Microsoft DeviceScript – TypeScript for Tiny IoT Devices

Re:Microsoft DeviceScript – TypeScript for Tiny IoT Devices by nicce on Friday June 09, 2023 @09:34AM (#36257596)

This makes a lot of sense. However, it makes me wonder how big is the new attack surface for remote upgrades/updates.

You need to implement a safe updater (with remote protocols) on VM level. And I guess you can never upgrade the VM itself, or if you can, it adds some extra complexity, or physical access.

There also need to be some kind of signature validation for every release, which means that device needs to perform some cryptographic operations and store at least tamper-proof public keys.

[ Parent | on HN ]

Re:Microsoft DeviceScript – TypeScript for Tiny IoT Devices by bri3d on Friday June 09, 2023 @09:48AM (#36257773)

I can't really see how this is different from a native-code based device, especially one which is actually following good practice by not trusting what's in flash. Every stage of the boot chain still has to validate the next - there's just one more layer on top where the application is the runtime VM and it has to validate sub-applications / managed code.

[ Parent | on HN ]