Re: Access control for IoT

On Mon, 2016-01-18 at 17:30 -0800, Tony Arcieri wrote:
> On Mon, Jan 18, 2016 at 5:11 PM, Ben Kloosterman <[email protected]> wrote:
> 
> > Not practical / wise for HW / small  ioc .  Yet to see a single mother
> > board auto update - with good reason . HW normally works on no changes  and
> > if there are any changes there is normally a very length cycle before its
> > released. This includes Flash /EEproms  , not to mention that it some cases
> > you can brick the device with some Eeproms if you do  it to often.
> >
> 
> Not true. It is quite common for embedded hardware these days to not only
> be field updatable, but be able to transparently and incrementally download
> updates and install them. I will again point to my employer as reference.
> We do it, so I'm afraid I have to ignore your claims to the contrary.
> 
> Likewise, I would argue it's irresponsible to put devices which don't
> automatically update onto the Internet (that is the subject of this
> discussion, right? The *Internet* of Things).
> 
> There are certainly many applications of hardware for which updates are a
> bad idea, or devices which are too small or constrained to support
> automatic updates. But you have to Venn Diagram that with the types of
> devices it's reasonably responsible to connect to the Internet and assign
> an IP address to.

in practice you have the option to include an ethernet library and:

1) get the IP address via dhcp

2) hardcode the IP address into the program

> I would argue it's irresponsible to put any device on the Internet which is
> not capable of receiving software updates.

it seems after all that an automatic update mechanism is also a possible
attack vector.