ControlsFreak
No bio...
User ID: 1422
ControlsFreak
4d ago
There are of course substantial technical barriers to flying cars, but almost no one is even interested in trying to overcome them because the regulatory barriers to marketing them and getting the general public to be allowed to fly them are obviously insurmountable.
Here is where we get to the BZZZZZZZZZZZZZZZT part. Every couple years, I see another flying car concept from some start-up. Every couple years, it's technologically fucking absurd, because "there are of course substantial technical barriers to flying cars".
You have zero reason for anyone to believe that the core reason why we don't have flying cars is regulatory and not technological/cultural/practical, especially when I can see with my own two eyes that every proposal that comes up is obscenely whack from a technological/cultural/practical standpoint. Don't get me wrong, I'm no FAA-lover, and they would almost certainly get in the way, but they're the reason we don't have flying cars in the same way that Space Force is the reason we don't have aliens invading earth.
ControlsFreak
4d ago
Ok, so California required default passwords four years ago. Your nightmare world has already arrived. We've already crossed over the epsilon threshold. The boot has already eternally stomped the artist, and you should have already exited the terminally ill tech sector. I don't know why you're complaining now.
ControlsFreak
4d ago
Now this is the type of response I was hoping for! Actually engaging with the substance!
FRAM
Perhaps they'll issue a clarification, but from the note in this section, I think someone could read this as "memory"; it has "memory" right in the name! In general, I do expect there to be some clarifications along these lines as folks like you bring up additional concerns.
5.4-2 (unique IDs)
This one is conditional, and I imagine ultra-small or ultra-disposable devices won't qualify in the first place.
5.3.4/6/10 (updates)
Same here; conditional. We'd at least have to get down to the level of thinking about each of the devices you've mentioned in terms of the conditions.
Mandating that "For constrained devices that cannot have their software updated, the product should be isolable and the hardware replaceable" (5.3-15) could mean almost nothing, or it could require vendors to commit to support any optional part of a product until they retire an entire series.
Notice how they define isolable:
isolable: able to be removed from the network it is connected to, where any functionality loss caused is related only to that connectivity and not to its main function; alternatively, able to be placed in a self-contained environment with other devices if and only if the integrity of devices within that environment can be ensured
EXAMPLE: A Smart Fridge has a touchscreen-based interface that is network-connected. This interface can be removed without stopping the fridge from keeping the contents chilled.
In the section describing the rule, they continue:
There are some situations where devices cannot be patched. For constrained devices a replacement plan needs to be in place and be clearly communicated to the consumer. This plan would typically detail a schedule for when technologies will need to be replaced and, where applicable, when support for hardware and software ends
I think I would interpret this as, sure, you need to support any part of a product until you tell the customer that you're not supporting it anymore, and the type of support can vary.
SecureBoot (5.7-1), hardware memory access controls (5.6-8)
Yeah, I have a feeling that these aren't going to pop into the Mandatory category for a while. The real good news is that concerns are really of the type, "Will they at some point make these Mandatory, when it is still too soon?" Because pre-rule-dropping, I imagine the worry would have been of the type, "Will they make this stuff Mandatory now?" And, they, uh, didn't. I think this document shows a pretty decent level of care in getting some of the really basic stuff right and showing the industry the direction they'd like to go in the future. There's no telling at this point whether it'll all actually go that way; one has to imagine that there are differing worlds where it seems more/less plausible to upgrayyyed these Recommendatations into Mandatory.
guaranteeing cryptographic updates for the life cycle of the product (5.5-3)
Whereas this one, I think is fine, given their explanation:
For devices that cannot be updated, it is important that the intended lifetime of the device does not exceed the recommended usage lifetime of cryptographic algorithms used by the device (including key sizes).
How easy is that? You don't even have to update it at all. But if you do, then at least make sure your shit isn't trivially broken, at least so long as you're telling the customer that you're still supporting it.
