What If We Put Warnings on IoT Devices?

But ya, take out the internet connection, and no more problems. Take out the battery and the risk of fire/explosion also goes away.

Sidenote, those earbuds sound interesting. Could you point me to them?

Everybody uses their own homegrown solution, which depends heavily on the hardware they have to work with. This means that some companies get it right and many get it wrong. Yeah, the biggest problem is companies shoehorning connectivity to products, but the second biggest problem is that there really isn't a standard for securing that connectivity.

What chemicals do you think have been included without scientific basis?

And these are places, not products...with gardens. Even if they use organic pesticides, they probably still have to put up the warning.

I'm pretty interested in how much cadmium and mercury gets into my system because they're bad news for the brain. At the same time, mercury is also in air so it's kind of inescapable. Parts per billion is interesting information because then I can control how much I ingest the way I do for food that is fattening.

This is changing. But you still have the problem of over reporting. There are provisions to verify that your use of the material is safe, but it's so much easier, and so much less risky, to just slap the label on.

In some areas "this product not for sale in CA" is a marketable feature. On small engines it means it's tuned to run well instead of minimum emissions. For gas cans it means you don't need three hands to pour from them. For riding mowers it means you don't need to go out of your way to engage several redundant safety mechanisms in order to operate it (In addition to reasonable safeties like a seat switch and shifter that can't easily be bumped).

I can't think of one off the top of my head but I'm sure there's equally "pants on head" consumer safety laws about things other than garden/lawn equipment and/or in states/countries other than CA.

(BTW, this is post is the cliff notes of a conversation I had with my coworkers at a tech company so it's not like we're a bunch of hicks complaining that the guards on our saws prevent us from fitting oversized blades.)

I got it home, opened the box, thinking I had a new watch!

Nope. You have to connect it to the internet and let it phone home first. It would not tell time, permit you to manually set the time, or let you explore that watch at all, until it spoke with it’s mothership.

I put it back in the box, and tossed it in the closet, and it’s still there, and now it’s completely unusable because the company collapsed.

Ok seeing we talking IoT what standard: of the top of my head mqtt, coap, http/rest, soap? Those are just communication protocols. Now we still need to standardize the application data layer jsonschema, swagger/openapi, wsdl? and most of the time the vendor wants to own the application for their benefit. Also the classic xkcd of standards leading to more standards is so true.

As you mentioned the problem lies with the general public, don't care attitude. Hopefully there is enough that will try to educate and help their peers.

But a lot of us is going to learn the hard way how criminals used our iot devices against us to rob us blind and only then change will truly start to take place.

"By visiting my front door, you agree to Doorbird's privacy policy"

Currently I have a bunch of cheap WiFi cameras, all made by D-Link. The thing I like about D-Link cameras is that when you put them on a WiFi network that isn't allowed to access the internet they still work as expected.

The cameras themselves have all of the smarts to do motion detection and email short recordings, they can also FTP images somewhere or you can use something like Zoneminder to handle things. None of this requires them to phone home or make use of some kind of cloud service.

Of course, D-Link does have a cloud service, but it's not required. To me it seems like the best of both worlds - the easy-to-use cloud service for those who want it, plus the ability to work standalone for those who don't want to use their service.

Why doesn't someone build a video doorbell that works like this? D-Link keeps making and selling these cameras, so clearly there's some kind of market for products that have a cloud service but don't require it.

The irony is that this is Hacker News and so many people building those things hang out here. If we want to make a difference, we have to start making a difference.

I've long advocated the basic idea from the article here, but in a much more blunt way, with explicit warnings about the potential consequences:

Identity theft is the fastest rising crime in COUNTRY.

The average victim loses $X permanently and takes Y months to get their life back.

THIS PRODUCT DOES NOT MEET PRIVACY STANDARD Z SO YOU ARE MORE LIKELY TO BECOME A VICTIM IF YOU USE IT. COMPETING PRODUCTS MAY BE AVAILABLE.

(Or something along those lines. You get the idea.)

By requiring a warning label on it, as the title suggests. Doesn't seem like such a silly idea now, does it?

My navigator is an elderly TomTom, my phone an old Nokia and so on. I seem to be stuck in stuff that is now a generation or two behind the times but I've yet to be convinced that the 'new' stuff is better in a way that outweighs the privacy and security risks.

I agree.

Personally, I actively do not want OTA updates, or much of any remote communication to or from my car at all, that isn't 100% isolated from all the essential vehicle control, safety and security systems.

I can tolerate the idea of a vehicle-initiated automatic emergency call system, or a remotely activated but otherwise independent tracker device as an anti-theft measure. These have a clear and beneficial purpose for me as the owner/driver, and if strictly limited to that stated purpose they pose minimal privacy, security or safety concerns.

Anything beyond that, I would rather do without. And I'll maintain my current car indefinitely rather than buying any of the current generation of might-work-or-might-kill-you stuff. The lack of effective regulation and oversight in the auto industry was scary when it was just mechanics, it became more scary when software started to eat the industry, and it's just plain terrifying in the new, connected era.

For example, in my country, it is typically the merchant who sells you a physical product who will be on the hook under consumer protection legislation if the product fails to meet acceptable standards somehow. It's implicit that they would in turn try to recover any losses from their own suppliers later, but that's not the end customer's problem, and the merchant is the one who loses out if they don't have such a recovery mechanism available.

However, that's hardly fair if there's a third party involved (the developer of some software component within the product) who can update it in whatever good or bad ways they want without any knowledge or consent on the part of the merchant. It is particularly unfair if that third party is also a relatively large or even monopoly supplier and can dictate more-or-less arbitrary terms to merchants selling their products, who typically do not benefit from a baseline of legal protections against exploitation in the same way that end customers do.

In short, our entire framework of consumer protection and product liability laws has been built around the model of a linear supply chain resulting in a single point and time of sale, but that model simply doesn't apply any more in many cases.

Very good one.

A good candidate would have been "smart", but unfortunately it is already taken to mean the opposite.

[1]: https://www.reddit.com/r/Android/comments/75ev0z/oxygenos_is...