ControlsFreak
No bio...
User ID: 1422
ControlsFreak
2yr ago
Ok, so "read the whole post" means "ignore the first two thirds and just read the last third". Got it. Violates Grice's maxims and makes you a bad communication entity, but got it.
However reasonable a given rule is of no consequence if it enables unreasonable rules to be made and if unreasonable rule makers necessarily outcompete reasonable rule makers.
Ok, so flesh out those "ifs". In your long post, you spoke about power rising up to take power. In this context, it would sound like what you're worried about is cashing out in terms of regulatory capture/crony capitalism. That powerful corporate interests will rise to impose unreasonable regulations to form barriers to entry. This is a totally plausible thing to happen, and perhaps we could consider some reasoning for when this is likely to happen/not happen, and how damaging it is likely to be in a particular domain. Plausibly, this has something to do with the regulations in question or the regulatory bodies in question, or something. Or is this truly just a long-form way of restating, "Once we've crossed epsilon, the worst conclusion in inevitable."
ControlsFreak
2yr ago
I read the whole post. You started off talking about good regulation and bad regulation, then got to some considerations of slippery slope dynamics. Is the former part just irrelevant? I was going by Grice's maxims that it did, in fact, have relevance. It seems like it is relevant to the dynamics of slippery slope dynamics. If it's not relevant, please let me know. I'd especially like to know why you don't actually think it's relevant. Do you think that it actually doesn't matter whether something is a 'good regulation' or a 'bad regulation', and that the only thing that matters is the slippery slope part, where you think that all regulations end up in the bad category? If so, it would have been nice if you said something along these lines. I was just trying to go through your considerations in a systematic fashion.
ControlsFreak
2yr ago
The approach I outlined earlier, which you called reasonable, was to regulate mass produced end-user consumer goods, and let people who build stuff on their, or otherwise are reasonably expected to know what they're getting into, have a large degree of freedom. There wasn't a word there about changing anyone's culture, in fact the whole approach is designed to let everyone keep their culture the way they like it.
Nybbler would declare that this is, in fact, changing the culture of people who mass produce end-use consumer goods. That this is the only way, that we have to change their culture. If that is required, I am willing to do it. If you think that we can regulate them so that they don't churn out billions of trivially-hackable devices, without changing their culture, I'm fine with that. But they keep telling me that we can't do that! That we have to change their culture! That that's the only option!
I don't think it is, but I think the things you are saying here strongly imply that trivially hackable default passwords are just an excuse for you to destroy a culture you hate.
Not at all. I love the 'tinkerer' culture. I love the innovation culture. I love the building new stuff culture. I love coding and coming up with interesting new shit, though my day job is more on the new math side and I'm having less time for coding lately. The culture that I dislike is the "we can keep pumping out trivially-hackable shit because it might be slightly boring to take the basic steps everyone knows and nobody's going to do anything about it" culture.
ControlsFreak
2yr ago
Fair enough. If there is literally no way to change the culture to something that doesn't have trivially-hackable default passwords on billions of devices with anything other than unreasonable regulations, if this is honestly the dichotomy that you think exists in the world, then I guess I have to throw my lot in with the unreasonable regulations folks. But if you can come up with any plausible way to change the culture enough so that we don't have a spigot of trivially-hackable devices with default passwords on them, and your method is anything other than 'unreasonable regulation', I will jump to your side immediately. Nybbler has already committed to the claim that this is a complete impossibility, that the only options are "a culture that churns out trivially-hackable devices with default passwords" and "unreasonable regulations". Do you embrace this position, that those are the only two options?
ControlsFreak
2yr ago
Ok, I think we've made progress. It is literally impossible for the culture to bother taking the most basic steps to make the billions of devices on our networks not trivially hackable without causing some folks like you to shut down and stop being open to new ideas. These are the stakes as you have presented them. The only question that seems to be available to the general public is what they value.
Different folks can have different values and different answers. I personally fall on the side that I think you're actually just delivering a bullshit threat that is based on a lie. That it's akin to a child swearing that they're going to hold their breath until they die unless you let them have more cookies. No better than saying, "Nice IoT development space you have there; would be a shame if something happened to it." No better than a monopolist swearing that if you let others enter the market, shoddy products will kill everyone. That it's a false dichotomy, propped up just so you can avoid even the smallest iota of boredom, purely in your own self-interest.
But whatever. My opinion on that isn't important. You've laid down the stakes. Society made its choice years ago when California gave the first checkbox. The deed is already done. The only thing left is for us to watch what happens. Does innovation actually die? Do people actually just stop thinking about new ideas, because they might have to not put a default password on their new idea? I guess we'll find out.
