ControlsFreak
No bio...
User ID: 1422
ControlsFreak
5d ago
Nobody is arguing
The argument is, instead, that adding a regulation increases the chance that we will slide down that slippery slope.
This is a vastly better argument, but one that wouldn't allow us to then simply reject any continued discussion, just because we've 'declared' slippery slope and observed that we're epsilon on it. For example, one might ask about the underlying reason for why it increases the chance that we will slide down it? The answer could take many forms, which may be more or less convincing for whether it does, indeed, increase the chance. See here for some examples, and feel free to click through for any specific sub-topics.
Section 5.4.1, "sensitive security parameters in persistent storage shall be stored securely by the device," seems a bit more likely to be a costly provision, and IMO one that misunderstands how hardware security works (there is no such thing as robust security against an attacker with physical access).
IMO, it shows that you misunderstand how these things work. They're not saying "secure against a nation state decapping your chip". They actually refer to ways that persistent storage can be generally regarded as secure, even if you can imagine an extreme case. To be honest, this is a clear sign that you've drunk the tech press kool aid and are pretty out in whacko land from where most serious tech experts are on this issue. Like, they literally tell you what standards are acceptable; it doesn't make any sense to concoct an argument for why it's AKSHUALLY impossible to satisfy the requirement.
And then there's perplexing stuff like 5.6.4 "where a debug interface is physically accessible, it shall be disabled in software.". Does this mean if you sell a color-changing light bulb, and the bulb has a usbc port, you're not allowed to expose logs across the network and instead have to expose them only over the usbc port?
H-what? What are you even talking about? This doesn't even make any sense. The standard problem here is that lots of devices have debug interfaces that are supposed to only be used by the manufacturer (you would know this if you read the definitions section), yet many products are getting shipped in a state where anyone can just plug in and do whatever they want to the device. This is just saying to not be a retard and shut it off if it's not meant to be used by the user.
ControlsFreak
5d ago
My personal way of squaring that circle is that I'm open to regulation on mass-produced end-user consumer goods, and a more freedom on anything that requires some deliberate action.
I think this is very reasonable, and these regulations pretty much go after just that. Consumer IoT devices, that are being mass-produced and just thrown onto the internet by the billions. What's worse is that they're making the same handful of mistakes over and over and over and over and over again, even though everyone and their dog knows that they can fix these things (at least the worst problems; not every problem) using even just a small number of best practices. A small number of things that every expert technologist has been screaming, "OH MY GOD PEOPLE JUST DO THIS SHIT WHY WON'T YOU DO THIS SHIT IT'S SO EASY AND WOULD PREVENT SO MANY PROBLEMS!" Things that they don't do because they don't have to. There's no law making them. They're Chinese, but their devices are being sold in the US, so fuck the US anyway. And even if they did do them, it would cost them epsilon amount of money, and they'd never be able to market it as anything to make them more money, besides, all their competitors are just churning them out as cheaply as possible without bothering, and they're not suffering for it.
There are many edge cases, and gattsuru brought up a lot of good cases that may be difficult. Things that might legitimately contribute to a regulation-innovation tradeoff. Most of them still seem kind of minor, so while they might produce some small tradeoffs, I think it's unlikely that they're going to wholesale preclude innovation. There's still going to be plenty of innovation, though there may be some edges that are unfortunately trimmed. Is that worth saving the nightmare of having billions of adversarial objects, likely quickly and easily controlled by the Chinese or Russians, literally everywhere on all our networks? Maybe not. But maybe so?
ControlsFreak
5d ago
you haven't produced any reasoning as to why regulation isn't a slippery slope while I can point to the development of essentially any technology since 1940 to affirm it.
I don't actually see how your argument here is supposed to function. Can you spell it out for me?
You seem ready to argue elsewhere in this thread that the very idea of the slope being slippery is ridiculous and unfounded
Nope; literally never did that. Please don't waste our time strawmanning me.
what is your positive theory of the interaction of regulation and innovation, does it have any limiting principle and how does it maintain the innovation cycle and competition in the face of the interests that inevitably act on it?
