I think this is oversimplifying things.

Is finishing the dinner more important than applying a patch that fixes actively exploited bug that locks your oven into cleaning mode and burns everything inside into ash over the next three hours? Or something that disables the safety checks and lets the oven overheat and burn your house down?

(Granted, the latter shouldn't physically be possible because it should have physical temperature killswitches etc.)

People always (understandably so!) consider software updates to be annoyances; but especially when you give an example like _an oven_, the potential for _catastrophic_ failures is too great.

One my favorite IoT botnet scenarios is an attacker taking control of thousands of ovens/air conditions/other high-wattage devices and using them to cause power outages. https://www.usenix.org/system/files/conference/usenixsecurit...

I wonder how the impulse to connect everything to the internet will be remembered.

The flip side of that is you can use control of all those high wattage devices to prevent power outages by shifting load to times when more energy is available.

Hopefully, that's how the impulse will be remembered.

Or by the rise of salmonela infections...

These seem like very rare scenarios. If we're concerned about such threats, the oven needs a way to get sent into an internet-disconnected "safe mode" before we're even talking about updates.

How do you, as a user, determine whether your oven is in "safe mode" that the manufacturer has toggled, or in "safe mode" that makes the UI look the same as the real one, but is actually a malicious code that waits until 3AM to start the cleaning mode?

I agree that these scenarios are (relatively) far fetched _now_; but if we expect the future to include connecting appliances like that to the internet, then solving problems like those is table-stakes stuff.

I understand that enforced software updates are annoying; but for high-stakes environments like this they strike me as a lesser of the two evils.

If the attacker has total control, then all bets are off no matter what mechanisms you put in first. Adding a safe mode would at least allow manufacturer to stop any non-total exploit without relying on the more complicated update mechanism. Also, the appliance would more likely work in a kinda normal way in the meantime.

>If the attacker has total control, then all bets are off no matter what mechanisms you put in first.

Great, so we now agree that it's important to keep the system patched and up to date.

That depends on updates never introducing new vulnerabilities.

I didn't say otherwise. Only that a forced update mechanism is insufficient for stakes as high as burning down the house. Maybe the patch fails to download/install, or they take too long to develop the patch in the first place, or the patch doesn't work for all models on the first try. There needs to be a simple kill switch if we're talking about threats like this.

Besides that, the safe mode oven should still be able to cook food manually.

Just as smart people agree that the manufacturer knows nothing about the situation at the appliance, and a forced update mechanism a la the first iteration of Windows forced updated ("update's here, restarting, too bad you're currently doing important stuff that won't be saved") is a stupid idea and outside of private use often a non-starter. That kind of condescension is generally only something you can do to private tech users.

Though I guess making the experience frustrating could keep more people from needlessly connecting everything to the network because it sound futuristic...

> If the attacker has total control, then all bets are off no matter what mechanisms you put in first.

You could have a second SoC on the device running off ROM, whose only purpose is handling this safe mode and controlling internet access of the main device. Keep it simple and make it essentially just a fuse that can be blown (turning off internet access) by a signed message from the manufacturer. Keep the hardware capability of this SoC to just that, so even if you have a vulnerability on that thing itself, an attacker can't really do anything with it. Keep the code running on that SoC simple and preferably make it a FSM that is proven to be free of vulnerabilities. Also make sure the main device can't interfere with it in any way.

Once the fuse is blown, the user needs to press a physical button on the device to re-enable internet access. Preferably ship the devices with this internet access disabled by default.

Even better yet, don't build an internet connected oven... but that ship has sailed in many areas.

Ideally yeah, the bar for critical appliances would be high enough for this. If not, disabling IP at the OS level would still be pretty good.

> If we're concerned about dire threats like this, the manufacturer needs a way to remotely send devices into an internet-disconnected "safe mode" before anyone's even talking about updates.

This was exactly my thought. Download the update then take the device offline until it's applied if the update contains a security vulnerability.

If these are the kind of things we are worried about then the correct course of action is to ban needlessly internet connected devices. Your need for twitter on your fridge doesn't outweigh the botnet threat it poses.

Idk if that can be done, but anyway, I don't want to hear these scary threats thrown out as excuses for whatever policy the manufacturer puts in place. If the threat model really is burning down the house, you need a lot more than some forced updates to protect you.

