Re: [Spud] SPUD's open/close are unconvincing

[Eliot Lear <[e-mail]>]

Hi,

On 4/9/15 7:22 PM, Tom Herbert wrote:

> The major Internet security problem now is in embedded systems which
> are not maintained (which notably includes middleboxes  like home
> routers) (https://www.schneier.com/essays/archives/2014/01/the_internet_of_thin.html).

While it's true home routers get 0wned, they are actually not the
biggest problem.  The biggest problem will be the orders of magnitude
more boxes that are behind those boxes (for those keeping score, home
routers= O(1), and a house full might very quickly rise to O(100).  Of
those, maybe O(10) will ever see an update, and those will be general
purpose computing devices, and they will only get an update under the
best of circumstances.  This wouldn't normally be germane to SPUD, but
the "I hate middleboxes" mentality only gets you so far.
> This is not a OS, userspace, or firmware issue, or even protocol a
> issue-- but this is an issue with the software deployment model of a
> wide array of products. I don't know how SPUD will be able to help
> solve this, but it should at least not make things less secure.

It is all of the above, but the fact is that it is also a UI issue, a
trust problem, and an economics problem.

Eliot