I think there is often a general sense of a regulation-innovation tradeoff. It happens in different ways in different places, and it's often area specific, many times in ways that you might not expect. It's a really tough problem, so I'm generally in favor of fewer regulations, especially when they're not pretty decently well-tied to a specific, serious problem. I think that a lot of the time, you can maintain the innovation cycle and competition by being careful and hopefully as light-touch as possible with regulation. Some examples would be that if (and this is a big if, because I would actually disagree with the ends) you want to reduce carbon emissions from powerplants or noxious emissions from tailpipes, it's better to do things like set output targets and let the innovation cycle and competition figure out how to solve the problem rather than mandate specific technological solutions that must be adopted for the rest of time, no questions asked. Of course, this is an easy example, and many situations can pose more difficult problems; I'm probably not going to have the answer to them all off the top of my head.
This requirement seems mostly focused on some of the most egregious practices, and it appears that they at least try to leave open the possibility that people can come to the table with innovative solutions to accomplish the "aspirational text" (as gattsuru put it), even if it wasn't a solution that they specifically identified. It may be possible that we have some other big breakthroughs in the field of network security that make some of these line items look ridiculous in hindsight, which is why I would also say that a grossly under-resourced effort across regulation regimes is hunting for precisely any items that may have been deprecated, so they can be promptly chopped. I lament that this is not done well enough, and it's likely one of the major contributors to the general sense of a regulation-innovation tradeoff.
I reject the concept that as soon as epsilon regulation of an industry is put into place, it necessarily and logically follows that there is a slippery slope that results in innovation dying. I think you need at least some argument further. It's easy to just 'declare' bankruptcy a slippery slope, but we know that many end up not.
ControlsFreak
5d ago
I think that would be a clear case of malicious regulation, which is an entirely different class of problem. That is to say, if we were discussing something like laws about business records fraud or campaign finance, we'd talk generally about how it generates friction in business processes or has some potential to chill some amount of speech around the edges, and that would be a totally valid discussion with real tradeoffs. But I think it would be an entirely different conversation than talking specifically about Trump being maliciously prosecuted in NY; that has about jack-all to do with real tradeoffs in the space of business records fraud law or campaign finance law; it it purely about malicious actors reaching for literally any tool they can find to hit someone over the head with.
ControlsFreak
5d ago
CMOS RAM
Fair enough. Hopefully the worst case is that this ends up not being covered, even though it should be.
5.4-2 (unique IDs)
I think I can agree that there may be tradeoffs here for some devices.
twenty sensors on a LIN line
I think these would almost certainly just be classified as "constrained devices", and they also give alternate mechanisms for valid trust relations, which I think will be what the automakers go for. They'll do the verification at a different step and say that the lack of physical or other access is what ensures that presence on the network is sufficient.
A presumption toward encrypting everything makes sense when it's free or nearly-free, but there are a lot of entire devices where it's just not that relevant. If your equipment does literally nothing but relay temperature and humidity values over ISM bands, you might want some amount of authentication to prevent spoofing, but it's really not that big a deal if someone can listen in. And there's a lot of IoT stuff that goes into that category.
There's some parts of the rules that motion around this -- 5.5-1's "Appropriateness of security controls and the use of best practice cryptography is dependent on many factors including the usage context" or the exceptions for ARP, DHCP, DNS, ICMP, and NTP in 5.5-5 -- but again that turns the requirement into aspirational text.
I think you're right that some portion of this is aspirational text, but I think it's along the lines of, "If you can just put some reason down on the table for why this should be considered aspirational text, then you're probably fine," and the only people who are at risk are the people who are doing the clearly and obviously boneheaded stuff. Like, I don't think it's going to be hard for the maker of a device that does nothing but relay temperature and humidity values over ISM bands to just say, "It's a constrained device; can't do any of that fancy stuff; pretty much no way in anyway," and we can all mostly go home happy. If we start having major corporate networks brought down by botnets of temperature monitors (uh, how?), then perhaps folks will have to figure out how to make it more than aspirational text.
In any event, thanks a bunch for really thinking through edge cases for a wide variety of really specialized and, for lack of a better term, really constrained devices.
ControlsFreak
5d ago
Because not all slippery slopes logically entail exactly whatever anyone can just throw out there as a possible conclusion? So, perhaps, you're throwing out "death of innovation" as the end of the slope, but that's actually akin to "dog marriage". And someone else might throw out a different possibility as the end of the slope, and that's akin to trans stuff. A reasonable conversation can be had about the connection between gay marriage and those two different possible end points, just like a reasonable conversation can be had here about this regulation and different possible end points.
