ControlsFreak
No bio...
User ID: 1422
ControlsFreak
2yr ago
If you're going to just ignore everything I wrote, then we're probably not going to make any progress. Perhaps we could leave this tangent where it is, and you can actually specify your claim, so that we can determine whether this tangent is even meaningful to your actual claim. Or if, ya know, you're just whining about the world.
Or, of course, you could read what I wrote and actually respond to it. You could show your expertise in flight navigation and control, particularly with regards to automation technology. You could make an argument that actually competes with mine, in order to show that I have mistaken some points of fact or something. What is non-responsive is just pure imagination about hypothetical alternative realities, completely disconnected from any facts about the world.
ControlsFreak
2yr ago
the user isn't reading the 100-page manual that probably already warns about this.
I don't believe any user manuals actually warn about any of these things. The manufacturers simply do not care about security, because they don't have to, be it built-in, in manuals, or in advertisements.
it's not as easy as "just make the device idiot-proof, like toasters!"
Totally and completely agreed. I started off saying that one way we could fix this is to do something extremely simple, like banning default passwords. No manufacturer is going to put on their box whether they have a default password or not, so many consumers aren't going to know.
There has been some efforts in the US to create a Cyber Trust mark, where that is an indication that they have been built to some sort of standards (that aren't that far off from these regulations). This is a plausible approach, though we likely won't see whether it would have been effective (are consumers going to be paying close attention for this mark on a box full of ten other certification marks?), because they're probably just all going to bring their devices up to the UK standard. Could have been an approach, though.
ControlsFreak
2yr ago
Drone regulation went from zero to some. We could debate the merits of specifics there, as well, but does anyone seriously hold that, after having gone from zero to some drone regulation, all innovation in drones is crushed to zero, that everything is doomed and that nothing can be saved?
In any event, drones have different concerns than manned aircraft. I wholly expect that a detailed discussion about the similarities/differences would be rich and fruitful, but what is not rich and fruitful is observing that drone regulation has gone from zero to some and concluding that it must be impossible that the FAA is opening up to alternative navigation and control systems for manned aircraft, especially since the conclusion is factually false.
ControlsFreak
2yr ago
Understood and agreed. We'd then have to shift to a discussion about the theory of slippery slopes and regulation dynamics. I don't think @The_Nybbler is open to that discussion yet. He thinks that "there's no point" in discussing anything like that; once we've crossed epsilon, all is doomed, and nothing can be saved. If he'd like to walk back that claim and actually have a detailed and reasonable discussion about what happens after we cross epsilon, I am here and waiting, but he has to agree to those terms rather than constantly immediately shifting back to claiming that once you cross epsilon, all is doomed and nothing can be saved.
ControlsFreak
2yr ago
Those were pretty much real-world constraints until automation developed enough to be a reasonable approach. This is very very very much directly in my domain of expertise. The good news is that the FAA has opened up to these sorts of "alternative navigation and control schemes". As an expert in the field, this reads to me very much as you just wishing that we lived in a different world, where this sort of technology was feasible a few decades ago, when it definitely definitely wasn't, regardless of what regulations existed/didn't exist.
Do you have a current complaint about the current regulation, or are you just complaining retroactively about California's regulation?
EDIT: It doesn't sound like you have a current complaint about the current regulation, because you say:
There's no point in talking about the specific merits of the specific regulations
But I want to make sure I'm not strawmanning you. Thus, I'm just trying to confirm that the appropriate understanding of your argument is that everything was doomed (at least) four years ago, and that you have nothing more to add. I think it could have saved us lots of digital ink if you had just spoken plainly about this being your position in the beginning.
ControlsFreak
2yr ago
Let's look at the tape.
You can have protectionism and regulation if you want, but you can't get that and innovation.
You won't change it without breaking it such that it can't produce the new stuff any more.
The former person has at least walked it back to, "The debate is only on the magnitude of the effect.", and we have proceeded to have a more fruitful conversation since then. The latter obstinately refuses to make any more specific claims other than that the only thing you can do is to make it so that the industry "can't produce the new stuff any more". If they would like to walk this back from being in the land of hyperbole and into the land of reasoned argumentation, we'll be making some progress.
