Comment by myself248 | Hacker News Reader

Comment by myself248 | Hacker News Reader

Speaking as someone who has several cheap cameras gathering dust in a box because I no longer trust them with network access...

...manufacturers are simply never going to be incentivized to take security seriously. The best you can hope for with a regulatory approach is to incentivize them to pay more lip-service to the idea, while hiding their backdoors better. Their incentive to spy on users is simply too profitable.

(And, the legal environment is such that users can simply click-wrap away literally anything. If the terms say you agree to let the manufacturer monitor your conversations, guess what, it's no longer spying. Perhaps any such language, in the built-in firmware OR IN ASSOCIATED APPS, should immediately make a device ineligible for a favorable label.)

Only users ourselves, actually have users' interests at heart. The only meaningful improvements in security that I've ever seen in the wild, have been with open-source firmware that completely replaces the device's own. Not a shim on top that adds functionality while preserving the OEM's backdoors, but a complete ground-up replacement.

Therefore, the most meaningful step would be to require support for open-source firmware. Providing all the data such that open-source drivers can be written, providing a working build-environment, and making it easy to install user-provided firmware, would go a long way.

Then once the device is fully supported in the mainline distro of a mainstream FOSS project, its label could indicate that support may extend beyond the manufacturer's whims or even existence. And since the label wants to be affixed at time of sale, the incentive is on the manufacturer to get this support work done before they even ship.

Also, require a meaningful cybersecurity response. That is, they have a disclosure contact, they work with researchers to fix vulnerabilities under standard timelines, they pay bounties that make it worth researchers' time rather than incentivizing them to sell their vulns, and they check related products for similar vulns rather than playing perpetual whack-a-mole.

> The best you can hope for with a regulatory approach is to incentivize them to pay more lip-service to the idea

While I think this is true, there's also some benefit to getting the manufacturer's to pay lip-service to the idea.

In that, it becomes part of the marketing and the sales of the device. Later, consumers can _attempt_ to hold manufacturer's feet to the fire with false advertising and other fraud class action lawsuits.

It's really really not a good system, but even forcing a bit of lip-service is a marginal improvement over what we have now.

> Therefore, the most meaningful step would be to require support for open-source firmware.

I agree that it would absolutely be better, but it sounds like even this voluntary labeling program is the compromise that might be tolerated by the other members of the FCC. I'm guessing such a strong and effective program would be a non-starter with those members.

Which, honestly, tells me a lot about the other members of the FCC, and whose interests they are seeking to serve.

> Later, consumers can _attempt_ to hold manufacturer's feet to the fire with false advertising and other fraud class action lawsuits.

I would hope that this becomes relatively simple at some point.

1. I have this box that says I get updates until 2025-01-01.

2. It is 2023-09-05.

3. I have applied all available security updates.

4. Vulnerability X is still exploitable and has been made public to the manufacturer for 4 months.

5. Get full refund for defective product.

Obviously we are a long way from this. Especially 4 being hard to make a concrete rule for.

I think if the box says updates until the beginning of 2025, and they've stopped providing updates before then, you have a pretty good contract lawsuit against them. You'd have to show that their failure to issue a patch for four months constitutes a breach, but that is exactly the kind of thing that gets hashed out in lawsuits. You could even have a class action of all the owners suing the manufacturer. We think one of the great opportunities of this labeling program is to begin developing a caselaw of what it means to hold a manufacturer to the commitments on the label.

Yep, the labeling would enable exactly the kind of class-action false advertising/fraud lawsuits against companies that simply lie on the packaging.

So companies would be forced to disclose their actual level of support, and risk consumers not wanting the product, lie on their disclosure and risk a significant class-action lawsuit, or improve their level of support.

I would hope the market would tip us towards the latter scenario, but...we won't know unless we actually force disclosure of these things.

I figure like everything else, this will just advantage the fly-by-night imports who you can't sue in the first place. They will continue to have no incentive to comply with any laws whatsoever.

manufacturers are simply never going to be incentivized to take security seriously

I worry about this too, and it's one thing when it's a camera but another when it's a car, or electrical grid equipment, or chemical process controls, etc. You make a great point re clickwrap, and clearly clickwrapping your rights away should be something that we don't readily allow for a manufacturer receiving the federal benefit of a marketing label.

It could be that even a top-tier label will turn out to be meaningless. That would mean that we'd need to have "harder" regulation or that people would start demanding dumb devices. I hope that industry will respond productively to this voluntary effort so that the public doesn't get harmed and we are able to benefit from the real advantages of connectivity that's also secure.

I think open source firmware would be healthy for device manufacturers in the long term. Companies who build toasters should be competing on who can build the most reliable, energy efficient, long lasting, and aesthetically pleasing toaster possible, not on how much data they can harvest and sell. They're also not likely to recruit elite software engineers to write firmware, so the open source alternative will usually be of vastly superior quality.

Reply on news.ycombinator.com