ControlsFreak
4d ago
Irrelevant. Obviously, people can choose to regulate something specific away. The question is whether there has been "any" innovation in "any" other industry (that is, the non-bits ones that have more regulation). Unless you're claiming that the US has no regulation on the oil/gas industry, the shale revolution, which literally has changed the world at a geopolitical scale, is a huge counterexample.
But there are many others. Space X. Ozempic. Etc. It's really hilarious to have all the huge techno-optimists, who think that AI and tech more broadly is going to revolutionize literally everything, and at the same time, they imagine that the tiniest amount of regulation on fucking light bulbs will grind literally everything to a halt.
ControlsFreak
4d ago
I can easily commit to saying that no major IoT startup success is likely to be based in the UK any time soon.
Bruce Schnier noted that California had already implemented at least the number one item. Do you think that this is enough to also say that no major IoT startup success is likely to be based in California any time soon?
No chinesium lightbulb maker is ever going to bother with formally proving their code is correct because they don't care.
I don't believe anything in this requirement is aimed at formal code verification methods. I don't think that's a requirement that is on the table anywhere, except for perhaps some niche customers (e.g., military/space). Probably not even at most "critical infrastructure" places that could blow up or whatever.
I mean, honestly, if that's about all you have to say for what results from this, that no chinesium lightbulb maker is going to meet a standard that hasn't been proposed and that some critical application spaces are going to pay for good stuff anyway, that's kind of a nothingburger? Like, abstract senses about Europe (not even the UK) and wild references to John Galt aren't really "concerns" that can be addressed in context of the very specific document that we have in front of us. It really seems like you just don't have any meaningful concern that we can investigate.
ControlsFreak
4d ago
Ok, so not a prediction about consumers' willingness-to-pay slightly more for slightly more secure products. That's fine. It would have been an easy thing to make a prediction on if your step function catastrophic model was correct, but I think we can conclude by this much longer-term, contingent prediction that your step function catastrophic model really really wasn't ever a serious attempt at a model in the first instance.
Does TheMotte have a RemindMe bot that can come back in 20 years?
Flying cars actually are pretty close to my area of expertise, so I'm betting that you probably have some misconceptions of the reality on the topic. What do you think is "the way we talk about flying cars today"? Let's see if it reflects reality.
ControlsFreak
4d ago
You won't change it without breaking it such that it can't produce the new stuff any more.
This is just hyperbolic catastrophism. Hilarious, really. I mean, honestly. You can't possibly have a real argument for this. Did you really think that this was an actual argument? Or do you have some weird twisted argument that literally any epsilon>0 of regulation instantly grinds innovation to a halt? I hate to break it to you, but no one else believes this, because it's just not true. Not even remotely true. Tons of industries that are infinitely more regulated than tech still have plenty of innovation. There may be a tradeoff on some margins, yes, but your step function model is not remotely serious.
"Technokings" is not a reasonable description of the people building them. The people building them exist, and are not people with the regulated-industry mindset, where there are a ton of boxes to be checked and rechecked every time something is built or a change is made.
What shall we call them, then? "Bored Pandas", the culture of folks too bored by things like making sure there's no default password on their devices?
ControlsFreak
4d ago
If the UK wants to make such regulations it will reap the same sort of benefits: no toxic chemical pollution or chinese crap botnets, but also no innovation in these respective sectors.
So, will you then make a prediction along the lines of what I asked for in the OP? Are you predicting that tech companies will pull out of the UK rather than either upgrayyyeding their security practices for the world market or going with a dual product (one version that doesn't make absurdly basic mistakes for the UK market and one that does make those mistakes for the world market)?
The debate is only on the magnitude of the effect.
And I claimed that being forced to not have default passwords will have an incredibly low magnitude effect on innovation. Do you actually disagree with this, or do we agree?
I don't buy chinese crap that spies on you, I tell people not to buy chinese crap that spies on you and I shame people who do so in my social circles.
