(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)

That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.

Although I think it's fair that the company not have to deal with a defect that is almost certainly caused by something you do to your device. Like, strawman, but early iPhones sometimes encountered issues while doing an untethered jailbreak, or people would install tweaks that were less than stable (even sometimes on relatives' or friends' phones), then they would walk into an Apple Store with weird behavior and expect the fix to be free. That shouldn't be covered by warranty.

I struggle to think of a reason why a phone can't be factory reset to fix those issues that doesn't involve "the manufacturer fucked around trying to prevent 3rd party changes". It's their problem and fault if their attempts to prevent 3rd party software ended up bricking the phone. I can't be bothered to give a shit that they've done weird things to the bootloader and now it won't boot because the bootloader doesn't have the right magic keys. Fix it or issue a refund, it's their software breaking the damn thing.

That does exclude "your software physically burnt out hardware" but that's such a rare occurrence it's practically not worth mentioning. I can't remember the last time I heard of a ROM that physically killed a part.

Those people rightfully were like why can’t we keep it and the company was like we have to run the services to manage it. Why not just open up the hardware and let it continue being used? Well if you put the wrong software and it ends up killing the person, the hardware company can be held liable.

Made me realize my dream of having an open-source car is never going to happen.

Basically, we already live a reality where dangerous machines like cars have been hacked and are operated on the street among us.

This is the same argument that was being made that FOSS is less secure because it's open in the 90s or 2000s. Yet the most of critical infra today runs on open source.

Don't you think it'd be safer if these tuners had access to the source code?

That is to a certain point. If deemed misuse would be harm against other people or circumvent export control. You may also restrict, who is allowed to do it. However, if software is the only protection against dual-use, tler might have a general problem.

But at the same time, risk profiles between different tools are different, and it is common to have special rules for some of them. Eg. guns already do.

While we might need to stop an unlicensed SW engineer to accidentally or purposely turn your housekeeping robot into a killer robot, the risk of them messing up their fridge is lower. Yes, your food could spoil and kill you, but your fridge could face a power cut and do the same.

So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.

I think the main thing to grapple with is the idea that even laypeople who aren't security or SWE experts may want to protect against the highest risk profile possible, even if they don't personally understand what they're giving up. (And, for most of these people, I imagine they're giving up a freedom they might not have ever thought of using in the first place)

Strawman but, If you want to make a device called "securePhone 2027", where not even an evil maid attacker (say, a national security agency who has spied on you over your shoulder for 180 days and has thus seen all of your passwords) can install spyware on your phone, what sort of qualifications do you need to have in order to purchase (or qualifications for a manufacturer to sell) such device?

Part of the issue in arguments like this is in saying that, because the iPhone is the most popular phone in the United States, they should be forced to compromise on security because enough buyers aren't aware of the compromises they're making in order to have the iPhone. So if you still want companies to be able to sell a brick that never runs unsanctioned7 code, you either need

(A) setting an upper bounds (market share?) to how big a company can get before they must compromise on security and allow people to self-compromise via going through multiple hoops to disable security protections (e.g. disabling SIP on a Mac). (B) means-testing that the customer understands that what they're buying could compromise their security (C) some key ceremony for allowing said device to be unlocked. I imagine a 1 month waiting period plus needing to show passport and proof-of-non-coercion across multiple nation-states could work? maybe only if they're not apart of a shared intelligence network coallition (like five/nine/fourteen eyes)?

The fact that the iPhone is incredibly resistant to all forms of widespread malware is really good for society at large. Like, the only known widespread malware (outside of web-based scams calling Alert("Apple has compromised your device, call this number")) has been developer-distributed malware due to chinese developers releasing apps via a malicious unsigned Xcode app [0].

0: https://youtu.be/tJeEuxn9mug?t=1502

Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.

(I find revocation a harder problem, really)

Smartglasses have an amazing potential to improve lives when done right and used right. But that relies on a sophisticated sensor hardware package that is barely distinguishable from a covert recording tool, simply because of the reality of the problem space. I don't want to see that tech totally canned as assistive technology because of backlash.