ControlsFreak
2yr ago
What part would you like me to address? You spoke of "good regulation" and "bad regulation" first, so it would make sense to start with that discussion and then see how it flows into other pieces. I'm really not sure what you're demanding of me.
ControlsFreak
2yr ago
Can you propose a way that we could change the culture to "do the trivial basic shit so we don't have billions of abhorrently bad products permeating all of our networks"? I'm wide open to ideas you have for how to do this without making anyone check any boxes, but it seems a little unlikely that they won't have to somehow come up with a culture that at least considers having a box for "is this thing not trivially insecure against a handful of the most basic mistakes that everyone has known about for years?"
ControlsFreak
2yr ago
Those are plenty interesting general characteristics, and I don't object to much. Now, perhaps attention can be turned toward applying these ideas to the regulation at hand. I spoke to some reasons why I think this document leans much more toward the "good regulation" side than the "bad regulation" side. It seems plenty open to all sorts of innovative products in the IoT space and has very little that seems likely to affect the development of new features and products, except perhaps some edge cases. Any thoughts?
ControlsFreak
2yr ago
Not once in there did I say anything about it becoming an over-regulated morass. You can change your culture enough to do the trivial fucking basics without becoming an over-regulated morass.
ControlsFreak
2yr ago
If an attacker can read the flash storage on your door lock, presumably that means they've already managed to detach the door lock from your door, and can just enter your house.
[and similar examples given as reasons to discount 5.4-1]
Sure, if there are other threats, folks should mitigate those, too. You seem to be under the impression that if this document doesn't spell out precisely every detail for how to make every aspect of a device perfectly secure from all threats, then it's completely useless. That's nonsensical. It would be silly to try to include in this type of document requirements for physically securing door locks. This is just focused on the cyber part, and it's just focused on at least doing the bones-simple basics. Put at least some roadblocks in front of script kiddies. Full "real" security is obviously harder than just the basics, and I can't imagine it would be easy or really even plausible to regulate our way to that. So, we sort of have to say, "At least do the basics," to hopefully cut out some of the worst behavior, and then we still have to hope that the unregulated part of the market even tries to deal with the other aspects.
That said, the correct reading then seems to be "users should not be able to debug, diagnose problems with, or repair their own devices which they have physical access to, and which they bought with their own money."
Not at all. They made no such normative statements. They're saying that IF the manufacturer includes a debug interface that they intend to not be a user interface, then they should shut it off. They're still completely free and clear to have any interfaces for debugging or anything else that are meant to be usable by the user. But if they're going to do that, they probably need to at least think about the fact that it's accessible, rather than just "forget" to turn it off.
ControlsFreak
2yr ago
Nobody is arguing
The argument is, instead, that adding a regulation increases the chance that we will slide down that slippery slope.
This is a vastly better argument, but one that wouldn't allow us to then simply reject any continued discussion, just because we've 'declared' slippery slope and observed that we're epsilon on it. For example, one might ask about the underlying reason for why it increases the chance that we will slide down it? The answer could take many forms, which may be more or less convincing for whether it does, indeed, increase the chance. See here for some examples, and feel free to click through for any specific sub-topics.
Section 5.4.1, "sensitive security parameters in persistent storage shall be stored securely by the device," seems a bit more likely to be a costly provision, and IMO one that misunderstands how hardware security works (there is no such thing as robust security against an attacker with physical access).
IMO, it shows that you misunderstand how these things work. They're not saying "secure against a nation state decapping your chip". They actually refer to ways that persistent storage can be generally regarded as secure, even if you can imagine an extreme case. To be honest, this is a clear sign that you've drunk the tech press kool aid and are pretty out in whacko land from where most serious tech experts are on this issue. Like, they literally tell you what standards are acceptable; it doesn't make any sense to concoct an argument for why it's AKSHUALLY impossible to satisfy the requirement.
And then there's perplexing stuff like 5.6.4 "where a debug interface is physically accessible, it shall be disabled in software.". Does this mean if you sell a color-changing light bulb, and the bulb has a usbc port, you're not allowed to expose logs across the network and instead have to expose them only over the usbc port?
H-what? What are you even talking about? This doesn't even make any sense. The standard problem here is that lots of devices have debug interfaces that are supposed to only be used by the manufacturer (you would know this if you read the definitions section), yet many products are getting shipped in a state where anyone can just plug in and do whatever they want to the device. This is just saying to not be a retard and shut it off if it's not meant to be used by the user.