I do the same, but clearly that is not changing much about the world. Have you succeeded in changing the world through your evangelism?
Hell, I've spent years of my life writing symbolic execution software used specifically to make edge devices secure.
Then I'm sure you will be pleased that this work won't be going to waste by someone shaving a few cents off of the cost of your product by putting a default password on it. Honestly, hearing this, I'm really not sure what your concern is. Is it that your company's "We're Actually Secure" marketing is going to be slightly less effective, now that the floor has been raised? Did you really think that such marketing was really of all that much value in the first place? @The_Nybbler thinks that it's completely a waste and that no one would spend one red cent more for your secure product. Do you think he's wrong?
ControlsFreak
5d ago
But those people can't do it, because they aren't the people building the devices. The people being required to do it are the people you (gleefully) admit it is painful for.
Maybe their little subculture will change. It is a Culture War, after all.
The reason IoT devices have been an absolute security shitshow for years is no one except you and some European regulators actually gives a shit.
I mean, plenty of people care, including lots of technology and security experts. E.g.
There are no technokings building them
...wait, so those people aren't building them? Who is building them? People who aren't the artists and don't find following the regulation to be boring? Then we don't actually have any problem at all! I'm not sure what you've been complaining about this whole time.
nobody's going to pay a red cent more for an internet-connected light bulb that's more secure than some other internet-connected light bulb.
Well, now, if all the internet-connected light bulbs that are available in the store are more secure and cost one red cent more, will they still fly off the shelf? You've resisted making any tangible prediction here. I think it's because you know that they will still sell just fine for a tiny amount of additional money.
ControlsFreak
5d ago
The difference is that it's easy to people who don't have a particular psychology or culture. You're concluding that it's not easy to certain folks, which is perfectly compatible with it being objectively easy to most people. Maybe it's even tedious, or as the dictionary would recast that word, boring, to you. But hey, I think we're making progress. The reason why IoT devices have been an absolute security shitshow for years is just because a small culture of powerful technokings think that it's too boring for them to fix the obvious problems that everyone knows are obvious problems and which are objectively easy and simple to fix. We may have reached agreement!
ControlsFreak
5d ago
Where is the innovation in any other industry over the past decades exactly?
You know, since they brought these in.
Let's go with a simple one - the shale fracking revolution in the oil/gas industry. But nobody is actually going to go counting these things, because no one really has any sort of consistent argument for which sorts of regulations stifle innovation. Again, I totally realize that they do sometimes, in some ways. But what sort of massive innovation is going to be stifled by requiring devices to not have default passwords? Like, surely we can agree on that one. We could at least leave open arguments for other requirements, and I would welcome a wide-ranging debate on them. But if we're stuck with just theoretical arguments, totally disconnected from any specifics, in a way that can't capture basic truths like, "Being forced to not have default passwords is not a significant barrier to innovation," then we're not going to get anywhere.
I complain about having to fill forms, you retort about the justifications for the form existing as if I didn't also have such a concern.
Ok, so you also have a concern about default passwords. What are you going to do about your concern?
ControlsFreak
5d ago
Your original post expresses considerable contempt for "tech folks" and demonstrates absolute joy for us having regulation "dropped" on us "in a much stronger way that you really won't like." This really doesn't fit with an idea that you think the regulations will be anything like easy or simple to follow
This does not follow. It's just a non sequitur. It can be easy and simple to follow, but incredibly grating to the personality of "artists". They don't like coloring inside the lines, even if it's easy and simple to follow.
ControlsFreak
5d ago
Compliance is a huge industry.
Weird. I hear about that from my friends in literally every other industry ever. They still seem capable of operating.
What isn't seen is how much harder it is or will be to get funding for a startup that designs novel appliances because the costs to enter the market are now higher.
