It's not just consumers that need to understand this. Manufacturers of Things are right now on a steep learning curve. Consider that thermostat, for just a moment. In The Gold Old Days, before it had a network interface, the manufacturer cared about a handful of things like at what temperature to turn the heat or A/C on maybe with some adjustments for time of day or day or week. And that was it. That is their domain of expertise. Not security. Now the Internet looks like a new shiny object that promises to provide some cool new world capabilities, like letting people adjust the temp while they're away, or using weather forecasts to manage hysteresis effects. And so, the manufacturer initially thinks, we'll add an interface to the product, and a little bit of code, and we're done. Now the manufacturer has stepped outside their domain of expertise, and doesn't have a full understanding of the risks that need to be addressed. We as experts in this domain can help by informing manufacturers of those risks. Eliot On 9/27/16 6:05 PM, Patrick W. Gilmore wrote:
On Sep 27, 2016, at 11:49 AM, Roland Dobbins <rdobbins@arbor.net> wrote:
On 27 Sep 2016, at 22:37, Patrick W. Gilmore wrote:
All the more reason to educate people TODAY on why having vulnerable devices is a Very Bad Idea. Yes, but how do they determine that a given device is vulnerable? Easy: Can you ping it? It’s vulnerable.
:-)
Hey, I said we would have to educate them. I did not say how that would happen.