ControlsFreak
2yr ago
My personal way of squaring that circle is that I'm open to regulation on mass-produced end-user consumer goods, and a more freedom on anything that requires some deliberate action.
I think this is very reasonable, and these regulations pretty much go after just that. Consumer IoT devices, that are being mass-produced and just thrown onto the internet by the billions. What's worse is that they're making the same handful of mistakes over and over and over and over and over again, even though everyone and their dog knows that they can fix these things (at least the worst problems; not every problem) using even just a small number of best practices. A small number of things that every expert technologist has been screaming, "OH MY GOD PEOPLE JUST DO THIS SHIT WHY WON'T YOU DO THIS SHIT IT'S SO EASY AND WOULD PREVENT SO MANY PROBLEMS!" Things that they don't do because they don't have to. There's no law making them. They're Chinese, but their devices are being sold in the US, so fuck the US anyway. And even if they did do them, it would cost them epsilon amount of money, and they'd never be able to market it as anything to make them more money, besides, all their competitors are just churning them out as cheaply as possible without bothering, and they're not suffering for it.
There are many edge cases, and gattsuru brought up a lot of good cases that may be difficult. Things that might legitimately contribute to a regulation-innovation tradeoff. Most of them still seem kind of minor, so while they might produce some small tradeoffs, I think it's unlikely that they're going to wholesale preclude innovation. There's still going to be plenty of innovation, though there may be some edges that are unfortunately trimmed. Is that worth saving the nightmare of having billions of adversarial objects, likely quickly and easily controlled by the Chinese or Russians, literally everywhere on all our networks? Maybe not. But maybe so?
ControlsFreak
2yr ago
you haven't produced any reasoning as to why regulation isn't a slippery slope while I can point to the development of essentially any technology since 1940 to affirm it.
I don't actually see how your argument here is supposed to function. Can you spell it out for me?
You seem ready to argue elsewhere in this thread that the very idea of the slope being slippery is ridiculous and unfounded
Nope; literally never did that. Please don't waste our time strawmanning me.
what is your positive theory of the interaction of regulation and innovation, does it have any limiting principle and how does it maintain the innovation cycle and competition in the face of the interests that inevitably act on it?
I think there is often a general sense of a regulation-innovation tradeoff. It happens in different ways in different places, and it's often area specific, many times in ways that you might not expect. It's a really tough problem, so I'm generally in favor of fewer regulations, especially when they're not pretty decently well-tied to a specific, serious problem. I think that a lot of the time, you can maintain the innovation cycle and competition by being careful and hopefully as light-touch as possible with regulation. Some examples would be that if (and this is a big if, because I would actually disagree with the ends) you want to reduce carbon emissions from powerplants or noxious emissions from tailpipes, it's better to do things like set output targets and let the innovation cycle and competition figure out how to solve the problem rather than mandate specific technological solutions that must be adopted for the rest of time, no questions asked. Of course, this is an easy example, and many situations can pose more difficult problems; I'm probably not going to have the answer to them all off the top of my head.
This requirement seems mostly focused on some of the most egregious practices, and it appears that they at least try to leave open the possibility that people can come to the table with innovative solutions to accomplish the "aspirational text" (as gattsuru put it), even if it wasn't a solution that they specifically identified. It may be possible that we have some other big breakthroughs in the field of network security that make some of these line items look ridiculous in hindsight, which is why I would also say that a grossly under-resourced effort across regulation regimes is hunting for precisely any items that may have been deprecated, so they can be promptly chopped. I lament that this is not done well enough, and it's likely one of the major contributors to the general sense of a regulation-innovation tradeoff.
I reject the concept that as soon as epsilon regulation of an industry is put into place, it necessarily and logically follows that there is a slippery slope that results in innovation dying. I think you need at least some argument further. It's easy to just 'declare' bankruptcy a slippery slope, but we know that many end up not.
ControlsFreak
2yr ago
I think that would be a clear case of malicious regulation, which is an entirely different class of problem. That is to say, if we were discussing something like laws about business records fraud or campaign finance, we'd talk generally about how it generates friction in business processes or has some potential to chill some amount of speech around the edges, and that would be a totally valid discussion with real tradeoffs. But I think it would be an entirely different conversation than talking specifically about Trump being maliciously prosecuted in NY; that has about jack-all to do with real tradeoffs in the space of business records fraud law or campaign finance law; it it purely about malicious actors reaching for literally any tool they can find to hit someone over the head with.
ControlsFreak
2yr ago
CMOS RAM
Fair enough. Hopefully the worst case is that this ends up not being covered, even though it should be.