ControlsFreak
2yr ago
What are you confused about? This is a standard question of regulation, and the standard objections are that regulation can harm innovation and present barriers to entry. I have welcomed any detailed discussion of these features, but have objected to hyperbolic versions of them, that any epsilon amount of regulation instantly kills innovation to zero, for example. Some folks have quadrupled down on this hyperbolic claim, and are now claiming that I am making a hyperbolic reverse claim - that regulation cannot possibly impact innovation in any way. This is a bullshit strawman.
That is the broad context of the discussion. I also observed some of the features of the culture war. I'm not sure what you're confused about.
ControlsFreak
2yr ago
I have never objected to the idea that regulation can kill innovation. Try again. Actually read what I've said and respond to it rather than a strawman. You have to at least try.
ControlsFreak
2yr ago
"Artists" aren't real artists. They're just programmers and engineers at tech companies who developed a culture of believing that if they just imagined really hard that they were artists, it would be a good excuse for not being regulated. This culture grew out of the 90s and just happens to be a useful rationalization for them to refuse to do anything that seems "boring" to them. Sure, every other industry has boring parts of the job that need to be done in a proper fashion, but this cultural imagination gives them an excuse to object and only ever chase the "cool" stuff, no matter how much damage it does to the world. How long did they put off doing any sort of vulnerability work (except the "cool" red-teaming stuff) before it became such an incredible thorn in the side of the industry (and the world that uses their tools) that they were existentially forced to figure out some cultural modifications to actually manage a vulnerability disclosure and response cycle, pulling bodies away from the "cool" stuff and assigning them to "boring" patching work?
Do you think that this is enough to also say that no major IoT startup success is likely to be based in California any time soon?
Nah
Ok, cool. Then epsilon regulation doesn't instantly kill 100% of innovation.
I think we're talking past each other. This regulation in and of itself is a nothingburger. It's the tendency I'm speaking to, which is what was alluded to in the OP.
Regulation is a dynamic process, it never stops at one law and very few of its slopes are not slippery.
Well, then we can probably dig back into the history books to find the first actual regulation that was placed on the tech industry. Whenever it was, it was in the past. The complaint that if we have epsilon regulation, it will definitely be a slippery slope to infinite regulation was valid then, but we're past that threshold now. Now, regulation is a dynamic process; the question is whether this regulation is part of a slippery slope toward infinite regulation, or if it's actually mostly basic shit that everyone has already known they should be doing anyway.
In this house we discuss the Bailey, not the Motte.
I mean, no? It's literally TheMotte. And this betrays that your reasoning doesn't even follow the Motte/Bailey dynamics. It was:
So the motte-and-bailey doctrine is when you make a bold, controversial statement. Then when somebody challenges you, you retreat to an obvious, uncontroversial statement, and say that was what you meant all along, so you’re clearly right and they’re silly for challenging you. Then when the argument is over you go back to making the bold, controversial statement.
If anything, you're the one who is making bold, controversial statements (that innovation will grind to a halt, that no innovation happens anymore in any other industry that has any regulation). There's nothing comparable happening in the other direction. What even is the Bailey that you speak of?
EDIT: Your Bailey seems to be "an epsilon regulation grinds innovation down to zero". When someone challenges you on this, you retreat to an obvious, uncontroversial statement, like, "Regulation is dynamic," but try to sneak in some not-fleshed-out argument about a slippery slope implying infinite regulation. When pulled back to reality, and you're challenged to engage with actually-existing regulation, you're actually pretty silent, unlike at least gattsuru, who at least engages with what's actually going on rather than fever dreams. Why isn't the vastly more reasonable view that you're engaging in a Motte/Bailey argument, while not being able to point to any sort of Bailey from the other side?
ControlsFreak
2yr ago
There are of course substantial technical barriers to flying cars, but almost no one is even interested in trying to overcome them because the regulatory barriers to marketing them and getting the general public to be allowed to fly them are obviously insurmountable.
