Tech giants warn IoT vendors to get real about security

А васька слушает да ест

There is an excellent extra Fable in Krylov's retelling of Lafontaine's/Aesop's fables in Russian.

It is the fable about the Cook and the Cat. The Cook catches the cat in the act of stealing a big slice of ham and starts to chastize it. You bad kitty, yadda, yadda, yadda. And the cat listens and continues eating (А Васька слушает, да ест).

There is no baseball bat here. The kittie will CONTINUE EATING until all SOHO routers by default come with blacklist/whitelist for UPNP firewall traversal based on MAC. Not in an approved list of people who update their firmware - sorry no NAT traversal for you so no access from the Internet, bad kittie, bad kittie - no ham for you.

The issue is that these erstwhile "giants" are not even in possession of a bat to threaten anyone with. They divested from most of their Broadband CPE business and for the little they still make (Cisco Cable) the software is NOT WRITTEN IN HOUSE. So there is no bat (except just Google which has the staggering CPE share of <0.0001%). So Vaska can continue eating while the cook can continue to chastize. Nothing happened here. Move along. These are not the "broadband giants" you have been looking for.

"The industry is going to resist, because even implementing one of the report's many sets of recommendations – that the industry imitate enterprise IT's systems of vulnerability reporting, updates, life cycle management, secure updates and the like – falls entirely outside the economic model of a consumer gadget."

Narf, they will continue with business as usual. Was about to say "So what? Increase your pricing to ensure a budget for testing etc" but that have the same chances of an ice cube in hell.

Just an interesting thought - what if IoThings start to bombard Chinese IP's with everything they've got for a whole month? Or will they specifically avoid Chinese IP's and target world+dog that's not Chinese?

Just got back from a 'conference' held by yet another minor talking shop hoping to net some of the millions doled out by clueless government hoping for some iot street cred.

I bought up the very point. I was asked what needs to change and I said we need i) isp routers to ban anything not accredited, stamp a green padlock on each thing and ii) a successor to uPnP, which has to die a horrible death.

This was pooh-poohed. A non-starter. Let's publish another consumer leaflet instead and talk about getting Chinese manufacturers onboard. Sigh.