sellers, and maybe that's a good thing according to Schneier.
Many engineers who design bridges, roads, buildings, power systems, etc. are required to get a proefessional engineering certificate. There is no equivalent for computer scientist in the United States. Until there is liability for poor designs and implementation there will be changes to improve quality and security.
That would be swell.
Big Fire! Of course, nobody knows this but the Internet is Nuclear Powered....
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Don't buy IoT devices. Problem solved.
Everybody knows they offer marginally beneficial services to the user, and massive surveillance and privacy invasion opportunities for big data, unconstitutional government agencies and other sumbitches.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
TFA immediately made me think of the Arthur C Clarke story in which the "first cries" of the unintentionally created artificial intelligence that arose from the hook up of a world-wide telephone exchange was that every phone around the world rang at the same time.
What will it be for us? All the refrigerator doors on the planet opening at the same time?
Mimetics Inc. Twitter
https://www.bing.com/search?q=...
James Hogan imagined the next step of the world wide network in "The Two Faces of Tomorrow". Including how it could affect the outside world -- the mass driver was great.
Invalid Checksum. Retrying.
There is no accountability because the FCC sits on its hands when it isn't shoving them up the money-filled holes of telecom companies. REGULATE REASONABLY OR GTFO.
I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation.
SPOILER: stupid government regulation wins. There's no money to be made in "smart." If it just works, everybody forgets. if it's always breaking, the recriminations and money trail goes on for years and years.
(GOD I'm getting cynical in my old age.)
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
What's with the /. editors' obsession with robots?
Schneier gives kind of a "shouting at clouds" vibe. The Internet is not like a truck you load things into or off of, it's not a series of tubes, it's not one giant robot that will turn into Skynet once it achieves sentience.
Internet Green is people! Wait, still the wrong movie, but closer.
The Internet is made up of billions of devices, each with different capabilities, each with their own purpose and "goals", influenced by others in its social network. Some of these influencers are nearby, some are far away; some are humans, some are machines. Some of these machines are robust against malicious interference, but most have weak points.
The Internet does not look or act like a single robot. It looks and acts like a network or society, not a monolithic entity, and talking about it as a monolithic thing encourages unwise reactions.
Seriously. How else to explain the following paragraph?
Our computers and smartphones are as secure as they are because companies like Microsoft, Apple, and Google spend a lot of time testing their code before it’s released, and quickly patch vulnerabilities when they’re discovered.
Smacked me gob, I did, after reading that.
Just in case anyone was suspicious after he came on the Tor Project board after the big executive shakeup there.
The call for more regulation won't help with security problems, it will exclude even more people with the knowledge but not the degrees, and it doesn't solve the fundamental issues, most of which are based in design errors or assumptions in the hardware or software which should be fixed and formally proven, as was done in the secure L4 kernel concept. Short of that software will still be at the mercy of defects cause by both the hardware and the programmer to ensure security is as close to 'airtight' as is mathematically possible.
Having said that, the things needed to ensure it at this point are: Open documentation of the device cores, or original vhdl/verilog with manufacturing process errata. Compilers which thoroughly vet code for unusual accesses and document when such a series of accesses create a violation. Since most of these accesses are either races or boundary violations it shouldn't take *THAT* much time to test an entire codebase for them, both in source code, and final binary code checked against the oiiginal source code.
Additionally, we need to stop allowing compilers to become a moving target. Just following gcc and clang for the past 10-20 years will show that lots of cornercases develop from allowing 'future standard features' in 'official release compilers' as does mixing standards in a codebase. Pedantic standard rules and strict (and DOCUMENTED!) ABI compliance would help reduce many violations, even when interfacing new object code with legacy API/ABI code, where sufficient metadata documentation exists. Neither GCC nor CLANG and their related linker tools do this. This is also part of why there are so many MSVC runtime sets needed for some applications, but at least in that case they no longer clobber each other.
As a separate aside: If suddenly all this stuff DOES start getting secured, won't that simply result in more hardware level exploits enacted by agents of the international intelligence community to circumvent software-level restrictions? Most of the current security issues are as much due to a lack of 'firewall boundaries' for devices as they are the insecurity of the devices themselves. None of these devices should be connected to the internet directly. If you need access to them while away from home, it should be via a secure VPN to your private network which should not be routable from the internet other than VPN, properly configured outgoing subnet, or SOCKS/HTTP proxy. Direct network access was fine back in the old days of the internet where the network was heavily heterogenous. But nowadays the internet has homologized around Cisco, Juniper, Huawei, ZTE (for high end routing, plus probably a few others.), and x86/x86_64, ARM, MIPS for almost everything else consumer-level. The people making these attacks usually target one or the other of those groups, and both of those groups are easy to exploit due to the popularity of only one or two operating systems and software ecosystems (Windows, Linux, *BSD/Unix, or Cisco IOS or its successors.) When you factor those altogether the reason for the internets sickness is much easier to discover: It is almost a monoculture of systems. And if there is one thing people should have learned from Biology, monocultures only require one major event to kill them off.