5.4-2 (unique IDs)
I think I can agree that there may be tradeoffs here for some devices.
twenty sensors on a LIN line
I think these would almost certainly just be classified as "constrained devices", and they also give alternate mechanisms for valid trust relations, which I think will be what the automakers go for. They'll do the verification at a different step and say that the lack of physical or other access is what ensures that presence on the network is sufficient.
A presumption toward encrypting everything makes sense when it's free or nearly-free, but there are a lot of entire devices where it's just not that relevant. If your equipment does literally nothing but relay temperature and humidity values over ISM bands, you might want some amount of authentication to prevent spoofing, but it's really not that big a deal if someone can listen in. And there's a lot of IoT stuff that goes into that category.
There's some parts of the rules that motion around this -- 5.5-1's "Appropriateness of security controls and the use of best practice cryptography is dependent on many factors including the usage context" or the exceptions for ARP, DHCP, DNS, ICMP, and NTP in 5.5-5 -- but again that turns the requirement into aspirational text.
I think you're right that some portion of this is aspirational text, but I think it's along the lines of, "If you can just put some reason down on the table for why this should be considered aspirational text, then you're probably fine," and the only people who are at risk are the people who are doing the clearly and obviously boneheaded stuff. Like, I don't think it's going to be hard for the maker of a device that does nothing but relay temperature and humidity values over ISM bands to just say, "It's a constrained device; can't do any of that fancy stuff; pretty much no way in anyway," and we can all mostly go home happy. If we start having major corporate networks brought down by botnets of temperature monitors (uh, how?), then perhaps folks will have to figure out how to make it more than aspirational text.
In any event, thanks a bunch for really thinking through edge cases for a wide variety of really specialized and, for lack of a better term, really constrained devices.
ControlsFreak
2yr ago
Because not all slippery slopes logically entail exactly whatever anyone can just throw out there as a possible conclusion? So, perhaps, you're throwing out "death of innovation" as the end of the slope, but that's actually akin to "dog marriage". And someone else might throw out a different possibility as the end of the slope, and that's akin to trans stuff. A reasonable conversation can be had about the connection between gay marriage and those two different possible end points, just like a reasonable conversation can be had here about this regulation and different possible end points.
Let's kill those last two sentences and try again, then. Or do you think that "reasonable conversation" is a cudgel, also? Maybe we can try:
Because not all slippery slopes logically entail exactly whatever anyone can just throw out there as a possible conclusion? So, perhaps, you're throwing out "death of innovation" as the end of the slope, but that's actually akin to "dog marriage". And someone else might throw out a different possibility as the end of the slope, and that's akin to trans stuff.
Please respond on how you think about these problems. I won't even imply that your response should be reasonable or rational, but I'll probably be looking for these features, anyway.
ControlsFreak
2yr ago
Sorry, I realized that there was one part of my prior comments that could be misinterpreted, so I deleted my comment and redid it. I also posted in haste the first time. I thought I deleted it quickly enough that it wouldn't matter. My apologies.
ControlsFreak
2yr ago
I said you should start with anything anyone can bite into.
By all means, bite.
where is the part where they say they death of innovation is instantaneous and absolute? If you can't show that part, you have misrepresented their view precisely to the amount you are claiming they have misrepresented yours.
Here, there is one part of my language that I admit may be ambiguous and possibly misread. The "instantaneous" piece means "the premises necessary for the instantaneous logical chain of implications". Remember, they are explicitly claiming that once you are epsilon past the line, it's not worth even talking about. I take that to mean that instantaneously, in that moment, the entire logical chain of the slippery slope has been instantiated, and the conversation is over. I do not mean to imply that they think that innovation, itself, actually stops instantaneously. But they do actually mean that, in that moment, instantaneously, the game is over, the logic is iron-clad, the implications flow immediately, and the only conclusion is absolute death. That absolute death may take some time to culminate, in my understanding of their view, but that it is absolutely inevitable is instantaneously concludable from the moment that you cross over the epsilon regulation mark.
ControlsFreak
2yr ago
Because not all slippery slopes logically entail exactly whatever anyone can just throw out there as a possible conclusion? So, perhaps, you're throwing out "death of innovation" as the end of the slope, but that's actually akin to "dog marriage". And someone else might throw out a different possibility as the end of the slope, and that's akin to trans stuff. A reasonable conversation can be had about the connection between gay marriage and those two different possible end points, just like a reasonable conversation can be had here about this regulation and different possible end points. You would simply terminate the conversation immediately and conclude that it must be dog marriage/death of innovation. This seems like a pretty obvious non sequitur, a conversation killer, a mind killer, and the enemy of rational discussion.
