Comment Re:CONSUME (Score 4, Insightful) 56
We need legislation that all equipment that is no longer supported be open sourced, and one last firmware update gives a vector to load your own firmware (or community) firmware you download.
Yes, and it needs to apply to absolutely everything, including computers, cell phones, etc. Having hardware locked to a single software vendor is barely tolerable while the manufacturer is supporting it, but absolutely should not be allowed once the manufacturer drops support.
But that's not really enough. Reverse engineering the hardware for nontrivial stuff is usually not worth the effort. The companies should be required to also do one of two things:
- Release their internal documentation telling address space layout, programming info for any custom ASICs, etc.
- Provide complete source code for their firmware, along with the toolchain required to build it.
This serves two purposes. First, it makes it much easier for a third party to bring up a usable firmware build without having to figure out how to unsolder the CPU and install a jumper harness under it to expose the JTAG pins. Second, it greatly increases the amount of effort required to drop support for a device, which may be enough to make companies think twice about doing it, and also may make companies think twice about releasing a product without a reasonable long-term plan for how to support it indefinitely.
I get they have no economic interest in these buttons, but for fucks sake, if you aren't paying for it continuously, "the cloud" will stop working with it eventually. We need a way to make the device receive / send API calls locally. This should be legislated.
Devices that require the cloud should be banned, period. Any device sold should be required to provide a non-cloud-based alternative control path that never leaves your network. This falls under "minimum security requirements" even if you ignore the whole "the cloud server could go away" problem and the "I can't turn my lights on because the Internet is down, and I can't see to reboot my router because I can't turn the lights on" problem.
But that's a separate law.
"We no longer support your device. Here is the most recent firmware's source code, the certificates used to validate the update server, and a quick read me on how to get it to fetch a firmware from your local computer (web server with said certificate). Thanks for using our product!"
That only helps if it is actually possible to build the firmware, which isn't a given. Also, that's opening all users up to a lot of risk if it gets installed automatically, because if there are any security holes in the device, someone would then have the global signing key and could upload new firmware that permanently compromises every unpatched instance of that device all across the planet in a matter of days.
IMO, a much better process is something like this:
- Devices must be able to have properly signed firmware side-loaded, either by shoving the data on a USB stick and plugging it into the device (strongly preferred) or by making the device look like a USB mass storage device when you connect it to a computer and the user dragging and dropping the firmware bundle onto it.
- The manufacturer stops shipping automatic firmware updates.
- The manufacturer releases a manually downloadable firmware update that allows the user to provide a replacement signing key by attaching a mass storage device or uploading it to the mass storage endpoint.
The use of an external mass storage device (rather than the device looking like a mass storage device) is strongly preferable for security reasons, because it would be much harder (and, if done correctly, impossible) to exploit remotely and install a malicious party's key onto the device, then trick it into downloading a new firmware bundle from some other server, etc.
At that point, the user would provide a new user signing key that would sit alongside the manufacturer signing key and would be treated as an authorized signing key for firmware uploaded to the device. This would also have the benefit (from a corporate perspective) of making the product something that would only be used by hobbyists, and not turned into a tool for their competitors, because the installation process would be just enough effort to limit interest.