Let's kill those last two sentences and try again, then. Or do you think that "reasonable conversation" is a cudgel, also? Maybe we can try:
Because not all slippery slopes logically entail exactly whatever anyone can just throw out there as a possible conclusion? So, perhaps, you're throwing out "death of innovation" as the end of the slope, but that's actually akin to "dog marriage". And someone else might throw out a different possibility as the end of the slope, and that's akin to trans stuff.
Please respond on how you think about these problems. I won't even imply that your response should be reasonable or rational, but I'll probably be looking for these features, anyway.
ControlsFreak
5d ago
Sorry, I realized that there was one part of my prior comments that could be misinterpreted, so I deleted my comment and redid it. I also posted in haste the first time. I thought I deleted it quickly enough that it wouldn't matter. My apologies.
ControlsFreak
5d ago
I said you should start with anything anyone can bite into.
By all means, bite.
where is the part where they say they death of innovation is instantaneous and absolute? If you can't show that part, you have misrepresented their view precisely to the amount you are claiming they have misrepresented yours.
Here, there is one part of my language that I admit may be ambiguous and possibly misread. The "instantaneous" piece means "the premises necessary for the instantaneous logical chain of implications". Remember, they are explicitly claiming that once you are epsilon past the line, it's not worth even talking about. I take that to mean that instantaneously, in that moment, the entire logical chain of the slippery slope has been instantiated, and the conversation is over. I do not mean to imply that they think that innovation, itself, actually stops instantaneously. But they do actually mean that, in that moment, instantaneously, the game is over, the logic is iron-clad, the implications flow immediately, and the only conclusion is absolute death. That absolute death may take some time to culminate, in my understanding of their view, but that it is absolutely inevitable is instantaneously concludable from the moment that you cross over the epsilon regulation mark.
ControlsFreak
5d ago
Because not all slippery slopes logically entail exactly whatever anyone can just throw out there as a possible conclusion? So, perhaps, you're throwing out "death of innovation" as the end of the slope, but that's actually akin to "dog marriage". And someone else might throw out a different possibility as the end of the slope, and that's akin to trans stuff. A reasonable conversation can be had about the connection between gay marriage and those two different possible end points, just like a reasonable conversation can be had here about this regulation and different possible end points. You would simply terminate the conversation immediately and conclude that it must be dog marriage/death of innovation. This seems like a pretty obvious non sequitur, a conversation killer, a mind killer, and the enemy of rational discussion.
ControlsFreak
5d ago
I started by opening the conversation to a variety of perspectives on the issue at hand and an observation on the culture war component of it. I did not claim to endeavor to present a complete framework, nor has anyone even asked me to. When folks have wanted to have interesting discussions on particulars, I've engaged, and it's been fruitful. Full of details. Plenty of information about my position. I haven't even asked for a full and complete framework from anyone; even just a little attempt at talking about types of slippery slopes and such would be fine, but what I've gotten in return is literally on the level of, "Gay marriage, slippery slope, dog marriage, QED." Thinking that we can mayyyyybe do a tiny bit better than that in thinking about a framework for understanding slippery slopes is not a demand for a complete and total theory. It's a request to even try.
I never once misrepresented my opponents' views. They still explicitly claim that I represented them appropriately. Nor have I once demanded that they get mine exactly right. It is entirely a mess that they have created. Perhaps they viewed my observation of the culture war component as a sneer, got personally offended, and lost all capacity for rational argumentation, and I could be partially blamed for that. In that case, I would suggest that you focus on what part of my observation of the culture war component was wrong, for just because it was interpreted as a sneer and caused offense does not mean that was not true and necessary.
ControlsFreak
5d ago
Ok, so once we're epsilon onto a slippery slope, you're "not going to argue about the specifics". Got it. So, you could just respond to those comments by explicitly stating this, yes?
Do you hold this position for all possible claims of slippery slopes? Do you agree that gay marriage is just one more spot on the slippery slope to marrying dogs, and any argumentation about specifics is somewhere between fruitless and an entirely misguided endeavor? Or do you think there is room to discuss some sort of framework for claims of slippery slopes, that perhaps all slopes might not be equally slippery, or something along these lines? Or just nah to all that. "Gay marriage, slippery slope, dog marriage, QED." ?
ControlsFreak
5d ago
We're having a nice conversation here about the regulation in question. That is a good way of having a discussion about having non-zero regulation, but hopefully not too much of it. One can argue that some of the specifics are, in fact, too much of it, but that's what that conversation looks like... not the mess the other guys are doing.
