undefined | Better HN

0 pointsmkagenius3mo ago0 comments

Since this can be a significant security issue for the state, why doesn't the government sponsor a security audit of the software. Does it upload the data or everything is done on the device? (Also, will have to keep up with the updates)

0 comments

grosswait3mo ago

How does that provide any assurance against future changes that the public wouldn’t have any ability to know about.

hackernewds3mo ago

So the govt implements rules and a panopticon for penalties. this works for the FDA, why wouldn't it for the FCC

pintxo3mo ago

Because regulation is bad, according to the current executive?

Politics aside, the FDA applies a very generous amount of regulation (mostly justifiable), not sure we want to pay multiples for our consumer electronics, as it (mostly) shows acceptable behavior and rearely kills anybody.

1 more reply

Tangurena23mo ago

The NSA has a bad historical reputation for this sort of thing - intentionally weakening crypto standards to make things easier for themselves to break, while keeping them "strong enough" that other agencies outside of NSA/GCHQ/GRU can't. The Crypto AG scandal [0] was pretty bad, with Clipper/Skipjack & Dual_EC_DRBG [1] being more recent ones. The NSA could do what you are asking to do, but they probably won't let us know what the really bad holes are because they want to keep using them.

Notes:

0 - https://www.washingtonpost.com/graphics/2020/world/national-...

1 - https://www.scientificamerican.com/article/nsa-nist-encrypti..., https://en.wikipedia.org/wiki/Dual_EC_DRBG

IAmBroom3mo ago

"Why doesn't the state protect everyone from ___?" is a naive question.

Almost anything can be a significant security issue for the state. They have to carefully choose where they are going to spend effort & money.

And they pick whatever will keep them safely in power... which never ever includes "strict regulation of vacuum cleaners".

PaulDavisThe1st3mo ago

> which never ever includes "strict regulation of vacuum cleaners

but has routinely included "network and encryption related technologies".

It's just that these two worlds now, amazingly and probably incorrectly, overlap.

CamperBob23mo ago

The government's idea of regulating encryption-related technologies is to prohibit anyone but the government from using them. No, thanks.

Tangurena23mo ago

We don't regulate/protect the SCADA systems that run utilities like water treatment plants and the power transmission system.

kspacewalk23mo ago

Better yet, why not pick a security auditor and have the bidder pay for it, as a condition for approval?

j / k navigate · click thread line to collapse

0 comments

grosswait3mo ago

How does that provide any assurance against future changes that the public wouldn’t have any ability to know about.

hackernewds3mo ago

So the govt implements rules and a panopticon for penalties. this works for the FDA, why wouldn't it for the FCC

pintxo3mo ago

Because regulation is bad, according to the current executive?

1 more reply

Tangurena23mo ago

Notes:

0 - https://www.washingtonpost.com/graphics/2020/world/national-...

1 - https://www.scientificamerican.com/article/nsa-nist-encrypti..., https://en.wikipedia.org/wiki/Dual_EC_DRBG

IAmBroom3mo ago

"Why doesn't the state protect everyone from ___?" is a naive question.

Almost anything can be a significant security issue for the state. They have to carefully choose where they are going to spend effort & money.

And they pick whatever will keep them safely in power... which never ever includes "strict regulation of vacuum cleaners".

PaulDavisThe1st3mo ago

> which never ever includes "strict regulation of vacuum cleaners

but has routinely included "network and encryption related technologies".

It's just that these two worlds now, amazingly and probably incorrectly, overlap.

CamperBob23mo ago

The government's idea of regulating encryption-related technologies is to prohibit anyone but the government from using them. No, thanks.

Tangurena23mo ago

We don't regulate/protect the SCADA systems that run utilities like water treatment plants and the power transmission system.

kspacewalk23mo ago

Better yet, why not pick a security auditor and have the bidder pay for it, as a condition for approval?

j / k navigate · click thread line to collapse