ControlsFreak
2yr ago
I started by opening the conversation to a variety of perspectives on the issue at hand and an observation on the culture war component of it. I did not claim to endeavor to present a complete framework, nor has anyone even asked me to. When folks have wanted to have interesting discussions on particulars, I've engaged, and it's been fruitful. Full of details. Plenty of information about my position. I haven't even asked for a full and complete framework from anyone; even just a little attempt at talking about types of slippery slopes and such would be fine, but what I've gotten in return is literally on the level of, "Gay marriage, slippery slope, dog marriage, QED." Thinking that we can mayyyyybe do a tiny bit better than that in thinking about a framework for understanding slippery slopes is not a demand for a complete and total theory. It's a request to even try.
I never once misrepresented my opponents' views. They still explicitly claim that I represented them appropriately. Nor have I once demanded that they get mine exactly right. It is entirely a mess that they have created. Perhaps they viewed my observation of the culture war component as a sneer, got personally offended, and lost all capacity for rational argumentation, and I could be partially blamed for that. In that case, I would suggest that you focus on what part of my observation of the culture war component was wrong, for just because it was interpreted as a sneer and caused offense does not mean that was not true and necessary.
ControlsFreak
2yr ago
Ok, so once we're epsilon onto a slippery slope, you're "not going to argue about the specifics". Got it. So, you could just respond to those comments by explicitly stating this, yes?
Do you hold this position for all possible claims of slippery slopes? Do you agree that gay marriage is just one more spot on the slippery slope to marrying dogs, and any argumentation about specifics is somewhere between fruitless and an entirely misguided endeavor? Or do you think there is room to discuss some sort of framework for claims of slippery slopes, that perhaps all slopes might not be equally slippery, or something along these lines? Or just nah to all that. "Gay marriage, slippery slope, dog marriage, QED." ?
ControlsFreak
2yr ago
We're having a nice conversation here about the regulation in question. That is a good way of having a discussion about having non-zero regulation, but hopefully not too much of it. One can argue that some of the specifics are, in fact, too much of it, but that's what that conversation looks like... not the mess the other guys are doing.
One could even go after a "framework for analyzing", even in slippery slope situations. Here's a good example of how to construct such a framework, and I think rich conversations could be had. In fact, it could even be beneficial to have a top-level comment that branches off from Volokh's work to have a nice robust discussion on how to construct an appropriate framework.
But they're still refusing to have any sort of framework, discuss any sort of specifics, nothing. Just that they have declared that the slope is slippery, and nothing more need (or can) be said. That is it. That once we have passed epsilon, we are on the slope, one cannot discuss frameworks anymore, and doom is upon us. This is not a strawman. This is a repeatedly stated position, stated openly, and resistant to any attempt to bring the discussion back to the type of thing that you would like.
ControlsFreak
2yr ago
I disagree with your assessment of what "being capable of operating" entails, as we have gone over already.
We discussed shale fracking. Now Space X, ozempic, Matt Levine gives tons of examples of financial innovation, we're damn close to self-driving cars, but the hol' up is the tech, not the regulation. The list goes on and on. I do not see any more content in your comment that is anywhere near suitable to claim that we can simply declare this "gone over already". If anything, you just dropped it, because your position didn't go anywhere.
Let's make sure we're on the same page here, so that we are at least confident that we're both actually really ready to engage the slippery slope question honestly, without leaving room for a retreat in this direction. Are other industries capable of operating with some amount of regulation? Not, "Is there a general sense of a regulation-innovation tradeoff?" We agree that there is. The straightforward statement that many other industries are capable of operating with some amount of regulation. Are you going to stick with the position that this is an outlandish Bailey? Or is it simply a true fact about the world, and we can shift the discussion toward slippery slopes?
ControlsFreak
2yr ago
The Motte and Bailey. You Bailey your way to claims about the FAA and navigation automation, but then immediately retreat from defending it. You simply refuse to argue any specifics about any portion of the Bailey.
You retreat to a Motte of simply rejecting any epsilon of regulation ever, but refuse to acknowledge any actual claim that this position makes.
This is the quintessential form of reasoning that this place was made to reject.
It is not "my way or the highway". Again, if you can come up with any other way to make it so that we don't have billions of trivially-hackable shit with default passwords, sign me up. But I keep getting told this is my only option! It's not even "my way"! It's the only option! That this is a fact about the universe! Nothing to do with me at all!
EDIT: Give me "your way"! Make it an option! If you can do so in a way that won't result in Nybber telling us that "your way" would break their culture, great! But he keeps telling me that you can't.
More options
Context Copy link