Liability as security panacea keeps come up here. It's kind of ridiculous imo.

Electrical components, for example, aren't made safe by liability but by standards. And given there's no set way anyone knows how to manufacture secure components, it's hard to come up with a "you should have known" standard for liability.

[1]: https://usa.visa.com/visa-everywhere/blog/bdp/2019/05/28/chi...

The NFPA and NEC were created by insurance companies, the standards exist because of the liability. UL stands for Underwriters Laboratory, underwriters being the people who write insurance policies (to transfer risk aka liability).

IE, just liability isn't sufficient. Regulation were created to avoid a situation of liability because "raw liability" doesn't work.

The thing is, electrical regulations are not regulations merely on manufacturers, indeed, they only require particular, simple components. They are mainly for the users of electrical components, builders and the electrician they employ.

The constant whine here at HN is that software companies are held liable for their insecure applications. The problem is that the security isn't primarily about buying secure components. It's about having secure practices in place.

For "critical infrastructure", things like "don't connect shit that doesn't need connecting and "build from source, don't download anonymous binary blobs." are standards that should be on the end-user, just for example.

IoT and software isn’t special. It’s just getting a free pass because the vendors and solution providers want to dodge the responsibility for as long as they can.

To everyone else’s detriment.

-- Maybe I'm not saying it well. But my point is that until someone defines an overall use context, calling a given thing "unsafe" is futile. In an intranet not connected to the outside, an IP camera with no security at all is fine.

Without "customer classes" defined, without security use cases defined, and so-forth, of course manufactures will produce anything they want and why shouldn't they? The implicit standards of security now are the wild, wild west.

The original situation is IP cameras and other devices sold with pathetic security. Sure, it seems intuitively obvious that "these people were doing it wrong and ought to pay". But you can't really do that because there reasonable situation where these devices are reasonable.

IE, manufacturer responsibility can't exist, can't be pinned down, until standards exist.

I know how to manufacture components that cannot have their firmware updated by malicious code. Put a hardware switch on the "write enable" line for the ROMs. Like people used to do.

Then malware won't survive the "reboot" switch.

The next step is to add a hardware timer that does a hard reboot once a day (or more often for critical stuff).

I don't know why security professionals with clout don't demand this. I would.

If a device has a trained operator, sure, have a write-protect switch.

> trained operator

I'm not sure that flipping an "enable updates" switch requires training.

> reinfected five minutes after they reboot

Scenario A: malware installs itself in device ROM. You remove malware, the ROM code reinfects the system. You have no idea if the device is compromised or not. Your only choice is to buy all new components.

Scenario B: malware keeps reinfecting system 5 minutes after reboot. You remove the malware. Reboot. Your system is clean.

I choose (B).

... for about 5 minutes.

This is very close to what happened with the Slammer worm.[0] It was in-memory only, spread like wildfire, and any unpatched systems were infected within minutes.

0: https://en.wikipedia.org/wiki/SQL_Slammer

If a fire can be traced back to use of unsafe electrical components, most insurance companies across the world won't cover the damage.

So assigning resources and specific organization to define such standards is the way to go even if there's no enforcement scheduled yet.

In practice, this often has the force of law. There are many domains where regulatory bodies arbitrarily require that all contracts conform to one or more of these recommendations to be in compliance or fit for purpose even if they don’t come from the government. Government contracts often have language that product and delivery must conform to a long list of such reference documents.

This is less common in web tech, but in other market sectors compliance with a set of common public guidelines is a cost of doing business and contracts sometimes have long lists of things to conform to. The real issue is that most organizations do just enough to check the box, even if violating the spirit of the requirement, because it turns out that customers just want that conformance for ass-covering and don’t care about rigorous compliance. Rigorous compliance would be expensive, especially if anyone tested it (which virtually never happens).

People will comply with the NIST guidelines because their contracts will require it. The problem is that is not enough.

because a lot of laws do not have consequences codified, or they do but have delegated to an authority that cannot levy any consequence, like the Department of Commerce or in this cast the NIST

sometimes this is intentional, not by any specific lawmaker, but relying on their and everyone else's inattentiveness.

Sure, this won't stop Chinese consumer junk, but it will likely improve things like medical devices sold to the VA simply because FDA certifying two different devices of different security levels will be too expensive.