Here is where we get to the BZZZZZZZZZZZZZZZT part. Every couple years, I see another flying car concept from some start-up. Every couple years, it's technologically fucking absurd, because "there are of course substantial technical barriers to flying cars".
You have zero reason for anyone to believe that the core reason why we don't have flying cars is regulatory and not technological/cultural/practical, especially when I can see with my own two eyes that every proposal that comes up is obscenely whack from a technological/cultural/practical standpoint. Don't get me wrong, I'm no FAA-lover, and they would almost certainly get in the way, but they're the reason we don't have flying cars in the same way that Space Force is the reason we don't have aliens invading earth.
ControlsFreak
2yr ago
Ok, so California required default passwords four years ago. Your nightmare world has already arrived. We've already crossed over the epsilon threshold. The boot has already eternally stomped the artist, and you should have already exited the terminally ill tech sector. I don't know why you're complaining now.
ControlsFreak
2yr ago
Now this is the type of response I was hoping for! Actually engaging with the substance!
FRAM
Perhaps they'll issue a clarification, but from the note in this section, I think someone could read this as "memory"; it has "memory" right in the name! In general, I do expect there to be some clarifications along these lines as folks like you bring up additional concerns.
5.4-2 (unique IDs)
This one is conditional, and I imagine ultra-small or ultra-disposable devices won't qualify in the first place.
5.3.4/6/10 (updates)
Same here; conditional. We'd at least have to get down to the level of thinking about each of the devices you've mentioned in terms of the conditions.
Mandating that "For constrained devices that cannot have their software updated, the product should be isolable and the hardware replaceable" (5.3-15) could mean almost nothing, or it could require vendors to commit to support any optional part of a product until they retire an entire series.
Notice how they define isolable:
isolable: able to be removed from the network it is connected to, where any functionality loss caused is related only to that connectivity and not to its main function; alternatively, able to be placed in a self-contained environment with other devices if and only if the integrity of devices within that environment can be ensured
EXAMPLE: A Smart Fridge has a touchscreen-based interface that is network-connected. This interface can be removed without stopping the fridge from keeping the contents chilled.
In the section describing the rule, they continue:
There are some situations where devices cannot be patched. For constrained devices a replacement plan needs to be in place and be clearly communicated to the consumer. This plan would typically detail a schedule for when technologies will need to be replaced and, where applicable, when support for hardware and software ends
I think I would interpret this as, sure, you need to support any part of a product until you tell the customer that you're not supporting it anymore, and the type of support can vary.
SecureBoot (5.7-1), hardware memory access controls (5.6-8)
Yeah, I have a feeling that these aren't going to pop into the Mandatory category for a while. The real good news is that concerns are really of the type, "Will they at some point make these Mandatory, when it is still too soon?" Because pre-rule-dropping, I imagine the worry would have been of the type, "Will they make this stuff Mandatory now?" And, they, uh, didn't. I think this document shows a pretty decent level of care in getting some of the really basic stuff right and showing the industry the direction they'd like to go in the future. There's no telling at this point whether it'll all actually go that way; one has to imagine that there are differing worlds where it seems more/less plausible to upgrayyyed these Recommendatations into Mandatory.
guaranteeing cryptographic updates for the life cycle of the product (5.5-3)
Whereas this one, I think is fine, given their explanation:
For devices that cannot be updated, it is important that the intended lifetime of the device does not exceed the recommended usage lifetime of cryptographic algorithms used by the device (including key sizes).
How easy is that? You don't even have to update it at all. But if you do, then at least make sure your shit isn't trivially broken, at least so long as you're telling the customer that you're still supporting it.
ControlsFreak
2yr ago
Irrelevant. Obviously, people can choose to regulate something specific away. The question is whether there has been "any" innovation in "any" other industry (that is, the non-bits ones that have more regulation). Unless you're claiming that the US has no regulation on the oil/gas industry, the shale revolution, which literally has changed the world at a geopolitical scale, is a huge counterexample.
But there are many others. Space X. Ozempic. Etc. It's really hilarious to have all the huge techno-optimists, who think that AI and tech more broadly is going to revolutionize literally everything, and at the same time, they imagine that the tiniest amount of regulation on fucking light bulbs will grind literally everything to a halt.
ControlsFreak
2yr ago
I can easily commit to saying that no major IoT startup success is likely to be based in the UK any time soon.
Bruce Schnier noted that California had already implemented at least the number one item. Do you think that this is enough to also say that no major IoT startup success is likely to be based in California any time soon?
No chinesium lightbulb maker is ever going to bother with formally proving their code is correct because they don't care.
I don't believe anything in this requirement is aimed at formal code verification methods. I don't think that's a requirement that is on the table anywhere, except for perhaps some niche customers (e.g., military/space). Probably not even at most "critical infrastructure" places that could blow up or whatever.
I mean, honestly, if that's about all you have to say for what results from this, that no chinesium lightbulb maker is going to meet a standard that hasn't been proposed and that some critical application spaces are going to pay for good stuff anyway, that's kind of a nothingburger? Like, abstract senses about Europe (not even the UK) and wild references to John Galt aren't really "concerns" that can be addressed in context of the very specific document that we have in front of us. It really seems like you just don't have any meaningful concern that we can investigate.
ControlsFreak
2yr ago
Ok, so not a prediction about consumers' willingness-to-pay slightly more for slightly more secure products. That's fine. It would have been an easy thing to make a prediction on if your step function catastrophic model was correct, but I think we can conclude by this much longer-term, contingent prediction that your step function catastrophic model really really wasn't ever a serious attempt at a model in the first instance.
Does TheMotte have a RemindMe bot that can come back in 20 years?
Flying cars actually are pretty close to my area of expertise, so I'm betting that you probably have some misconceptions of the reality on the topic. What do you think is "the way we talk about flying cars today"? Let's see if it reflects reality.
ControlsFreak
2yr ago
You won't change it without breaking it such that it can't produce the new stuff any more.
This is just hyperbolic catastrophism. Hilarious, really. I mean, honestly. You can't possibly have a real argument for this. Did you really think that this was an actual argument? Or do you have some weird twisted argument that literally any epsilon>0 of regulation instantly grinds innovation to a halt? I hate to break it to you, but no one else believes this, because it's just not true. Not even remotely true. Tons of industries that are infinitely more regulated than tech still have plenty of innovation. There may be a tradeoff on some margins, yes, but your step function model is not remotely serious.
"Technokings" is not a reasonable description of the people building them. The people building them exist, and are not people with the regulated-industry mindset, where there are a ton of boxes to be checked and rechecked every time something is built or a change is made.
What shall we call them, then? "Bored Pandas", the culture of folks too bored by things like making sure there's no default password on their devices?
ControlsFreak
2yr ago
If the UK wants to make such regulations it will reap the same sort of benefits: no toxic chemical pollution or chinese crap botnets, but also no innovation in these respective sectors.
So, will you then make a prediction along the lines of what I asked for in the OP? Are you predicting that tech companies will pull out of the UK rather than either upgrayyyeding their security practices for the world market or going with a dual product (one version that doesn't make absurdly basic mistakes for the UK market and one that does make those mistakes for the world market)?
The debate is only on the magnitude of the effect.
And I claimed that being forced to not have default passwords will have an incredibly low magnitude effect on innovation. Do you actually disagree with this, or do we agree?
I don't buy chinese crap that spies on you, I tell people not to buy chinese crap that spies on you and I shame people who do so in my social circles.
I do the same, but clearly that is not changing much about the world. Have you succeeded in changing the world through your evangelism?
Hell, I've spent years of my life writing symbolic execution software used specifically to make edge devices secure.
Then I'm sure you will be pleased that this work won't be going to waste by someone shaving a few cents off of the cost of your product by putting a default password on it. Honestly, hearing this, I'm really not sure what your concern is. Is it that your company's "We're Actually Secure" marketing is going to be slightly less effective, now that the floor has been raised? Did you really think that such marketing was really of all that much value in the first place? @The_Nybbler thinks that it's completely a waste and that no one would spend one red cent more for your secure product. Do you think he's wrong?
ControlsFreak
2yr ago
But those people can't do it, because they aren't the people building the devices. The people being required to do it are the people you (gleefully) admit it is painful for.
