Hacker News Reader

Comment by owyn | Hacker News Reader

It wasn't mentioned in the bloomberg article, but the 15 areas covered are:

  • Data Recording and Sharing
  • Privacy
  • System Safety
  • Vehicle Cybersecurity
  • Human Machine Interface
  • Crashworthiness
  • Consumer Education and Training
  • Registration and Certi cation
  • Post-Crash Behavior
  • Federal, State and Local Laws
  • Ethical Considerations
  • Operational Design Domain (operating in rain, etc)
  • Object and Event Detection and Response
  • Fall Back (Minimal Risk Condition)
  • Validation Methods

Not sure if they're specifically ordered, but it seems positive that Data recording and Privacy are up at the top.

View on HN

This seems suspiciously like government getting something right... with regards to a quickly-evolving new technology market...

has this ever happened before?

Well there was the whole Federal Government inventing the internet thing at one point.

Yes. There's been a decades-long smear campaign against public management of common infrastructure.

What do you call a smear campaign against a target that's actually incompetent?

What do you call an indiscriminate smear campaign against a large target, parts of which are incompetent, and parts of which are competent?

"Self-serving"?

Politics.

It is truly unfortunate that among those perpetrating the smears are the public managers themselves, in the guise of doing their jobs.

https://en.wikipedia.org/wiki/Saturn_V

Can you think of a concrete example where the government got it wrong?[1] For the sake of argument, the federal government in the last 50 years? Maybe the encryption export ban. Or the CDA, but that was quickly reversed and the part that's left (Section 230) was really instrumental in the rise of the modern web.

[1] And I don't mean wrong as in "NSA spying" because you disagree with the policy. I mean like, "regulations mandated everyone use Beta tapes and laser disk even though they quickly became obsolete."

> Can you think of a concrete example where the government got it wrong?

Stem cell research.

I think 2bitencryption's point is more along the lines that the government regulates fields and that regulation quickly becomes unworkable because its a "quickly-evolving new technology market." For example, if the government mandated that all computers had to be Windows 9x-compatible that might have prevented the rise of the iPhone.

The embryonic stem-cell research ban didn't have anything to do with the underlying science and technology--it was based on a moral objection to the practice of destroying embryos for research. If the government had, for example, mandated the use of some testing methodology that soon became obsolete, that might be more on point.

Ah, I see. Thanks for clarifying, I thought it was a broader question.

Some HIPAA regulations that pre-date the rise of shared virtual servers in "the cloud" are quite outdated and cause quite a bit of trouble for no real benefit.

Such as? HIPAA generally has to do with organizational access controls and not specific technologies.

> Some HIPAA regulations that pre-date the rise of shared virtual servers in "the cloud" are quite outdated and cause quite a bit of trouble for no real benefit.

What HIPAA regulations are you talking about? Other than HITECH guidance (which can sort-of be seen as a "HIPAA regulation"), HIPAA regulations don't generally specify technologies at all, and I can't think of any that I would describe as outdated or troublesome due to the rise of shared virtual servers and "the cloud", whether they predate it or not.

The biggest thing is that we can't run software with unencrypted PHI on physical hardware that is simultaneously running other people's code. In practical terms this means that we have to pay AWS some $ to get dedicated instances and also we can't use ELBs in the standard (easy) way. There are some other things as well.

> In practical terms this means that we have to pay AWS some $ to get dedicated instances

This is a feature, not a bug. It also is neither HITECH nor HIPAA; it is instead AWS's requirement in order to sign your BAA.

> we can't use ELBs in the standard (easy) way

Also neither HITECH nor HIPAA. ELBs are used in a PHI-related scenario identically to any other scenario. Unless you are referring to using it as an SSL terminator, in which case I would say "the standard (easy) way is always wrong".

That seems like a fairly reasonable thing given you're talking about encrypted PHI... it's some extra $ for a considerable reduction to overall attack surface when processing the most sensitive type of personal data.

I don't think this meets OP's definition of "wrong".

In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about (in comparison to many other more likely failures):

1) determine what physical hardware in aws the target is running code on

2) somehow get the aws virtual machine manager to let the attacker run their malicious code on the same hardware

3) somehow pierce the protections of the virtual machine to read memory being used by the target application

4) figure out how the data is stored in memory in order to make sense of anything that was read

> In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about

In AWS case, this is an AWS rule about when they will sign a HIPAA BAA, even though there is no HIPAA regulation that specifically prohibits the arrangement at issue. AWS clearly thinks it is worth worrying about.

When you run your own public cloud, you can determine what risks are worth accepting potential liability for.

Yes, I agree that Amazon is behaving perfectly rationally given the legal environment. My point is that the legal environment has been designed in an un-optimal way from a technical perspective. Identifying such a situation was rayiner's request.

