Security quotes of the week [LWN.net]

Security quotes of the week

Posted Oct 20, 2016 10:39 UTC (Thu) by eduperez (guest, #11232)
Parent article: Security quotes of the week

> The market can't fix this because neither the buyer nor the seller cares. Think of all the CCTV cameras and DVRs used in the attack against Brian Krebs. The owners of those devices don't care. Their devices were cheap to buy, they still work, and they don't even know Brian. The sellers of those devices don't care: they're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution because the insecurity is what economists call an externality: it's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution.

This reminds me how the FCC deals with radio interference: there are rules about what radio signal a device may or may not emit, and the FCC enforces such rules; I think a similar scheme could be applied here.

to post comments

littering on the internet

Posted Oct 23, 2016 19:01 UTC (Sun) by Garak (guest, #99377) [Link] (1 responses)

This reminds me how the FCC deals with radio interference: there are rules about what radio signal a device may or may not emit, and the FCC enforces such rules; I think a similar scheme could be applied here.

In a sense, the goal of RFC-Garak1 above was an attempt to codify legal enforcement authority in this area. Unfortunately I get the impression there are too many voices here arguing the old non-regulation line on environmental pollution. I.e, my (business's) pollution is so small it isn't hurting anyone, therefore it is a horrible violation of my liberty to point the government's gun at my head making me a slave to their overbearing cleanup/prevention plan. However at some point, the aggregate harms to society increase until the point that the imposition on liberty becomes less onerous than having years shaved off the average human lifespan because of the aggregate effect.

I'm guessing things play out similarly here, as the harms from the aggregate of compromised devices polluting the internet increase. At some point the inconveniencing of device manufacturers and users with reasonable regulation and enforcement becomes less unpleasant than choking on the pollution on the internet. Pollution that also is used as a virtual smokescreen for more insidious malicious and criminal profit-motive based activity. (and *cough* unethical state surveillance *cough*)

littering on the internet

Posted Oct 25, 2016 9:36 UTC (Tue) by micka (subscriber, #38720) [Link]

Not at all. I actually would support regulation, I mean regulation of the devices that are allowed to be sold.
I don't think some rule that say users should fix they misbehaving devices they may not even know they have or how they work would change anything to the problem. That's more magical thinking in my opinion.
But don't grant conformity marking to devices that don't provide some minimal security properties (of course, a certified device in year X would probably not pass certification in year X+1 and yet still exist, but that's the same thing with cars without airbags).
And fine and/or refuse to certify new devices from a company that fails to update their devices or fail to do product returns.

That's how other kinds of devices (cars, electric saws) got less dangerous.