Comment by kbart | Hacker News Reader

Comment by kbart | Hacker News Reader

Parent Full thread

"I asked him a pointed question about how this scaled to the _international_ level, which he decided mostly not to answer (focus on domestic policy first, and such)"

He did answer that on his blog however:

"It's true that this is a domestic solution to an international problem and that there's no U.S. regulation that will affect, say, an Asian-made product sold in South America, even though that product could still be used to take down U.S. websites. But the main costs in making software come from development. If the United States and perhaps a few other major markets implement strong Internet-security regulations on IoT devices, manufacturers will be forced to upgrade their security if they want to sell to those markets. And any improvements they make in their software will be available in their products wherever they are sold, simply because it makes no sense to maintain two different versions of the software. This is truly an area where the actions of a few countries can drive worldwide change."[0]

And I mostly agree with him. If major markets start require certification of security (maybe something like FCC and CE), the rest of the world will follow as they want to trade in these premium markets. Sure, it will not solve the problem overnight, but at least it could be made less severe.

0. https://www.schneier.com/blog/archives/2016/11/regulation_of...

If you want to see a simple example of this in action, consider the impact that the California Air Resources Board has had on vehicle emissions globally. If you want to sell a car in CA it has to meet CARB standards. This effectively means that if you want to see a car in the US it has to meet CARB standards. As a consequence one of the largest car markets requires a specific minimum level in terms of emissions and almost all cars built for an export market can meet these standards or be easily modified to do so.

One state moved the needle here just by virtue of being the largest component of what was the largest market. There is no reason the same could not be done for internet-connected devices.

CA regulation did not stop VolksWagen to do what they did. And they did it for many years.

It didn't stop them from cheating, but they had to make the effort (a quite complicated effort at that) rather than just ignoring the regulation.

Nice to see he's thought about it since then. But anyways:

> "simply because it makes no sense to maintain two different versions of the software"

Except this isn't true. European law already requires Microsoft to separate certain features from it's core for European distribution - which is why there's Windows N for them and normal Windows for the US. Other pressures (such as government mandated backdoors, or regional media licensing) could easily create a situation where a company would find it beneficial to shard their software by market. (Which is, again, a load only larger companies can easily take on or optimize for!)

Microsoft already had their market segmented, so it was not hard to implement. I really doubt that some no-name Chinese router maker would bother to keep few versions of firmware vs disabling default admin password (yes, even that would be a huge step forward).

Reply on news.ycombinator.com