One could even go after a "framework for analyzing", even in slippery slope situations. Here's a good example of how to construct such a framework, and I think rich conversations could be had. In fact, it could even be beneficial to have a top-level comment that branches off from Volokh's work to have a nice robust discussion on how to construct an appropriate framework.
But they're still refusing to have any sort of framework, discuss any sort of specifics, nothing. Just that they have declared that the slope is slippery, and nothing more need (or can) be said. That is it. That once we have passed epsilon, we are on the slope, one cannot discuss frameworks anymore, and doom is upon us. This is not a strawman. This is a repeatedly stated position, stated openly, and resistant to any attempt to bring the discussion back to the type of thing that you would like.
ControlsFreak
5d ago
I disagree with your assessment of what "being capable of operating" entails, as we have gone over already.
We discussed shale fracking. Now Space X, ozempic, Matt Levine gives tons of examples of financial innovation, we're damn close to self-driving cars, but the hol' up is the tech, not the regulation. The list goes on and on. I do not see any more content in your comment that is anywhere near suitable to claim that we can simply declare this "gone over already". If anything, you just dropped it, because your position didn't go anywhere.
Let's make sure we're on the same page here, so that we are at least confident that we're both actually really ready to engage the slippery slope question honestly, without leaving room for a retreat in this direction. Are other industries capable of operating with some amount of regulation? Not, "Is there a general sense of a regulation-innovation tradeoff?" We agree that there is. The straightforward statement that many other industries are capable of operating with some amount of regulation. Are you going to stick with the position that this is an outlandish Bailey? Or is it simply a true fact about the world, and we can shift the discussion toward slippery slopes?
ControlsFreak
5d ago
The Motte and Bailey. You Bailey your way to claims about the FAA and navigation automation, but then immediately retreat from defending it. You simply refuse to argue any specifics about any portion of the Bailey.
You retreat to a Motte of simply rejecting any epsilon of regulation ever, but refuse to acknowledge any actual claim that this position makes.
This is the quintessential form of reasoning that this place was made to reject.
The Bailey is "I hear about [extensive compliance] from my friends in literally every other industry ever. They still seem capable of operating."
This is a true statement about the world, not an outrageous claim, newfriend. You may be thinking that those words mean something other than what those words mean. What are you thinking they mean?
My own consistent position is that this regulation is a small advance that is inconsequential by itself but proceeds in a direction that is ultimately incompatible with innovation and that assenting to it is a slippery slope.
Great! We can surely then have a reasoned discussion about the nature of slippery slope arguments, trying to understand when they hold, to what extent they hold, and whether the premises required for them to have force are present here. I have never objected to the concept of a slippery slope arguments, but it does need some something behind it, otherwise it leaves us vulnerable to just any crazy extrapolation of anything in any domain. We probably wouldn't respond to, "Gay marriage is a slippery slope to marrying dogs!" with, "H-yup. All slippery slope arguments are perfectly valid and correct in all conclusions."
ControlsFreak
5d ago
If you're going to just ignore everything I wrote, then we're probably not going to make any progress. Perhaps we could leave this tangent where it is, and you can actually specify your claim, so that we can determine whether this tangent is even meaningful to your actual claim. Or if, ya know, you're just whining about the world.
Or, of course, you could read what I wrote and actually respond to it. You could show your expertise in flight navigation and control, particularly with regards to automation technology. You could make an argument that actually competes with mine, in order to show that I have mistaken some points of fact or something. What is non-responsive is just pure imagination about hypothetical alternative realities, completely disconnected from any facts about the world.
ControlsFreak
5d ago
the user isn't reading the 100-page manual that probably already warns about this.
I don't believe any user manuals actually warn about any of these things. The manufacturers simply do not care about security, because they don't have to, be it built-in, in manuals, or in advertisements.
it's not as easy as "just make the device idiot-proof, like toasters!"
Totally and completely agreed. I started off saying that one way we could fix this is to do something extremely simple, like banning default passwords. No manufacturer is going to put on their box whether they have a default password or not, so many consumers aren't going to know.
There has been some efforts in the US to create a Cyber Trust mark, where that is an indication that they have been built to some sort of standards (that aren't that far off from these regulations). This is a plausible approach, though we likely won't see whether it would have been effective (are consumers going to be paying close attention for this mark on a box full of ten other certification marks?), because they're probably just all going to bring their devices up to the UK standard. Could have been an approach, though.
