Bruce Schneier: 'The Internet Era of Fun and Games Is Over'
The problem is that software engineering is hard.<p>Immensely so.<p>On a scale of engineering &quot;hardness&quot; (meaning, we can predict all side affects of action), software engineering is closer to medicine than to, say, civil engineering.<p>We know stresses, materials, and how they interact. We can predict what will happen, and how to avoid edge cases.<p>Software? Is there any commonly used secure software? Forget about Windows and Linux. What about OpenBSD?<p>Did it ever have a security hole?<p>And that&#x27;s just the OS. What about software?<p>There are just too many variables.<p>So what will happen?<p>There will become &quot;best practices&quot; enshrined by law. Most will be security theater. Most will remove our rights, and most will actually make things less safe.<p>Right now, the number one problem of IoT security is fragmentation. Samsung puts out an S6, three years later stops updating it, a hole is found, too bad. Game over.<p>The problem is that &quot;locking firmware&quot; is common &quot;security theater&quot;, which, if there&#x27;ll ever be a legal security requirement on IoT, it&#x27;ll require locked bootloader and firmware.<p>And you can&#x27;t make a requirement to &quot;keep code secure&quot;, because then the question will be for &quot;how long&quot;? Five years? 10 years?