Food for thought.
I had a 2 hour conversation last year with an IOT devices engineer who works for a multi-billion dollar Japanese Corporation. They guy didn't think Privacy was important or at risk at all through IOT devices. "Every home will have many of them soon" he said. He thought that realtime 3D face recognition - CCTV networks being able to identify you ANYWHERE IN PUBLIC with great accuracy even if you are not facing the camera, have grown a beard or are wearing a baseball cap - was a great step forward in human technological development. They guy kept talking about "new markets, new profits, a great future for our company". He literally DID NOT CARE what these technologies mean for people's Privacy. Every time I voiced even mild concerns about what these surveillance capable technologies might do to people's privacy, he acted terribly *shocked*. Apparently the corporation he works sees great profits in building IOT, face recog tech & other surveillance capable tech, and my bringing up concerns about them was something he was - wait for it - "uncomfortable with". =) This is what IOT is - faceless, nameless engineers crapping all over other people's lives because the companies that employ them expect a new XX Billion Dollar a year market from them.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
...
nevermind, too easy.
He's going to be fought tooth and nail on this one.
The worst flaws in the IoT are actually its biggest selling points as far as any three-letter agency, sales-rep or advertiser is concerned. They want the item to be capable of killing you like in bad 90s "hacking" movies. They *want* the item to be easily bricked by someone else in ways that can be blamed on the user's own lack of security - no matter how much effort one put into securing said devices within the confines of laws like the DMCA. They *WANT* it mouthing off vital information it doesn't need and shouldn't even gather to anything and anyone who asks - or at least who pays them for this kind of metric in great bulk.
The Internet of Things doesn't have to be the brain-frying Matrix of sinister paydata and fatal remote sabotage. But those pushing for it the hardest are doing their damnedest to make sure that it can become just that.
He's either watched the TV show Person of Interest, or he needs to, because he's just describing the overall plot of the show!
The only utility of ID-oT is p0wn1ng users. Buy our shit once then we stalk U forever. This is why the marketers keep cheerleading IoT.
Caring about security requires tech companies to care about the user. They only care about advertising and big data cyber stalking. Users are merely "dumb fucks".
If you think any legislative solution won't be perverted by mega corps to fuck people over even more your a delusional tool.
And a robot should pay tax! So, the question is, how do we go about this one?
Bruce tries, but in the wrong way.
My answer follows:
A government agency is NOT the answer. The government isn't even publishing the exploits it discovers or buys - it even lets criminals get away above revealing critical vulnerabilities who affect us all.
The most OFFENSIVE abusers of security holes are script kiddies and government actors. Currently.
In the future, we have to add the threat of Artificial Intelligence. The potential for a 'gone loose' AI taking control of our earth-scale computer robot is relatively large. Read more from the most intelligent human on the planet about that: Elon Musk. Nothing will be able to stop that unless we fix our lack of a better human-computer interface.
But in the mean time what can we do as an alternative to your proposed government agency - which would without any doubt - just make things worse?
We need 3 simple laws (so YES, I think regulation needs to step in). But it need to be simple laws - otherwise they will be abused.
1) "All offensive action on the internet are a crime - except those performed for research." This puts all the 'cyberwar' actions out of legality as well. We need cyberpeace, not war! And if the government looks as the internet as a weapon, they are out of line, it is a critical piece of infrastructure which should not be abused in such way!
2) "Companies can be held liable if they don't fix disclosed security holes in reasonable time." One can discuss about what a reasonable time is, and how the disclosure process needs to work. To me it seems that the policy by Google is a good middle ground currently: inform the affected company but if they fail to fix, inform the general public. One could see an additional step where the company is fined for the 'pollution' it causes worldwide. Yes, this also means you, Microsoft!
3) "If companies discontinue supporting a product or go broke - hardware or software. They need to provide the source code to their customers so they transfer the liability." This means that the cost of software and maintenance goes up. And companies need to weight the importance of the secrecy of their source code versus keeping the maintenance cycle alive. Companies who prefer not to give maintenance for the largest part of the OS running on the device might opt for an OpenSource Operating System which can be independently upgraded aside from their proprietary and maintained application.
Only if we push for these 3 simple laws, things will change.
These laws are simple enough for everybody to understand.
If they will be enough to stop a possible AI overlord, maybe not. But at least we might have a chance against malicious script kiddies and overreaching governments.
security expert Bruce Schneier warned the Open Source Leadership Summit
The irony about asking for regulation of IoT is that there is a high probability that the way they will "regulate" this is by close sourcing the thing, make it a felony to reverse engineer it in any way, and make it a felony to refuse patches distributed by the company, regardless of what spyware, malware, or bugs they pack into each patch you are now legally required to choke down. And then maybe start moving towards doing the same thing to phones and ultimately PCs.