Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates
One thing that regulators need to be very careful about is how &quot;security updates&quot; are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like &quot;manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9&quot; would be a clear non-starter.<p>There are also often practical issues related to security patching embedded devices: for example, a downstream supplier&#x27;s driver can make it impossible to upgrade a kernel unless&#x2F;until the supplier provides a fix. Of course, strong regulation here could help to drive bad practices like that out of the industry, but I&#x27;m not going to hold my breath on that one. The effect of regulation like this would make it harder for manufacturers who don&#x27;t have the market power to lean on their suppliers to provide security patches.<p>Finally, it&#x27;s important that any regulation that mandates or strongly encourages software updates also mandates that the update system itself be implemented in a secure way. This is my specific area of expertise, and I can tell you that it&#x27;s very often done very badly. A bad update system is a gigantic, flashing red target for attack. So something like mandating signatures (and sig validation) on software update images would be a good start. Mandating the use of TUF-compliant repositories would be even better.