Hacker News Reader

Comment by distract8901 | Hacker News Reader

I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks.

The core problem is that without control of the firmware, consumers don't really own these devices. The company can unilaterally decide one day to brick your device and force you to buy a new one. It should be obvious that this behavior is egregiously anti-consumer and anti-competitive.

View on HN

There's also the problem that electronic devices last a long time -- often much longer than any manufacturer wants to admit.

Vehicles, PCs, printers, and routers can easily last 10 years. Refrigerators and HVAC units can last 20 years or more. And now we're putting "smart" stuff into electric circuits that should last the lifetime of the house. The manufacturer will probably go out of business long before those devices go out of service, and there's no guarantee that there will be anyone to push one final firmware update or release the source code in the hectic last few days of an imploding business.

Seconding this thread. There is no reason why a device shouldn't be servicable in 30 years regardless of whether the vendor is still in business.

There might be a way to integrate these IoT regulations with e-waste regulations, where the liability for disposal, recycling, and cleanup is related to servicability.

Some sort of escrow with a dead man switch could solve this. They can reset the switch by releasing an update or affirming that they are still providing service. If no communication is received after a certain period of time, then it gets released publicly.

This is great for hackers but doesn't it make IoT devices incredibly insecure for normal users who wouldn't even know their device has reached end of support?

> doesn't it make IoT devices incredibly insecure for normal users

How secure or insecure a device is is unrelated to whether its source code is public.

Disclosure: I might be biased on this, as I'm a reverse engineer.

I think the parent comment is implying that if the source code is released at the end of the device's supported life, it will be much easier for hackers to find vulnerabilities. Then users who aren't paying attention will continue running that last version, and hackers will attack them using those now-public vulnerabilities.

So you'd still need some mechanism to force-update devices in response to vulnerabilities found in open-source end-of-support firmware.

Releasing source code could lower the barrier a bit but the main thing I was calling out is releasing the keys - maybe they could be transferred to a trusted custodian instead.

In certain cases probably yes, but maybe still worth it? If you have the keys you still need to get your maliciously manipulated build on the customer's device... And this is assuming the manufacturer even bothered signing and verifying in the first place.

So this would be bad for manufacturers releasing secure well designed devices without security vulnerabilities.... But if you think about it for a second, isn't this good? As long as there is no known vulnerability, the manufacturer can say the device is still supported, and it costs them nothing, as they have no reason to release an update. And well, if there is a security issue, then it might be better to have the source and keys after all?

If it were really unrelated, nobody would pay you to reverse engineer.

Which is why I believe I'm biased: I support releasing source codes, even if it sounds like it's going to reduce my pay.

What I mean is, reverse-engineering takes time, effort, and special talent, hence your job. This is the little security moat they get by not releasing src code, or at least not the latest running version. Of course a well-maintained and audited open-source codebase is better than a closed one, but a lot of this stuff isn't well-maintained.

Also, there are high-profile instances of hardware security that rely on obscurity, like secure enclaves or the iPhone passcode unlock. They tend to get cracked eventually, but it's still hard.

This is not really a solvable problem. Whether or not your iot devices are out of support is just not something anybody has time to think about. It's right up there with those "our terms of service have changed" emails from your bank in terms of priority.

No more than our current situation. A sufficiently determined hacker can break into most IoT widgets given enough time, and decompile the firmware.

The vulnerabilities exist and will be exploited either way. But with source available, we now have the possibility of a whitehat group springing up to patch them.

Would you rather have no chance of ever patching exploits or giving people the ability to patch them?

>AND be obligated to release the full source code for the device once they decide to end support.

This is unreasonable. Code is often reused in the next generation of a product. The company may not have the rights to release all of the code.

Then they have to acquire the rights to do so for of all components before they use those components.

A competent technician with access to a workshop can make even 80 year old vehicles work. That is long past the service life of that vehicle but it can still be done, an iteration of the same technology is likely still in use today though in your car.

That isn't possible for software simply because reverse engineering is not simple, reverse engineering a small microcontrollers firmware might be possible, reverse engineering even something like old unix wouldn't be and definitely any modern operating system wouldn't be even though there is no legal precedent for that source code to be protected.

In 30-40 years time when early windows and early DOS copyright expires do you think Microsoft is going to benevolently make that source code available? It has legally become public domain but the source code will still remain closed.

How about firmware for IOT devices being installed in your house, it's likely that that hardware can be made to work for the next 60 years but you are forced to replace it in 3 when the manufacturer decices it's no longer financially viable to support it.

>That isn't possible for software simply because reverse engineering is not simple

Nor is repairing a car. It is not as hard as you think to RE some random IoT device firmware.

Is it "Here's a manual and a pile of tools, follow the instructions" hard?

Most maintenance on vehicles is exactly that.

The smart fridge that has a buffer overflow leading to RCE cannot be fixed quite a easily as as replacing the brakes on my car, neither is easy but one of those a monkey with a spanner could figure out eventually.

Great, then if they keep supporting the codebase internally, back-porting security patches to an older device should be easy.

Manufacturing millions of widgets that go into the garbage every three years is bad and should carry heavy consequence. If the company isn't willing to support the devices they sell, it should be possible for consumers to do it.

Reply on news.ycombinator.com