I'm always sympathetic to concerns of regulatory capture putting barriers to entry in front of small businesses. Totally agree that this is the single strongest argument against these types of requirements. I just doubt that these particular requirements are that onerous. Plenty of smaller shops that actually care about not being a security clusterfuck already do these kinds of things, and you can do most of them without too much difficulty as a hobbyist. In any event, if you're a start up that can't figure out how to not have a default password on all your devices, I actually kind of don't want you selling stuff, anyway.
ControlsFreak
5d ago
Totally get where you're coming from. However, the last paragraph has I think the most important bit:
everything other than plugging in something
Most IoT devices are billed as, "You just plug it in, and it just works!" No one anywhere is standing at a store, looking at the baby monitors, seeing that one of the options lets them listen to it from their phone, and thinking, "Ya know, I really better not think about buying this and plugging it in unless I become an expert in network security." Just how no one stands in a store looking at toasters, thinking, "Ya know, I better not think about buying this and plugging it in unless I become an expert electrician." Like, should people learn more about network security and how their electrical system works? Yeah, sure. But while the breaker boxes in the store might have some sort of warning on them or cultural expectation saying that they mayyyyyybe shouldn't buy it and try to install it on their own without any expertise while the toaster doesn't have anything of the sort, nobody's internet devices have any such warning or cultural expectation. Even effin' routers, people just buy the box and plug the box in; it's easy! It's magic! Best case, they have the guy from the ISP show up to plug in the modem and the router, but he's not going to be fiddling with the security settings for them, either. Everyone is perfectly happy just letting it seem like plug-and-play magic.
ControlsFreak
5d ago
I don't follow your line of reasoning. Can you speak plainly, please?
ControlsFreak
5d ago
The good news is that it reads like they're expecting that companies will just publish this document on their website along with other support documentation. So, it won't be long until we get to see some and find out whose prediction is closer to accurate. As for the prediction of availability, would you like to predict anything specific about companies pulling out of the UK market?
ControlsFreak
5d ago
the reams of paperwork and signoffs necessary
My read is that they literally just need to fill in that table that I mentioned on page 32. That's not a lot of reams.
I guess you're a Real Engineer
I am most decidedly not a Real Engineer.
I think a big reason bits have continued to grow while everything else has stagnated is the regulators haven't caught up with the bits yet
Like I mentioned, we will see if the economy of bits will grind to a halt... or if they'll take the couple days necessary to not have a default password and to write "Yes, we don't have a default password" in the table on page 32. Perhaps you could formulate your prediction in numerical terms? Maybe something about growth rates in the tech sector over the next ten years? Maybe something about stock prices and how they'll reflect this immense stagnation? Or maybe an explanation for why the market hasn't already priced this in and had a massive drop in valuations in the past week in response to oppressive new regulation?
ControlsFreak
5d ago
The "S" in IoT stands for Secure
Boy, looong ago now, I broached the topic of security standards for techno-mabobs. At that time, I mentioned that the UK was considering some legislative proposals on the matter. I can't find the comment where I described what I viewed as the core driver of the tension over the topic - the culture of tech folks. That is, they are so used to the 90s consensus that software is gee wiz magic that is pure and sanctified, is the solution to world peace and all of life's problems, and can never possibly be the cause of anything bad, ever. The 90s conclusion was that government absolutely can. not. touch it. Hands off. No regulation whatsoever. No liability whatsoever. No matter what happens, they must have an absolute immunity stronger than even the strongest version that Donald Trump could have ever dreamed of claiming.
Justifications for this view have shifted, but I've always felt they've had a flavor of, "We can't be regulated! We're autistsartists! We make unique snowflake masterpieces! We have to move fast and break stuff! If we're ever held accountable for breaking anything, even for the most egregious of practices, then the entire economy will grind to a halt!" Whelp, after years of incident after incident exploiting the IoT-of-Least-Resistance, including things like ransomware takedowns of major corporate networks and huge botnets of smart refrigerators, we're about to see how true that really is.