Finishing dinner can be more important than the house not burning down. A burned down house is likely insured. A dinner with a potential business client is not.

Surely this has to be a joke.

Could be a reference to steamed hams

It’s just the Northern Lights.

I think it works best when the consumer gets to decide. If a car recall comes along because the seat belts in your car have been shown to actually kill people in accidents, would you blow off your weekend plans to get your car fixed as soon as possible or would you go to your thing then bring the car to the manufacturer on Monday? There will be people on both sides of that decision and, ideally, we should let them choose.

You make a good point, but this kills me. I've been writing software a long time, and there's nothing I trust less to control my oven than software. God help us. I yearn for simple physical controls

I'm wondering why you'd have a smart oven in the first place. Seems like all risk and no reward.

Probably for some feature or astetic that's unrelated to the smart features, but is only available on the smart oven.

This os definitely most of it. Also, someone figured out they could do something with the parameters of the convection oven and get close to an air frier. Got the mode a year later. Lastly, when the meat thermometer hits temp, I get a notification. That is actually useful.

The ability to pre-heat my oven without standing in front of it. That's really the big win. But also to be able to tell if spouse or children left it on.

But I can just walk to my oven and turn it on, which wasn't a real problem even when I lived in a huge house. What am I missing?

We really can’t force you to see the obvious if you’re set on not understanding something.

That's alright, I'm good. Smart ovens are pretty rare, so it seems like a lot of people don't get this.

> But I can walk to my oven and turn it on, which wasn't a real problem even when I lived in a huge house.

Rushing to get out the door, "Honey, did we turn off the stove?" Presumably you can then check with your phone.

People with internet controlled ovens turn them on before arriving home to shorten the time it takes to get dinner on the table.

In my case, being able to start it heating when I'm ten minutes away from home, so that I can get the kids fed ten minutes sooner.

Ok, that makes sense.

A timer to turn on an oven has been a thing for 25 years or more, probably there were clockwork ones before that. So it is down to very fine control on timing, or not turning the oven on, say, if you're in a traffic jam.

I'd expect the network connection to go down and the oven not to turn on at least as often as 10 minute makes an operable difference.

Maybe you don't decide at the start of your day, rather it comes up later that the kids want something baked for dinner that is already prepared and just needs to go into the oven, and you also get home from work at like 7pm. Idk how niche that is, but if that's someone's situation, the remote control makes sense.

Yup. Or the buses and the queues at childcare pickup and the speed of walking home with a 3 and 5 year old means that arrival times at home vary dramatically.

[delayed]

That'd be a legit feature, but far less involved than a full-on smart oven. At most, it'd have a way to turn off the oven remotely (but not turn it on).

Anyway, last time I had this anxiety, I checked my Ring camera in the kitchen that's posted there for reasons like this. Works for the stove and faucet too.

While I have neither, I'd much rather use a smart oven to see its status than have a constant camera feed of my kitchen.

It's not constant, it only starts recording when I ask it to. Mainly cause it's on battery. Also, it's just an observer, not controlling anything in the house.

A simple timer that switches off after a couple of hours would do. The timer could reset every time the oven door is opened. This should solve most issues. Long cooking could have a bypass button or somethong (if the door open reset is not enough).

I just remembered many old analog electrical ovens had this already , the only way to turn on the oven is by setting a timer (and when you needed it on for many hours you had to set another timer for yourself to remember to extend the oven timer ).

Even if you left the oven on, I believe it’s very unlikely to burn down the house.

These devices are designed to work for hours with minimal supervision. Given the size of the user base, IMO ovens are extremely reliable. And electricity prices are too low to be anxious about the costs.

> These devices are designed to work for hours with minimal supervision.

I wish. A while back, I put some (food) stuff to dry in the oven on a very low heat, knowing it would take all night to dry fully. After six hours, the oven decided that I must have accidentally left it on by mistake, and switched off automatically, and that stuff was wrecked when I got up in the morning and checked on it.

Indeed. I don't think I've ever heard of an oven burning down a house. And given how pretty much everyone has one, there must be many ovens left on alone in the house at every given moment.

If you think the oven can burn the house down, how about the anxiety of trusting some companies IoT oven not to be exploited by script kiddies to burn your house down?

[delayed]