Hacker News Reader

Comment by akerro | Hacker News Reader

FFS can't you just buy anything these days without worrying about backdoors, vulnerabilities in CPUs, MOBO? Why we just can't have nice things? Why do browsers have to run DRM, CPU can be controlled by any USB driver, MOBOs have webservers with code execution from LAN and internet. IoT cameras make biggest botnets ever known. At this point I'm just waiting for a fucking internet controlled kettles and ovens that will burn down neighbourhoods and cities.

View on HN

When I was shopping for a lock recently, the store had electronic locks you could control with your phone! There's no way a lock maker could possibly do IoT security right. Who in their right mind would get that lock? The burglar just has to see its distinctive panel and google some crack when it's eventually cracked.

Economics. Enough people prefer faster and cheaper. Security and reliability cost time and money. By the time your product ships it's already obsolete and still costs more than customers are willing to pay.

Probably won't change until the costs of these types of bugs/design flaws outweigh the costs of preventing them.

Surely, not putting in a backdoor is a cost saving measure though?

It could be if there's someone willing to pay for it being added.

If the backdoor was a hack for easier debugging that got left in, not having it during development could make for a longer more expensive development cycle. In which case it should have been removed before production.

It could also be intended as a support tool to ease hard to debug solutions remotely. Not having it could make support issues more expensive and slower. Very insecure and misguided (security by obscurity is not security) if this is the case, but not malicious. Just a stupid attempt at saving money. This apparently was the case for another commenter on a different product.

While it's possible it was placed with malicious intent, there are plausible (and all too common) alternatives that explain it.

Reply on news.ycombinator.com