Comment by mdekkers | Hacker News Reader

Comment by mdekkers | Hacker News Reader

Parent Full thread

I am not sure I agree with CF's example of why security for the IoT is too difficult. They claim:

- The PC security model can't scale to handle 22;

- The IoT builders don't have an update mechanism, and are scared to send bad updates;

- Consumers don't think about applying updates;

That is some serious FUD used by CloudFlare. Each of these have a simple solution:

- More infrastructure;

- Write good updates. This is not impossible, it is simply a matter of cost. NASA needs to write error-free software, and manages to send updates to devices throughout the solar system.[1];

- They wouldn't have to, if your mechanism is good enough;

Moreover, the whole argument is disingenuous. IoT devices are likely to be several orders of magnitude simpler than PC's (Or Mac's or whatever) which are general purpose computing devices as opposed to an IoT devices which is likely single or limited purpose, significantly reducing the complexity in most cases.

This isn't to say the CloudFlare solution is a bad thing per-se, but the way CloudFlare goes about selling it is too easy to shoot down.

[1]https://www.fastcompany.com/28121/they-write-right-stuff

"Moreover, the whole argument is disingenuous. IoT devices are likely to be several orders of magnitude simpler than PC's (Or Mac's or whatever) which are general purpose computing devices as opposed to an IoT devices which is likely single or limited purpose, significantly reducing the complexity in most cases."

This is a double-edged sword. The increased capabilities of my laptop and smartphone (having human-friendly input and output) are what makes upgrading them so easy. The simplicity of a lightbulb, lacking a monitor and keyboard, is what makes updating it relatively difficult for a non-technical person, and this is on top of Cloudflare's fair (IMHO) opinion that consumers also don't even think to update such an apparently simple device.

I agree with you, of course, that IoT security should work better outside of the consumer's hands entirely, but I think Cloudflare has targeted an existing market opportunity fairly well with this announcement.

I have a suspicion though, that any vendor who cares enough to use this new service will also likely be better at security than other IoT vendors anyway. At that level, I can't criticise such a defense-in-depth approach, but if Cloudflare ever stops operating, it won't be pretty.

The simplicity of a lightbulb, lacking a monitor and keyboard, is what makes updating it relatively difficult for a non-technical person

I see your overall point and don't disagree. However, most IoT devices will have some kind of UI, in the form of a smartphone app or other kind remote access - think routers, WiFI AP's (not IoT per-se, but devices without keyboard/mouse) or recently there was some brouhaha over garage door openers, I believe. The App/Webpage is a clear route to notify users, and manage the upgrade process. I believe it is possible, and doable, but will cost money. And until we are going to start seeing some serious attacks with real day-to-day impact, IoT makers will remain unmoved to invest in this process. I believe that CF fuels insecurity in the medium to long term by removing further incentives for the makers to invest in secure practices.

I believe that CF is aware of this, hence their marketing message appears to be "it's too hard, don't bother, we'll take care of it"

Reply on news.ycombinator.com