News for hackers. Stuff that matters.
Re:Smart homes will turn dumb overnight as Charter kills sec... by _Microft on Saturday January 18, 2020 @06:46AM (#22083881)
The manufacturer should never be able to either deactivate or otherwise disable the functionality of a device they sold in a form that requires a service to function. If the customer is paying a subscription fee and no longer has to pay the fee when the service goes away, that is maaaybe fine (albeit opening a loophole that would most likely be abused (from a customer's perspective).

If the service was priced into the selling price of the device, game or other software though: nope, never. You did the math, you sold the device for that price, now keep on delivering.

That would not necessarily mean that they would have to run servers indefinitely, it could as well be in the form of releasing or open sourcing the related server software or the specifications (and required certificates for signing updates if applicable? That might be thorny though.) in a form that someone else could successfully take their place when they end-of-life a device.

Ideally in a form that would also work when the company closes shop, that is when no longer any form of workforce or capital for anything might be available.

It might be time to actually require that from (also software) manufacturers since there seems almost no change in that regard.

Re:Smart homes will turn dumb overnight as Charter kills sec... by TeMPOraL on Saturday January 18, 2020 @10:32AM (#22084936)
> The manufacturer should never be able to either deactivate or otherwise disable the functionality of a device they sold in a form that requires a service to function.

I would go further: IMO, the manufacturer should never be able to sell the device that requires a service to function, period. They should only be able to either a) sell the device that can be optionally tied to a service - not necessarily manufacturer's - but otherwise works fine without it, or b) rent a device as a part of a service, remaining responsible for its maintenance.

Model a) is how cell phones work - you buy a cell phone, a cellular connection is a separate service provided by multiple competing parties that are not the manufacturer. Model b) is how ISPs tend to work - they lend you hardware to connect to their network infrastructure, they replace it if it breaks, they take it away at the end of the contract, and they absolutely refuse to let you use their hardware with a different ISP.

Re:Smart homes will turn dumb overnight as Charter kills sec... by avian on Saturday January 18, 2020 @08:06AM (#22084217)
> Ideally in a form that would also work when the company closes shop

You typically already have to provide full hardware schematic when submitting an electronic product to test labs to get various certifications.

It doesn't seem that far fetched that you would also have to submit server software and the certification house would keep it in escrow in case you go bankrupt.

I don't think it's realistic to expect that will happen though.

Re:Smart homes will turn dumb overnight as Charter kills sec... by paulgb on Saturday January 18, 2020 @08:11AM (#22084239)
Code escrow isn't unheard of in B2B software. Maybe enough people will be burned by companies bricking their hardware that it will happen with B2C, too?
Re:Smart homes will turn dumb overnight as Charter kills sec... by tcd on Saturday January 18, 2020 @08:15AM (#22084255)
Let's assume product uses domain.com to get updates.

domain.com one day might be owned by $badDude - that's a huge risk

domain.com might return 404's - that's pretty terrible.

What happens to domain.com once $business is now $noLongerBusiness?

You can provide a method of flashing firmware onto the device itself (possible security risk?), but where do you get the files from? How do you verify they're safe?

Then, you need to host the server software itself (depending on how it's coded, that ranges from quite simple to your worst nightmare), and you expect someone to keep that secure? The EU dictates GDPR compliance, which adds additional cost to maintenance.

It's just easier and cheaper to just not bother with servers if the company can't keep them online.

Re:Smart homes will turn dumb overnight as Charter kills sec... by vbezhenar on Saturday January 18, 2020 @10:18AM (#22084853)
Let user change server domain. Firmware must be signed by certificate with that domain. So now user can change server domain to his own server (or someone he trusts) and sign firmware with that key. It poses no security risk.
Re:Smart homes will turn dumb overnight as Charter kills sec... by tcd on Saturday January 18, 2020 @08:03AM (#22084208)
That's a very idealistic but unrealistic perspective. Often times the source code can't or won't be released - it could put further customers at risk if a vulnerability is found and the update servers have gone away.

Some devices might not be possible to update due to hardware/software configuration (perhaps certain variables are hard coded?).

Whilst what you're saying is right it just doesn't work that way. I'd love for all the Android devices to get years of OS and security patches, but it simply doesn't happen.

Any IoT device is pretty much the same. It's not going to change any time soon.

Only invest in products you can be sure of (which is hard these days). Expect them to break, expect nobody to care, and be prepared to lose money or get a terrible ROI - it's why phones don't get updates, the OEM doesn't make money from providing updates which are a direct cost VS selling a new phone.

This is capitalism, produce crap, sell many units, offer no support, rinse and repeat.

Re:Smart homes will turn dumb overnight as Charter kills sec... by vbezhenar on Saturday January 18, 2020 @10:22AM (#22084879)
Security by obscurity does not work. For experienced reverse engineers reading assembly code is as easy as reading C code for someone else.
Re:Smart homes will turn dumb overnight as Charter kills sec... by Silhouette on Saturday January 18, 2020 @09:16AM (#22084539)
Market forces have clearly failed to address this issue for an extended period, so this seems to be a situation where statutory regulation is indicated.
Re:Smart homes will turn dumb overnight as Charter kills sec... by GuB-42 on Saturday January 18, 2020 @08:55AM (#22084454)
Isn't that tying? The manufacturer sells both the product and the service, and they can't be separated. Many countries have laws against it, or at least some forms of it.