Hitting the wire last week, the UK has dropped regulation for smart devices that are sold there. In my original comments five years ago, they were proposing three items; I had only asked for one (the most incredibly basic one - don't have every bloody device have the same default password). I really feel like it's a case of, "If you resist and throw enough of a shitfit over the really simple stuff, it's going to come back around in a much stronger way that you really won't like." The full document of "Baseline Requirements" speaks to fourteen items:
● No universal default passwords
● Implement a means to manage reports of vulnerabilities
● Keep software updated
● Securely store sensitive security parameters
● Communicate securely
● Minimize exposed attack surfaces
● Ensure software integrity
● Ensure that personal data is secure
● Make systems resilient to outages
● Examine system telemetry data
● Make it easy for users to delete user data
● Make installation and maintenance of devices easy
● Validate input data
● Data protection provisions for consumer IoT
Each area is broken down into one or more specifics. There's a helpful table on page 32, detailing whether the requirement is Mandatory, Recommended, and/or Conditional. This is important to know, because a bunch of them are truly just recommendations, but even many of the ones that are Capital M Mandatory are also Conditional, which is actually displaying quite a sense of care about the diversity of devices and possible situations. For example, they acknowledge things like "constrained devices", which is a "device which has physical limitations in either the ability to process data, the ability to communicate data, the ability to store data or the ability to interact with the user, due to restrictions that arise from its intended use". Here, they give some explicit examples, like "The device cannot have its software updated due to storage limitations, resulting in hardware replacement or network isolation being the only options to manage a security vulnerability."
I think this truly is a culture war between the culture of technokings and the culture of They Can't Keep Getting Away With This, and no culture war offensive ever comes without a counteroffensive. Will major corporations, either American or Chinese, bow the knee? Will they pull out of the UK in a weird, polar opposite anti-security stance to the position that has led other companies to pull products like Signal/Telegram from countries that threatened to make them less secure? The UK may be the sixth largest economy in the world by GDP, but that's still only about 4%. Will they go full tizzy and make separate products, where the secure versions go to the UK and the less secure versions go elsewhere? If they don't pull out and don't make different versions, than everyone in the world just got a huge security upgrayyyed. If they don't pull out and make different versions, other countries have a green light to mandate that they should also get the good stuff. So, if they're even thinking about pulling out, they've gotta rally the troops, punish any defectors, and really make the UK feel blockaded as a warning shot to the rest of the world.
My guess is that they'll bow the knee and just do this stuff for everyone. It's pretty much all stuff that everyone has known that they should be doing for quite a while now. Will it cost a little extra? Sure. Will they have to deal with some annoyed developers who feel constrained by law, as basically every other industry ever does, and eventually have to bring their culture into the Industrial Age? Sure. I doubt that having to pay $9 for a smart plug instead of $6 is going to change much about the economics of wiz bang gizmos... but it just might be a step toward not having newspapers filled with nightmare exploits causing millions in damage... at least not every week.
ControlsFreak
8d ago
Good news! The price system has your back! As we continue using up all these finite resources, prices will rise, and people will naturally shift to alternatives out of their own self-interest. The bonus is that you don't even need to do anything. You don't need to say anything; you don't need to argue online for a position; you don't need to ban/subsidize anything; you don't need to organize any rallies or political movements. You can just be happy in your own personal knowledge that the future will give you your preferred reality and your own personal confidence that the prices of your selected set of finite resources will certainly rise in the future. You might even make some speculative wagers in futures markets that could make you a bundle of money with which you can extra enjoy the future world. After all, that's why prices of hydrocarbons just kept ramping up from the early 2000s and there was no technology change whatsoever that reversed that trend. One thing is for sure; we're absolutely not heading to a world where we get more value out of using less stuff (on an absolute scale, not marginal).
ControlsFreak
9d ago
Use gum to get a mild stimulant effect and weak habit forming. Suuuuper easy for me to stop using it weeks at a time, like for just taking a trip or something.