Maybe their little subculture will change. It is a Culture War, after all.
The reason IoT devices have been an absolute security shitshow for years is no one except you and some European regulators actually gives a shit.
I mean, plenty of people care, including lots of technology and security experts. E.g.
There are no technokings building them
...wait, so those people aren't building them? Who is building them? People who aren't the artists and don't find following the regulation to be boring? Then we don't actually have any problem at all! I'm not sure what you've been complaining about this whole time.
nobody's going to pay a red cent more for an internet-connected light bulb that's more secure than some other internet-connected light bulb.
Well, now, if all the internet-connected light bulbs that are available in the store are more secure and cost one red cent more, will they still fly off the shelf? You've resisted making any tangible prediction here. I think it's because you know that they will still sell just fine for a tiny amount of additional money.
ControlsFreak
2yr ago
The difference is that it's easy to people who don't have a particular psychology or culture. You're concluding that it's not easy to certain folks, which is perfectly compatible with it being objectively easy to most people. Maybe it's even tedious, or as the dictionary would recast that word, boring, to you. But hey, I think we're making progress. The reason why IoT devices have been an absolute security shitshow for years is just because a small culture of powerful technokings think that it's too boring for them to fix the obvious problems that everyone knows are obvious problems and which are objectively easy and simple to fix. We may have reached agreement!
ControlsFreak
2yr ago
Where is the innovation in any other industry over the past decades exactly?
You know, since they brought these in.
Let's go with a simple one - the shale fracking revolution in the oil/gas industry. But nobody is actually going to go counting these things, because no one really has any sort of consistent argument for which sorts of regulations stifle innovation. Again, I totally realize that they do sometimes, in some ways. But what sort of massive innovation is going to be stifled by requiring devices to not have default passwords? Like, surely we can agree on that one. We could at least leave open arguments for other requirements, and I would welcome a wide-ranging debate on them. But if we're stuck with just theoretical arguments, totally disconnected from any specifics, in a way that can't capture basic truths like, "Being forced to not have default passwords is not a significant barrier to innovation," then we're not going to get anywhere.
I complain about having to fill forms, you retort about the justifications for the form existing as if I didn't also have such a concern.
Ok, so you also have a concern about default passwords. What are you going to do about your concern?
ControlsFreak
2yr ago
Your original post expresses considerable contempt for "tech folks" and demonstrates absolute joy for us having regulation "dropped" on us "in a much stronger way that you really won't like." This really doesn't fit with an idea that you think the regulations will be anything like easy or simple to follow
This does not follow. It's just a non sequitur. It can be easy and simple to follow, but incredibly grating to the personality of "artists". They don't like coloring inside the lines, even if it's easy and simple to follow.
ControlsFreak
2yr ago
Compliance is a huge industry.
Weird. I hear about that from my friends in literally every other industry ever. They still seem capable of operating.
What isn't seen is how much harder it is or will be to get funding for a startup that designs novel appliances because the costs to enter the market are now higher.
I'm always sympathetic to concerns of regulatory capture putting barriers to entry in front of small businesses. Totally agree that this is the single strongest argument against these types of requirements. I just doubt that these particular requirements are that onerous. Plenty of smaller shops that actually care about not being a security clusterfuck already do these kinds of things, and you can do most of them without too much difficulty as a hobbyist. In any event, if you're a start up that can't figure out how to not have a default password on all your devices, I actually kind of don't want you selling stuff, anyway.
This is a true statement about the world, not an outrageous claim, newfriend. You may be thinking that those words mean something other than what those words mean. What are you thinking they mean?
Great! We can surely then have a reasoned discussion about the nature of slippery slope arguments, trying to understand when they hold, to what extent they hold, and whether the premises required for them to have force are present here. I have never objected to the concept of a slippery slope arguments, but it does need some something behind it, otherwise it leaves us vulnerable to just any crazy extrapolation of anything in any domain. We probably wouldn't respond to, "Gay marriage is a slippery slope to marrying dogs!" with, "H-yup. All slippery slope arguments are perfectly valid and correct in all conclusions."
More options
Context Copy link