Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by ncallaway on Tuesday September 05, 2023 @01:11PM (#37394806)

> The best you can hope for with a regulatory approach is to incentivize them to pay more lip-service to the idea

While I think this is true, there's also some benefit to getting the manufacturer's to pay lip-service to the idea.

In that, it becomes part of the marketing and the sales of the device. Later, consumers can _attempt_ to hold manufacturer's feet to the fire with false advertising and other fraud class action lawsuits.

It's really really not a good system, but even forcing a bit of lip-service is a marginal improvement over what we have now.

> Therefore, the most meaningful step would be to require support for open-source firmware.

I agree that it would absolutely be better, but it sounds like even this voluntary labeling program is the compromise that might be tolerated by the other members of the FCC. I'm guessing such a strong and effective program would be a non-starter with those members.

Which, honestly, tells me a lot about the other members of the FCC, and whose interests they are seeking to serve.

[ Parent | on HN ]

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by kevincox on Tuesday September 05, 2023 @02:03PM (#37395465)

> Later, consumers can _attempt_ to hold manufacturer's feet to the fire with false advertising and other fraud class action lawsuits.

I would hope that this becomes relatively simple at some point.

1. I have this box that says I get updates until 2025-01-01.

2. It is 2023-09-05.

3. I have applied all available security updates.

4. Vulnerability X is still exploitable and has been made public to the manufacturer for 4 months.

5. Get full refund for defective product.

Obviously we are a long way from this. Especially 4 being hard to make a concrete rule for.

[ Parent | on HN ]

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by MarcoPerazaFCC on Tuesday September 05, 2023 @04:57PM (#37397640)

I think if the box says updates until the beginning of 2025, and they've stopped providing updates before then, you have a pretty good contract lawsuit against them. You'd have to show that their failure to issue a patch for four months constitutes a breach, but that is exactly the kind of thing that gets hashed out in lawsuits. You could even have a class action of all the owners suing the manufacturer. We think one of the great opportunities of this labeling program is to begin developing a caselaw of what it means to hold a manufacturer to the commitments on the label.

[ Parent | on HN ]

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by ncallaway on Tuesday September 05, 2023 @05:46PM (#37398203)

Yep, the labeling would enable exactly the kind of class-action false advertising/fraud lawsuits against companies that simply lie on the packaging.

So companies would be forced to disclose their actual level of support, and risk consumers not wanting the product, lie on their disclosure and risk a significant class-action lawsuit, or improve their level of support.

I would hope the market would tip us towards the latter scenario, but...we won't know unless we actually force disclosure of these things.

[ Parent | on HN ]

Re:Ask HN: I’m an FCC Commissioner proposing regulation of I... by myself248 on Tuesday September 05, 2023 @07:33PM (#37399292)

I figure like everything else, this will just advantage the fly-by-night imports who you can't sue in the first place. They will continue to have no incentive to comply with any laws whatsoever.

[ Parent | on HN ]