> What you need is not a government mandate for infallibility, it's updates

So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring.

And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month another kind soul finds more bad wiring. And we just have to hope there is an army of kind strangers out there checking every building built by every company. And hope in the meantime that the building doesn't burn down.

Meanwhile, people have to live with bad wiring for years, that could have been completely prevented to begin with, by an electrician following the electrical code we all already agree on.

> What you need is the ability for consumers to replace the firmware.

I don't think that's enough. Most people aren't going to replace the firmware on their device with an open source replacement made by someone else. Now if the firmware was required to be open source, and automatic updates could be seamlessly switched over to a non-profit or government agency in the event of the company going out of business, you might have something. But there would be a lot of details to work out.

> And "require longer support" doesn't fix it because many of the vendors will go out of business.

Which is not a real issue in practice. It's like arguing that warranty doesn't matter because the vendor might go out of business.

The government obviously cares less about citizens running firmware China can hack than it does about citizens potentially running firmware the government can't hack.

The concept of community firmware seems like a huge cop-out that allows companies to externalize costs. And it probably won't help security because 99% of devices will never get the third-party firmware installed anyway.

Why not just put the onus on ISPs? 99% of users lease their router from their ISP. If updates stop after three years, looks like you're getting a complimentary service appointment to get a new router.

> But then vendors want to stop issuing them after 3 years

Tough shit. You provide updates for the mandated amount of time, or you lose access to the market. No warnings, you're just done.

> And "require longer support" doesn't fix it because many of the vendors will go out of business.

Source code escrow plus a bond. The bond is set at a level where a third party can pay engineers to maintain the software and distribute updates for the remainder of the mandated support period. And as time passes with documented active support, the bond requirements for that device go down until the end of the support period.

Requiring that the customer be allowed to replace the firmware is essential, I agree, but not for this reason. That requirement, by itself, just externalizes the support costs onto open source communities. Companies that sell this sort of hardware need to put up the resources, up front, irrevocably, to ensure the cost of software maintenance is covered for the entire period.

Personally I don't buy consumer router hardware that I can't immediately flash OpenWRT on, but that option is not suitable for the general public.

That’s a technical solution to a business and incentives problem.

How does one ensure the support for the devices is funded?

> What you need is the ability for consumers to replace the firmware.

> That solves the problem in three ways.

That alleviates the problem, but definitely doesn't solve it. Updates are still required, and most people will never update devices they don't directly interact with.

"You ship something with no known bugs and then someone finds one."

You managed to say that with a straight face!

Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out.

How on earth is embedded creds in any way: "no known bugs"?

I think we are on the same side (absolutely) but please don't allow the buggers any credibility!

Somebody has to pay for the support. There is no free meal.

Enterprise must be able to pay for support for as long as they use devices. Solved.

I can only think of requiring the devices to be serviceable, as you say. The absolute only way I can think of charging the consumers, ie the owners, is to charge a tax on internet connections. Then the government would pay somehow vulnerability hunters working along patchers, who can oversee each other.

Consumers are tricky: if you include support in the sale price, the company will grab the money and run in 3 or 5 years; and some companies will sell cheaper because they know they won't provide support.

>The problem is that "secure firmware" is a relativistic statement.

No it isn't, software formally verified to EAL7 is guaranteed to be secure.

I could see why someone might be confused in the Mayer of what the FCC can regulate, considering that it regulates the content of television and radio broadcasts and somehow regulates cable TV providers, despite the use of wired connections to customers, instead of radio transmissions.

So if a company uses as part of its marketing for a product the phrase "advanced security, privacy, and connectivity for homes of every shape and size" and then is later found to have lied about the "advanced security" and "privacy" part of their marketing by shipping firmware with security bugs, does that not now fall under the "deceptive" category of the "unfair, deceptive and fraudulent business practices" part of the FTC's mission?

Sounds like it does to me. Also you're forgetting the part where the FTC under a prior administration either banned DLINK from selling in the US or heavily fined them for selling routers in the US that they knew were running insecure, buggy firmware.

(both quotes were taken verbatim from first, Netgear's US website, and secondly the Bureau of Consumer Protections' section of the FTC's website)

Are you saying that other manufacturers don't do this?

What was the company, and what did they inject?

And who hasn't seen American software companies where crap security practices are later leveraged by the same company to run exploits? It's of course always phrased in Orwellian terms of business practices, terms of service, "security", etc but we can still call a spade a spade.

[dead]