We’ll never improve society as long as we keep rolling over and saying “it’s the way it’s going to be, we just have to adjust”. Nothing made by humans is inevitable. Chat Control having been repeatedly repealed is proof that resistance is not futile. We’re in a bad spot, yes, but we should fight to defeat the bad outcomes or delay them as much as possible.

someone 100 years from now might be horrified by the idea that murders and rapes were very often unsolved because the AI wasn't around to see them happen.

Just about everything you hold as sacred an indelible features of a just and normal universe is actually a societal preference subject to the tastes and sensibilities of the people of that time.

I think that's their whole point. That society can shape itself and that nothing is set in stone. There is no reason to roll over and say 'this is OK' if you don't think it is OK. If enough people don't think it is OK, it won't be considered OK.

Would people using them because of visual impairment be OK with them being bright green?

https://www.theverge.com/gadgets/962514/meta-privacy-light-t...

People don't like recording, and there's usually a patchwork of laws that give many people some protection against it.

Not related to meta but the privacy angle is stuff like the Plaud recorders. Normal non-techies have had these, including personal run-ins of my own with people using these dedicated smartphone recorders where it was neither acceptable nor consensual.

I'm curious if ubiquitous and hidden personal recording collapses the technical or social lines set up against it first.

The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.

So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.

That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.

Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.

I agree some big obvious scare message is good but actually voiding the warranty restricts user freedom.

Only thing is, if the company releases software updates to fix issues, they should by no means be expected/required to backport bug fixes to older versions just so that compromised devices can. There are certain warranty claims where the issues would be solved via software update, but thus are unavailable to people who are insistent on staying on a rootable version of the firmware.

At some point in the software as a service world (driven by web apps), we started accepting that a manufacturer can break the software we use (change it so it does not have the same features or even just UX we are used to), and is now mandated to provide security maintence but can still do that by simply forcing a customer to their new version.

I understand the economics of this, but this is why I loved LTS releases and their commitment to backport security vulnerability fixes.

Hopefully with GenAI, companies sprout that will support this for consumers too!

No deal.

Nah. No thanks. I want actual freedom, not a longer chain.

As an engineer, you wouldn't believe how many times I've recently used `curl | bash` to install a piece of software

I'm a Zionist only in the sense that I believe both the Jews and Arabs (Palestinians) have/had a right to states in their respective majority areas because of secular reasons after studying the history of both sides; not on religious or theological grounds.

It's partly what led me to convert to Eastern Orthodoxy which doesn't believe in "Christian Zionism" as a form of end-of-days prophecy. The level of crazy I saw in Evangelical churches and groups during my time there could become absurd.

They also happen to be caught between a rock and a hard place where both the Israelis and the Muslim Palestinians both oppress them. Quoting from [1]:

    I am a Christian by religion, born in Nazareth, Israel to 
    Arabic-speaking Christian parents and brought up in Kufur Yasief, 
    the hiding place of Josephus Flavius
    
    Persecution for Christians in Israel and Palestine is not on the 
    scale it is in Egypt, but it is there nonetheless. It must be added 
    that there is a growing number of Jewish-background, and Russian
    Christians in Israel, who suffer more persecution from the 
    Jewish state and people. 
    ...
    Christian Arabs in Israel/Palestine live in a climate of fear 
    and therefore hypocrisy. Pressure on Arabic-speaking Christians 
    to tow the Muslim Arab nationalist line is so great, that we are even
    afraid of complaining about injustices against us.
    We suffer:
    • At the hands of Jews, because we are seen as:
     o Arabs: and so enemies, and primitive.
     o Christian: and so gentiles. WE are often blamed, by association, 
           for the European holocaust.
    • At the hands of Muslims because we are Christian, and "infidels." 
         We are often punished for “western” bias towards Israel.

[0] https://github.com/soundscape-community/soundscape/

I think we can be certain that reduced cash use didn't cause the pandemic, and a common cause for both is also hard to imagine. That only leaves the pandemic causing a reduction in cash use. Am I missing something?

Sometimes a thing is bad in and of itself. A thing designed specifically and explicitly to do bad things is still bad even if it helps a small number of people.

And if that didn’t help, there might be a push to limit access to these machines because clearly a too significant part of the population is unable to use them responsibly.

That's not why they're making them though; that's just insincere cover. If they were intended to be assistive devices, the marketing would be totally different.