Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by tkfu on Tuesday September 05, 2023 @12:43PM (#37394366)

That's the problem, there isn't a good objective measure. Some type of "reasonableness" standard is usually invoked in situations like this, but that kinda just takes us back to square one: what's currently considered reasonable in the industry is pretty terrible.

[ Parent | on HN ]

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by MattPalmer1086 on Tuesday September 05, 2023 @01:11PM (#37394810)

I'm not sure we will ever have a universally accepted objective measure of risk. Risk is, by its nature, somewhat subjective.

Most organisations will use CVEs and the CVSS system as a starting point, but will triage them and produce their own assessment of the actual risk to them and their products given how the software is used.

[ Parent | on HN ]

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by whats_a_quasar on Tuesday September 05, 2023 @03:11PM (#37396348)

I don't think a legal reasonableness standard would be the same as "common industry behavior." Regulation would hold companies to a real reasonableness standard, as determined in the text of the regulation or by a court.

[ Parent | on HN ]