Slashdot Mirror
Bruce Schneier Calls for IoT Legislation, Argues The Internet Is Becoming One Giant Robot (linux.com)
"We're building a world-size robot, and we don't even realize it," security expert Bruce Schneier warned the Open Source Leadership Summit. As mobile computing and always-on devices combine with the various network-connected sensors, actuators, and cloud-based AI processing, "We are building an internet that senses, thinks, and acts." An anonymous reader quotes Linux.com:
You can think of it, he says, as an Internet that affects the world in a direct physical manner. This means Internet security becomes everything security. And, as the Internet physically affects our world, the threats become greater. "It's the same computers, it could be the same operating systems, the same apps, the same vulnerability, but there's a fundamental difference between when your spreadsheet crashes, and you lose your data, and when your car crashes and you lose your life," Schneier said...
"I have 20 IoT-security best-practices documents from various organizations. But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning. I know regulation is a dirty word in our industry, but when people start dying, governments will take action. I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation."
"I have 20 IoT-security best-practices documents from various organizations. But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning. I know regulation is a dirty word in our industry, but when people start dying, governments will take action. I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation."
Once again, everyone's threats, concerns, and "dire warnings" mean absolutely zero. It will happen and there is nothing anyone can do about it.
... is an idiot in this instance when it comes to calling for legislation for IoT. The whole problem is humanity did not evolve to make rational decisions in a high tech free market society, no amount of legislation is going to overcome human's old meaty brain. Just like banks got bailouts because they own the government, any legislative body in america will quickly succumb to regulatory capture making the whole thing worthless. Not only that the internet is planet wide, you need co-operation with foreign governments and human beings have problems enough dealing with global warming. The whole regulatory system in america is a clusterfuck especially with trump, is he really expecting trump and his administration to make sound policy? I wouldn't trust trump with my toaster.
Let's just admit, humanity generally at this point in history has accelerated its development before its old monkey brain is able to catch up. Human beings are not evolving as fast as they are developing technology which is the fundamental issue. Human's lack of intelligence, maturity and foresight can't be overcome by adding more burdensome rules especially given the political "don't tread on me" culture of the american people.
>But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning.
I highly doubt regulation will cause many iot companies to take security seriously, unless it has some teeth. And then regulation becomes a barrier to entry for smaller companies, so there would be fewer IoT sellers, and maybe that's a good thing according to Schneier.
Many engineers who design bridges, roads, buildings, power systems, etc. are required to get a proefessional engineering certificate. There is no equivalent for computer scientist in the United States. Until there is liability for poor designs and implementation there will be changes to improve quality and security.
That would be swell.
Big Fire! Of course, nobody knows this but the Internet is Nuclear Powered....
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Don't buy IoT devices. Problem solved.
Everybody knows they offer marginally beneficial services to the user, and massive surveillance and privacy invasion opportunities for big data, unconstitutional government agencies and other sumbitches.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
TFA immediately made me think of the Arthur C Clarke story in which the "first cries" of the unintentionally created artificial intelligence that arose from the hook up of a world-wide telephone exchange was that every phone around the world rang at the same time.
What will it be for us? All the refrigerator doors on the planet opening at the same time?
Mimetics Inc. Twitter
https://www.bing.com/search?q=...
James Hogan imagined the next step of the world wide network in "The Two Faces of Tomorrow". Including how it could affect the outside world -- the mass driver was great.
Invalid Checksum. Retrying.
I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation.
SPOILER: stupid government regulation wins. There's no money to be made in "smart." If it just works, everybody forgets. if it's always breaking, the recriminations and money trail goes on for years and years.
(GOD I'm getting cynical in my old age.)
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
It's mating season
Schneier gives kind of a "shouting at clouds" vibe. The Internet is not like a truck you load things into or off of, it's not a series of tubes, it's not one giant robot that will turn into Skynet once it achieves sentience.
Internet Green is people! Wait, still the wrong movie, but closer.
The Internet is made up of billions of devices, each with different capabilities, each with their own purpose and "goals", influenced by others in its social network. Some of these influencers are nearby, some are far away; some are humans, some are machines. Some of these machines are robust against malicious interference, but most have weak points.
The Internet does not look or act like a single robot. It looks and acts like a network or society, not a monolithic entity, and talking about it as a monolithic thing encourages unwise reactions.
Just in case anyone was suspicious after he came on the Tor Project board after the big executive shakeup there.
The call for more regulation won't help with security problems, it will exclude even more people with the knowledge but not the degrees, and it doesn't solve the fundamental issues, most of which are based in design errors or assumptions in the hardware or software which should be fixed and formally proven, as was done in the secure L4 kernel concept. Short of that software will still be at the mercy of defects cause by both the hardware and the programmer to ensure security is as close to 'airtight' as is mathematically possible.
Having said that, the things needed to ensure it at this point are: Open documentation of the device cores, or original vhdl/verilog with manufacturing process errata. Compilers which thoroughly vet code for unusual accesses and document when such a series of accesses create a violation. Since most of these accesses are either races or boundary violations it shouldn't take *THAT* much time to test an entire codebase for them, both in source code, and final binary code checked against the oiiginal source code.
Additionally, we need to stop allowing compilers to become a moving target. Just following gcc and clang for the past 10-20 years will show that lots of cornercases develop from allowing 'future standard features' in 'official release compilers' as does mixing standards in a codebase. Pedantic standard rules and strict (and DOCUMENTED!) ABI compliance would help reduce many violations, even when interfacing new object code with legacy API/ABI code, where sufficient metadata documentation exists. Neither GCC nor CLANG and their related linker tools do this. This is also part of why there are so many MSVC runtime sets needed for some applications, but at least in that case they no longer clobber each other.
As a separate aside: If suddenly all this stuff DOES start getting secured, won't that simply result in more hardware level exploits enacted by agents of the international intelligence community to circumvent software-level restrictions? Most of the current security issues are as much due to a lack of 'firewall boundaries' for devices as they are the insecurity of the devices themselves. None of these devices should be connected to the internet directly. If you need access to them while away from home, it should be via a secure VPN to your private network which should not be routable from the internet other than VPN, properly configured outgoing subnet, or SOCKS/HTTP proxy. Direct network access was fine back in the old days of the internet where the network was heavily heterogenous. But nowadays the internet has homologized around Cisco, Juniper, Huawei, ZTE (for high end routing, plus probably a few others.), and x86/x86_64, ARM, MIPS for almost everything else consumer-level. The people making these attacks usually target one or the other of those groups, and both of those groups are easy to exploit due to the popularity of only one or two operating systems and software ecosystems (Windows, Linux, *BSD/Unix, or Cisco IOS or its successors.) When you factor those altogether the reason for the internets sickness is much easier to discover: It is almost a monoculture of systems. And if there is one thing people should have learned from Biology, monocultures only require one major event to kill them off.
Food for thought.
I had a 2 hour conversation last year with an IOT devices engineer who works for a multi-billion dollar Japanese Corporation. They guy didn't think Privacy was important or at risk at all through IOT devices. "Every home will have many of them soon" he said. He thought that realtime 3D face recognition - CCTV networks being able to identify you ANYWHERE IN PUBLIC with great accuracy even if you are not facing the camera, have grown a beard or are wearing a baseball cap - was a great step forward in human technological development. They guy kept talking about "new markets, new profits, a great future for our company". He literally DID NOT CARE what these technologies mean for people's Privacy. Every time I voiced even mild concerns about what these surveillance capable technologies might do to people's privacy, he acted terribly *shocked*. Apparently the corporation he works sees great profits in building IOT, face recog tech & other surveillance capable tech, and my bringing up concerns about them was something he was - wait for it - "uncomfortable with". =) This is what IOT is - faceless, nameless engineers crapping all over other people's lives because the companies that employ them expect a new XX Billion Dollar a year market from them.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
...If you think any legislative solution won't be perverted by mega corps to fuck people over even more your a delusional tool.
Even more delusional is you thinking you still have a chance at winning.
When 99% of the population is being tracked and you choose "not to play", you will be playing by default as the anomaly. You will be easily tracked because you will stick out and it will be rather obvious.
Many people have already accepted this fact, which is why attempting to regulate some constraint around it is the next logical step. If you must live with a monster, then you'll at least try and put it on a leash.