Furthermore, many countries now have some regulations regarding e-waste. Either now or in the making. And I expect "bricking" to be punished in some way. Right to repair comes to mind.

Re:Smart homes will turn dumb overnight as Charter kills sec... by scarface74 on Saturday January 18, 2020 @08:29AM (#22084326)
The manufacturer should never be able to either deactivate or otherwise disable the functionality of a device they sold in a form that requires a service to function.

Exactly, why can’t I still dial in with my 2400 baud modem to get virus definitions for Norton Antivirus for my 386 that I bought in the 80s?

Re:Smart homes will turn dumb overnight as Charter kills sec... by the8472 on Saturday January 18, 2020 @09:18AM (#22084547)
You can dial your 2400 baud modem if you find another endpoint or operate one yourself, you're not bound to a specific provider. Fax machines still work after all.

You can run norton antivirus for DOS in whatever state it was when it was last sold.

Re:Smart homes will turn dumb overnight as Charter kills sec... by scarface74 on Saturday January 18, 2020 @09:26AM (#22084583)
So now all I have to do is find someone who keeps a bank of 2400 baud modems and an updated list of virus definition files.

As far as using as it was, what good is virus protection software that only works for viruses created in the 80s?

Sure I can use a standalone gps device that I bought 10 years ago that doesn’t get updated but that doesn’t do me too much good navigating in a suburban area where most of the roads, houses and businesses didn’t even exist then.

Re:Smart homes will turn dumb overnight as Charter kills sec... by afiori on Saturday January 18, 2020 @11:38AM (#22085310)
But this is the point, manufacturers should offer improved features as incentives not intentionally and gratuitously deprecating older products.
Re:Smart homes will turn dumb overnight as Charter kills sec... by scarface74 on Saturday January 18, 2020 @01:36PM (#22086103)
It is an optional feature in this case. He could go out and buy a regular cartridge and print from his same printer.

I looked at the pricing. I would go for the free tier in a heartbeat- 15 pages a month and $1 for 10 (?) pages over that. I don’t print that often.

Re:Smart homes will turn dumb overnight as Charter kills sec... by TeMPOraL on Saturday January 18, 2020 @10:35AM (#22084942)
A general-purpose computer with a general-purpose operating system and a general-purpose network adapter tied to it absolutely does not require Norton Antivirus or its virus definitions to function. Correspondingly, Norton is not involved in manufacturing any of these components.
Re:Smart homes will turn dumb overnight as Charter kills sec... by scarface74 on Saturday January 18, 2020 @10:54AM (#22085040)
That seems like a distinction without a difference. I hypothetically bought a product that requires a service for functionality - Norton Antivirus. According to the parent poster, Norton should be required to keep their service running.

Should Sony also be forced to keep their service running for PS1 games that had an online component - forever?

Re:Smart homes will turn dumb overnight as Charter kills sec... by Dylan16807 on Saturday January 18, 2020 @12:20PM (#22085602)
> Should Sony also be forced to keep their service running for PS1 games that had an online component - forever?

On the other hand, would that even be particularly difficult?

For most companies making games with an online component, if they set aside 0.1% of revenue into a fund that would take over server costs once support ends, that fund would last for a very long time.

At a certain point the player base drops enough that you only need one server and a few hours a month of labor. (Less than one server, actually, once you factor in virtualization. Even if you want to have some redundancy and support multiple regions.)

Re:Smart homes will turn dumb overnight as Charter kills sec... by TeMPOraL on Saturday January 18, 2020 @11:04AM (#22085112)
Technically you didn't buy a Norton Antivirus, you entered into a license agreement. Software is, unfortunately, almost always leased and not bought. However, I would very much be into forcing companies to either a) keep their service running forever, or b) allow the user to use a third-party service - in this case, virus definitions. This is in line with my comment elsewhere in the thread - companies should be allowed to either a) sell a product that doesn't require a service, and if it uses a service, it should support compatible third-party services as well, or b) lease the product as a part of a service. They should explicitly be banned from selling a product that requires their particular service to function.

As for Sony, PS1 games and on-line: similarly, whatever middleware there is that facilitates on-line gaming, endpoints should be user-configurable. Fortunately, at least PS1 the device doesn't require Internet to run.

(Come to think of it, did PS1 even support an Internet connection?)

Re:Smart homes will turn dumb overnight as Charter kills sec... by scarface74 on Saturday January 18, 2020 @11:20AM (#22085218)
You’re right. It was first introduced with the PS2 in 2000. I do however have a vague recollection of early cartridge based systems where you could download games over cable.
Re:Smart homes will turn dumb overnight as Charter kills sec... by CedarMadness on Saturday January 18, 2020 @12:45PM (#22085765)
You're probably thinking of Sega Channel [1] which was functionally like Microsoft's Game Pass that is available now. You knew that you would only have access to the games as long as you subscribed, and that they could be changed at any point by Sega.

[1] - https://en.wikipedia.org/wiki/Sega_Channel

Re:Smart homes will turn dumb overnight as Charter kills sec... by mrr54 on Sunday January 19, 2020 @02:51AM (#22090055)
>Should Sony also be forced to keep their service running for PS1 games that had an online component - forever?

Yes! Absolutely they should.

Re:Smart homes will turn dumb overnight as Charter kills sec... by kenjackson on Saturday January 18, 2020 @10:41AM (#22084968)
Why do you specify “device”. Shouldn’t the same be said for an app or service that is sold?