SoylentNews is people
SoylentNews
from the Russians-hacked-my-toaster.-Again. dept.
TechDirt reports
Thanks to a laundry list of lazy companies, everything from your Barbie doll to your tea kettle is now hackable. Worse, these devices are now being quickly incorporated into some of the largest botnets ever built, resulting in some of the most devastating DDoS attacks the internet has ever seen. In short: thanks to "internet of things" companies that prioritized profits over consumer privacy and the safety of the internet, we're now facing a security and privacy dumpster fire that many experts believe will, sooner or later, result in mass human fatalities.
Hoping to, you know, help prevent that, the folks at Consumer Reports this week unveiled a new open source digital consumer-protection standard that safeguards consumers' security and privacy in the internet-of-broken things era. According to the non-profit's explanation of the new standard, it's working with privacy software firm Disconnect, non-profit privacy research firm Ranking Digital Rights (RDR), and nonprofit software security-testing organization Cyber Independent Testing Lab (CITL) on the new effort, which it acknowledges is early and requires public and expert assistance.
As it stands, most of the proposals are common sense and take aim at most of the common issues in the IoT space. For example, encouraging companies to spend a few minutes engaged in "penetration testing" of their products before shipping (a novel idea!). The standard also hopes to ensure companies notify consumers of what's being collected and who it's being shared with, and that devices aren't using default login credentials. But Consumer Reports also notes that it hopes to develop these standards with an eye on more broadly incorporating them into product reviews.
"The standard should be easy enough for consumers without a technical background to understand, yet sophisticated enough to guide testing organizations such as Consumer Reports as we develop precise testing protocols. We want to rate products on measures such as security, in much the same the way we currently assess products for physical safety and performance."
(Score: 1, Insightful) by Anonymous Coward on Sunday March 12 2017, @03:57PM (3 children)
These security issues are something that these people didn't even think could happen.
Most software is total trash, especially now that Javascript Script Kiddies have grown up and started moving into industry.
(Score: 2) by Kilo110 on Sunday March 12 2017, @07:17PM (1 child)
Why not both?
(Score: 1, Insightful) by Anonymous Coward on Sunday March 12 2017, @08:21PM
When something is produced in a lazy manner, then improving it is simply a matter of putting in the foregone work.
When something is produced in an incompetent manner, then it's virtually possible to improve it; it must be torn down and rebuilt.
(Score: 5, Insightful) by Thexalon on Sunday March 12 2017, @08:57PM
Actually, it's neither. The real cause is that all the incentives are wrong.
If you ask a manager to extend the project schedule 2 weeks to get the security right, I can guarantee you that the answer will be an emphatic "No" every time. That's because management sees security breaches on their products as something not in any way determined by the quality of the software involved, has no way of measuring the quality of software anyways, and any breaches that do happen are at most a minor PR problem for a few weeks until the noise dies down. Meanwhile, by launching the product before the next round of project management performance reviews, the manager in question will look far better to the boss to have gotten things out in time.
And that doesn't change after the product is launched. Management doesn't care about improving product that has already been sold. And why should they? They already have the money!
The only thing that stops a bad guy with a compiler is a good guy with a compiler.