Re: Food for thought (resurfacing)

On Tue, Jul 29, 2014 at 10:44 PM, Larry Masinter <masinter@adobe.com> wrote:

>  I know the Nest does auto-update. But it’s also $249.
>
> How much would a non-auto-update one cost?
>
> What if I want a 3rd-party security scan of my company’s thermostat code?
>
> The thermostats of a building can become critical infrastructure.
>
> Imagine a thermostat where all the web part does is show weather warnings.
>
> Is auto-update really important here?
>

If it's critical infrastructure, then auto-uppdate really is really
important.


> You don’t want to support a web
> thermostat where the browser is in ROM and optional?
>
>
>
> I have lots of devices on my home network – printers, pcs, mobiles, pads,
>
> receiver, remote, thermostat, tv, blue-ray, roku, cable box, routers,
>
> personal peripheral (FitBIt).
>
>
>
> Most of them could logically use the web. And most aren’t auto-update,
>
> don’t need it, don’t need updates, the web is just a piece of what they
>
> do. I’m spending way too much time babying updates. This is a good
>
> architecture for whom?
>

For everyone else connected to the web. Once these devices reach out and
touch someone, they can do so in inappropriate ways when subverted. I
recommend checking out one of HD Moore's talks to get a sense for the scale
of the problem and the worst offenders:

    https://www.youtube.com/watch?v=VuYi7gVy3dI

Hint: it's old, unupdated, unloved software. Don't be That Guy (TM).


>
>
> Yes, and if you have a Nest, you'll understand that it DOES auto-update.
>
>
>
> Rather, than, say, sandboxing the display module? Auto-update isn't a
> security panacea.
>
> Doesn't it cost more to build auto-updating thermostats; are non-updating
> ones out of scope for the web?
>
>
>
>