> Yes, I agree that Amazon is behaving perfectly rationally given the legal environment.

I'm not commenting on Amazon's rationality (I haven't actually evaluated the security concerns that would determine that.)

> My point is that the legal environment has been designed in an un-optimal way from a technical perspective.

And you haven't pointed to anything in the legal environment that is suboptimal from a technical perspective. You haven't even pointed to anything in the legal environment at all.

Amazon (as a BAA) has certain administrative responsibilities for putting administrative and technical safeguards in place to prevent breaches, and certain obligations and liabilities in the case of breaches. HIPAA and related laws and regulations do not specify the specific administrative or technical safeguards, though they do specify areas that must be addressed.

Amazon has decided that the particular technical arrangement you prefer is too high of a risk, but you haven't pointed out anything that indicates that this is the result of an outdated regulation that results in poor technical choices rather than technology-neutral regulation and a reasonable evaluation of the security concerns of the particular technical arrangement you would prefer.

People said the same thing about cold boot attavks against encryption keys. Yet today the police and others are using that and other NAND attacks regularly.

HIPPA is a very easy compliance standard to meet. If it seems difficult to meet those requirements with your standard tool configurations, you should think about what that means with respect to the integrity of your data.

I would like to see a case of a cold boot attack by the police.

Memory forensics is a thing.

Google around with terms like forensics and "Volatility" or "Volatility toolkit" and you should find some presentations and other references.

I know what memory forensics is and I use Volatility and Second Look and quite a few other things pretty often, I've asked specifically about an instance of cold boot attack that you claimed in a hyperbole that are used often or at all by the police.

You know what I don't need a case, please find me a jurisdiction in which cold boot attacks have passed forensic certification, e.g. a link to the process like for example from a body equivalent to the ASTM https://www.astm.org/Standards/forensic-science-standards.ht... would suffice.

> The biggest thing is that we can't run software with unencrypted PHI on physical hardware that is simultaneously running other people's code.

There is no, AFAICT, no regulation under HIPAA or related law that requires this. Certain service providers may have determined that they cannot provide guarantees of privacy/security without this technical restriction.

I asked my doctor to email me my records and was told it is illegal due to HIPAA it makes no fucking sense but that's what it is.

It isn't illegal to email records under HIPAA. But your doctor probably doesn't have a system set up to securely email records (such things do exist), and their practice has probably adopted privacy policies that don't allow emailing for that reason. Doctors aren't generally compliance experts, and are much more likely to know what the policies of their place of work allow than the distinctions between what HIPAA allies and what their place of employment has adopted as policy based on the particular technology they've decided to adopt and their particular level of risk tolerance and other factors.

Also, certain provisions of FERPA precluding use of cloud accounts for holding student data. I think those may be the archetypal examples.

How about the DMCA? It's routinely abused; it's easy to issue takedown notices and difficult to defend against them.

ITAR comes to mind. Its basically bans export of dual-use (mil/civ) technologies. Its has made for incalculable harm to our aerospace industry and other industries that produce things that are classed dual use (encryption used to be one of them). This is the same law that banned encryption.

You have things like companies in Aviation Week (a big aerospace industry mag/site) running full page ads for sensors and other aerospace items proudly claiming its ITAR free (means not made/designed in US). A company I worked for bought a high power (2.5kW) laser from Germany. It failed and cannot be sent back to Germany for repair due to ITAR (tooling needed to fix it cannot be easily moved and probably would fall under ITAR). High end CNC machine tools will brick themselves if they are moved without the manufacturer specifically blessing the move due to ITAR regulations (earthquakes can trigger the "I've been moved without permission" response).

There is a countless list of other harms it has caused, but I have no direct experience with. ITAR is fairly easy to get around for the "bad guys" because they can just not buy US goods.

e-cigs. We don't know their exact relative harmfulness/safety, but there is fairly broad consensus that 'vaping' is better for your health than cigarettes.

Clearly more work needs to be done to rigorously investigate and evolve the space, but recent Federal regulations have essentially put small innovators out of business.

In sum: a harm-reducing item is being regulated into the ground.

The law that allows the Government to access all cloud-hosted emails that are older then 6 months, without a warrant.

The VA Healthcare debacle. The government was unable to timely provide healthcare and instead of trying to fix the problem they hid and covered it up by falsefying records. The new system they made is complexly incompetent where doctors and patains are force to spend days on the phone with people who have no clue what they are doing.

Software patents.

Frequently. Passenger air travel. The highway system. Many others.

The FAA and NTSB have really worked well.

Interesting "Federal, State and Local Laws". So what happens when the self driving car violates a law and the police office pulls it over. Who gets the ticket? If there is no steering wheel... can it even get pulled over?