ControlsFreak
5d ago
Drone regulation went from zero to some. We could debate the merits of specifics there, as well, but does anyone seriously hold that, after having gone from zero to some drone regulation, all innovation in drones is crushed to zero, that everything is doomed and that nothing can be saved?
In any event, drones have different concerns than manned aircraft. I wholly expect that a detailed discussion about the similarities/differences would be rich and fruitful, but what is not rich and fruitful is observing that drone regulation has gone from zero to some and concluding that it must be impossible that the FAA is opening up to alternative navigation and control systems for manned aircraft, especially since the conclusion is factually false.
ControlsFreak
5d ago
Understood and agreed. We'd then have to shift to a discussion about the theory of slippery slopes and regulation dynamics. I don't think @The_Nybbler is open to that discussion yet. He thinks that "there's no point" in discussing anything like that; once we've crossed epsilon, all is doomed, and nothing can be saved. If he'd like to walk back that claim and actually have a detailed and reasonable discussion about what happens after we cross epsilon, I am here and waiting, but he has to agree to those terms rather than constantly immediately shifting back to claiming that once you cross epsilon, all is doomed and nothing can be saved.
ControlsFreak
5d ago
Those were pretty much real-world constraints until automation developed enough to be a reasonable approach. This is very very very much directly in my domain of expertise. The good news is that the FAA has opened up to these sorts of "alternative navigation and control schemes". As an expert in the field, this reads to me very much as you just wishing that we lived in a different world, where this sort of technology was feasible a few decades ago, when it definitely definitely wasn't, regardless of what regulations existed/didn't exist.
Do you have a current complaint about the current regulation, or are you just complaining retroactively about California's regulation?
EDIT: It doesn't sound like you have a current complaint about the current regulation, because you say:
There's no point in talking about the specific merits of the specific regulations
But I want to make sure I'm not strawmanning you. Thus, I'm just trying to confirm that the appropriate understanding of your argument is that everything was doomed (at least) four years ago, and that you have nothing more to add. I think it could have saved us lots of digital ink if you had just spoken plainly about this being your position in the beginning.
ControlsFreak
5d ago
Let's look at the tape.
You can have protectionism and regulation if you want, but you can't get that and innovation.
You won't change it without breaking it such that it can't produce the new stuff any more.
The former person has at least walked it back to, "The debate is only on the magnitude of the effect.", and we have proceeded to have a more fruitful conversation since then. The latter obstinately refuses to make any more specific claims other than that the only thing you can do is to make it so that the industry "can't produce the new stuff any more". If they would like to walk this back from being in the land of hyperbole and into the land of reasoned argumentation, we'll be making some progress.
ControlsFreak
5d ago
What are you confused about? This is a standard question of regulation, and the standard objections are that regulation can harm innovation and present barriers to entry. I have welcomed any detailed discussion of these features, but have objected to hyperbolic versions of them, that any epsilon amount of regulation instantly kills innovation to zero, for example. Some folks have quadrupled down on this hyperbolic claim, and are now claiming that I am making a hyperbolic reverse claim - that regulation cannot possibly impact innovation in any way. This is a bullshit strawman.
That is the broad context of the discussion. I also observed some of the features of the culture war. I'm not sure what you're confused about.
ControlsFreak
5d ago
I have never objected to the idea that regulation can kill innovation. Try again. Actually read what I've said and respond to it rather than a strawman. You have to at least try.
Sure, if there are other threats, folks should mitigate those, too. You seem to be under the impression that if this document doesn't spell out precisely every detail for how to make every aspect of a device perfectly secure from all threats, then it's completely useless. That's nonsensical. It would be silly to try to include in this type of document requirements for physically securing door locks. This is just focused on the cyber part, and it's just focused on at least doing the bones-simple basics. Put at least some roadblocks in front of script kiddies. Full "real" security is obviously harder than just the basics, and I can't imagine it would be easy or really even plausible to regulate our way to that. So, we sort of have to say, "At least do the basics," to hopefully cut out some of the worst behavior, and then we still have to hope that the unregulated part of the market even tries to deal with the other aspects.
Not at all. They made no such normative statements. They're saying that IF the manufacturer includes a debug interface that they intend to not be a user interface, then they should shut it off. They're still completely free and clear to have any interfaces for debugging or anything else that are meant to be usable by the user. But if they're going to do that, they probably need to at least think about the fact that it's accessible, rather than just "forget" to turn it off.
More options
Context Copy link