ControlsFreak
10d ago
This is an extremely accurate description of the phenomenon, and it's prevalent here as well, contributing to Hlynka's observation that a surprising number of the commenters here have built their positions on the same fundamental ground as the progressive left, though they want to vehemently deny it, as well as my observation that this turn to stealth moral relativism packaged in confusion came, in large part, due to New Internet Atheism convincing a lot of folks to at least claim a jettison of moral realism, but not knowing how to handle it philosophically, and leading pretty directly into the dominant frame being one of pure power politics along the lines of cancel/deplatform/shame woke-style culture.
So far, when I've prodded, I've seen one commenter embrace the conclusion in a clear-eyed manner, but more often, folks just lean in to the mire of completely confused meta-ethics. After seeing your excellent trilemma, it makes sense that it seems common to appeal to game theory, even if it's still a confused appeal, because I'm starting to think that the appeal to game theory is basically a variant of "the right side of history". One doesn't need to do any of the hard work of showing why an iterative game theoretic process will actually converge to the "right" solution (because one cannot commit to positing a "right" solution), but you can see in those threads that they are utterly allergic to embracing a straightforward appeal to power or preference. So we get weaksauce meta-ethics that make it obvious to any real, existing agents who actually understand game theory and can think through the process of unilateral defection (perhaps at the level of a movement/group of 'insiders') and realize that no one is able to present a meaningful argument against pure exertion of cultural power, so the obvious game theoretic response is to do precisely that. It's like they sort of realize that they're playing something akin to prisoner's dilemma, but weirdly think that invoking "the right side of history" or vague "game theoretic concerns" will certainly result in cooperate-cooperate, but simultaneously not understanding game theory enough to know that it actually leads to "the wrong side of history", defection, and pure power.
ControlsFreak
12d ago
Hlynka-in-theory, as a conceptual perspective, as opposed to Hlynka-in-practice.
ControlsFreak
12d ago
There is truly a Hlynka-sized hole in the moderation team. This kind of petty shit is getting worse and worse, and the King's court is really struggling to conceptualize their subjects as agents.
ControlsFreak
12d ago
If it's cardio and a motivation problem, just go to something like a spin class. When I was doing it, it was much cheaper than personal training, given that one trainer could manage the entire class of people rather than just one. I used to joke that I found cardio so boring that it was impossible to motivate myself, so the only way I could do it was to have someone basically yelling what I was supposed to do at me.
Ok, cool. Then epsilon regulation doesn't instantly kill 100% of innovation.
Well, then we can probably dig back into the history books to find the first actual regulation that was placed on the tech industry. Whenever it was, it was in the past. The complaint that if we have epsilon regulation, it will definitely be a slippery slope to infinite regulation was valid then, but we're past that threshold now. Now, regulation is a dynamic process; the question is whether this regulation is part of a slippery slope toward infinite regulation, or if it's actually mostly basic shit that everyone has already known they should be doing anyway.
I mean, no? It's literally TheMotte. And this betrays that your reasoning doesn't even follow the Motte/Bailey dynamics. It was:
If anything, you're the one who is making bold, controversial statements (that innovation will grind to a halt, that no innovation happens anymore in any other industry that has any regulation). There's nothing comparable happening in the other direction. What even is the Bailey that you speak of?
EDIT: Your Bailey seems to be "an epsilon regulation grinds innovation down to zero". When someone challenges you on this, you retreat to an obvious, uncontroversial statement, like, "Regulation is dynamic," but try to sneak in some not-fleshed-out argument about a slippery slope implying infinite regulation. When pulled back to reality, and you're challenged to engage with actually-existing regulation, you're actually pretty silent, unlike at least gattsuru, who at least engages with what's actually going on rather than fever dreams. Why isn't the vastly more reasonable view that you're engaging in a Motte/Bailey argument, while not being able to point to any sort of Bailey from the other side?
More options
Context Copy link