If I were to guess, once self-driving cars are widespread, cars won't be pulled over any more for driving-related issues (ie, cops won't radar any more). However, they will probably be required to have a kill switch that can pull it over for other reasons (ie, if the cops thought your car was the getaway vehicle from a bank robbery)

This is of course once almost all cars are self-driving so it'll be interesting to see what happens in the midterm.

> If I were to guess, once self-driving cars are widespread, cars won't be pulled over any more for driving-related issues

There will still be black people in cars

No problem, they'll just unload .45 rounds into the vehicle until they hit something that makes it stop.

Solution: since you don't need to see out of the car anymore, all windows have 0% VLT tint unless it's stopped.

Cops pull over cars for traffic infractions for three primary reasons. The first is for driving safety, the second is for revenue, and the third is because it leads them to arrests of idiot criminals who can't be bothered to fix their tail lights.

The revenue part is coming under a lot of scrutiny recently, since it's being proven to have very regressive effects. The Federal government will make it more expensive than the revenue they generate from it.

I imagine it would be like radio tag toll lanes now. If you go through and do not have a tag, they mail the vehicle owner the ticket. Most violations would not need stops. I don't think private vehicle ownership will survive self driving cars.

NHTSA level 1 and 2, the driver. NHTSA level 3-5, the vehicle manufacturer.

The cynic in me immediately interpreted "Post-Crash Behavior" as the exact opposite priority from "Privacy".

I was thinking it meant the car would not drive itself away and hide after a collision :-)

That could actually be an interesting problem. It might sound like "in the event of a impact >Xg, stop, shut down, and wait for police/NTSB/etc to come investigate". But if, say, you hit a deer on a wilderness road in the winter, that behavior could lead to the passengers all dying of exposure.

Do self-driving cars have a button labeled "fuck your rules and DRIVE"?

A self-driving car that refuses to move after a minor accident on a wilderness road sounds like a great opening scene for a horror movie.

Yes, unless it's level 5. Then you walk.

Likewise, in most discussions of self-driving cars, it is noted that they probably won't work well in the snow. Someone (presumably not from a snowy area) will then say that the car will pull over and wait, as you shouldn't be driving in a snowstorm anyway. They never say what's supposed to happen next, with the highways full of people whose cars have stranded them. Are they all supposed to call for cabs? But wait, cabs have been replaced by self-driving cars...

I'm pretty sure they'll eventually figure out how to get self driving cars working in snow, or rain, with protocols on when to stop that match when humans should.

Probably any self-driving vehicle should have a button you can push that amounts to consenting to "The car will now record that you initiated a manual override. You are now in full control. Anything you do is your responsibility." Insurers will throw a fit if you push this button but it's better than being stuck in a bad situation because your car can't figure out a way out of it.

If you are driving a modern car, it has a blackbox that records accident data.

That's a very short section, but it looks more like how the driving system itself responds if a sensor is damaged in a crash. Basically, that it should hand control back to the driver. And also if you crash and then repair the system, it must somehow be validated/tested before being put back in service.

The data collection "black box" side of it is in a different section.

> it must somehow be validated/tested before being put back in service

I pity the mechanics for that one. You just know the car manufacturers are not going to want some unwashed shade tree mechanic, or even a legitimate independent garage, to have access to do that.

Let alone self-maintenance. There goes the right to repair...

Thanks for listing them, I was curious indeed.

By the way, in which area do the following requests fall:

- Yielding to an emergency vehicle with sirens on.

- Moving backwards to a safe and large enough spot when the route is too narrow to fit self-driving car and oncoming huge lorry (and there is no line marking the limit between road and ravine).

- Upon instructions from authority, recognize that the highway is closed due to an accident and, no matter what the driving code says, you actually have to make a U-turn on the highway and follow the crowd. Alternatively, just take that route (yes, the one with the large no-entry sign at the beginning) or that narrow path in the wood (yes, it exists, even if Google Maps isn't aware of it). At the bare minimum, park yourself off the road and let the others move on.

- Verify whether a queue is forming behind you. Listen to the honkers, they may be right. When you are an obstacle to the most part of traffic, moving to the side and letting others pass from time to time is sincerely appreciated.

Now if the could just come up with some "Data recording and Privacy" regulations for all electronic devices. So, Google and Facebook can stop creeping me out. They're like the creepy neighbors that always look at out the window to see what I'm doing.

Do you need to use their services? Have been (mostly) Google and Facebook free for a long time, and I don't live under a rock. Maybe you should also try the "FB&G"-free diet too ...? (It's not for everyone :-)

The problem is communicating with people that use those services

Reply on news.ycombinator.com