Re:Ask HN: I’m an FCC Commissioner proposing regulation of I...
by worthless-trash on Tuesday September 05, 2023 @11:39AM
(#37393218)
> A mechanism requiring disclosure of how long security updates are available seems like a great step.
So, as I work in this space, there needs to be realistic guidelines on this, does a security flaw need to have a CVE ? Do they need to fix every CVE ? What is the timeframe requirement ?
This kind of thing keeps me up at night.
Re:Ask HN: I’m an FCC Commissioner proposing regulation of I...
by SimingtonFCC on Tuesday September 05, 2023 @11:57AM
(#37393544)
Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable.
It's not inconceivable that this could be a requirement for getting a label (or some tier of label.) It depends how the advocacy comes out on the record.
Re:Ask HN: I’m an FCC Commissioner proposing regulation of I...
by kijin on Tuesday September 05, 2023 @12:41PM
(#37394347)
The requirement can be easily bypassed by going bankrupt before the required time is up. You will soon hear advice like "if you want to get in to the IoT space, create a new C Corp for each iteration of your product..."
Whatever you require them to disclose after X years, it must be escrowed with a trusted third party in advance.
Re:Ask HN: I’m an FCC Commissioner proposing regulation of I...
by JoshTriplett on Tuesday September 05, 2023 @12:45PM
(#37394418)
Agreed: any kind of future disclosure requirement should be backed up by a source code escrow requirement.
Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable.