Subject: [perpass] US intelligence chief says we might use the IoT to spy on you

From: Russ Housley <[email-masked]>
Date: Thu, 11 Feb 2016 10:02:48 -0500

http://www.theguardian.com/technology/2016/feb/09/internet-of-things-smart-home-devices-government-surveillance-james-clapper?CMP=share_btn_fb

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 11 Feb 2016 10:09:07 -0500

Then-CIA Director Petraeus said essentially the same thing four years ago, FYI:

http://www.wired.com/2012/03/petraeus-tv-remote/

On Thu, Feb 11, 2016 at 10:02 AM, Russ Housley <[email-masked]> wrote:
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

CDT's annual dinner, Tech Prom, is April 6, 2016! https://cdt.org/annual-dinner

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 11 Feb 2016 15:14:38 +0000

> http://www.theguardian.com/technology/2016/feb/09/internet-of-things-smart-home-devices-government-surveillance-james-clapper?CMP=share_btn_fb
Yeah, that's a shocker eh;-(

FYI, I did try to argue for defining a padding scheme
in the COSE wg [1] but nobody else seems to care, so at
present, I think they won't define a mechanism.

Padding of course isn't anywhere near sufficient but if
we don't add such mechanisms to our protocols, then ISTM
that we're making that kind of tracking easier.

More broadly, if someone has expertise in this space,
and would like to do a presentation at a saag session
at an IETF meeting, I think that'd be good. Contact
Kathleen and I if so.

S.

[1] https://mailarchive.ietf.org/arch/msg/cose/eq6HMc8tm1sYghpS8LFcvADZPn8

> 
> 
> 
> _______________________________________________ perpass mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/perpass
>

---

From: [email-masked]
Date: Thu, 11 Feb 2016 11:22:31 -0500

IoT will consistently be where dual use is most profound.
Consider what I know to call "WiVi"...

scientific references

  people.csail.mit.edu/fadel/wivi

nascent commercial delivery of above
  
  www.emeraldforhome.com

I'll go a little further and suggest that IoT for health
will be the most profound within the most profound, though
the Sensity platform is already widely deployed.
  
  www.sensity.com

--dan

---

From: Dave Crocker <[email-masked]>
Date: Thu, 11 Feb 2016 08:42:32 -0800

> Yeah, that's a shocker eh;-(

In terms of privacy, it is worth treating statements about likely 
exploitation for attacks as merely one more basis for increasing 
protections.

Until recently, I'd assumed that the IOT devices in a home could be 
isolated from the devices under more classic control, such as personal 
computers.  That is, since a user does the regular administration of 
their computer, its safe operation is likely to be more predictable, 
whereas all those IoT-ish devices are likely to be more vulnerable.  So 
set up a barrier (firewall) between them.

It's increasingly clear that

      a) a firewall isn't really possible, given the extent of 
interoperation needed among /all/ the devices in a home, and

      b) none of the classic consumer devices (pc/laptop, tablet, 
whatever) are as much under user control as one would like to think. [1, 2]

Simply put, we need to design protection mechanisms on the assumption 
that every single device is being told by outsiders (vendors, attackers, 
whoever) to obtain and report data we might wish them not to.  There's 
no safe island.

d/

[1] 
http://arstechnica.com/information-technology/2015/08/windows-10-doesnt-offer-much-privacy-by-default-heres-how-to-fix-it/

[2] 
http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/

---

From: Robin Wilton <[email-masked]>
Date: Thu, 11 Feb 2016 17:13:18 +0000

Yup - so much for the dire warnings about the Internet "going dark"... they're about to see the deployment of exponential numbers of devices where security is (if I'm optimistic) a "bolt-on", ad which will generate a constant stream of cloud-bound data, straight from your fridge/lightbulb/pants.

I thought DKG put it very pithily in Yokohama: "it's not that the Internet is going dark, it's that the agencies have been staring at the sun for the last decade or so" (not verbatim quote, apologies to DKG for any inaccuracy!)

Yrs.,
Robin

Robin Wilton

Technical Outreach Director - Identity and Privacy

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 11 Feb 2016 10:39:24 -0800

On Thursday, February 11, 2016 7:15 AM, Stephen Farrell wrote:
> > http://www.theguardian.com/technology/2016/feb/09/internet-of-things-s
> > mart-home-devices-government-surveillance-james- clapper?CMP=share_btn_fb
> >
> >

Many of the appliances are designed to "report to the cloud," and have a business model based on the "big data" that they acquire. If we design appliances like that, it will be hard to keep "big brother" away.

> FYI, I did try to argue for defining a padding scheme in the COSE wg [1] but
> nobody else seems to care, so at present, I think they won't define a
> mechanism.
> 
> Padding of course isn't anywhere near sufficient but if we don't add such
> mechanisms to our protocols, then ISTM that we're making that kind of
> tracking easier.
> 
> More broadly, if someone has expertise in this space, and would like to do a
> presentation at a saag session at an IETF meeting, I think that'd be good.
> Contact Kathleen and I if so.

Sure, encrypting the communications between the appliances and the cloud cannot hurt. But we should also look at standardization, so that appliances can communicate directly, or so that people could easily switch the "appliance monitoring" services. In the absence of such standards, we get lots of info concentrated in few places, which becomes of course a target for all kind of spying.

-- Christian Huitema

---

From: Dave Crocker <[email-masked]>
Date: Thu, 11 Feb 2016 10:49:29 -0800

On 2/11/2016 10:39 AM, Christian Huitema wrote:
> any of the appliances are designed to "report to the cloud," and have
> a business model based on the "big data" that they acquire. If we
> design appliances like that, it will be hard to keep "big brother"
> away.
...
> Sure, encrypting the communications between the appliances and the
> cloud cannot hurt. But we should also look at standardization, so
> that appliances can communicate directly, or so that people could
> easily switch the "appliance monitoring" services. In the absence of
> such standards, we get lots of info concentrated in few places, which
> becomes of course a target for all kind of spying.

Yes, but...

First, tablets and, now, PCs are following exactly the same reporting model.

Second, the 'monitoring' is controlled by the original vendor and they 
have no interest in handing that control over to anyone else, no is 
there any groundswell among customers to force the change.

Standards work when there is a very strong market force demanding them. 
  We ain't got that.  Yet(?)

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Ted Lemon <[email-masked]>
Date: Thu, 11 Feb 2016 13:57:18 -0500

To be fair, there is really no way at present for IoT vendors to
deliver service without running the data collection end, unless they
sell you a workstation to do it at home.   If there were a place at
home where data collection apps could run, it's not inconceivable that
something better could be arranged, but at present there is no basis
for vendors of data collection equipment to cooperate with vendors of
data aggregation services.   In order for that to change, someone has
to lead the way.   It's possible that if someone leads the way, it
still won't happen, but without that, it definitely won't happen.

The IETF has the technological basis for working on this problem, but
it would be completely speculative at this point, and probably we'd
get it wrong.   More likely this is something that the open source
community should work on, if we want it to be open.   I think the IETF
could play a role in that process, because otherwise we'll get a
repeat of the dbus fiasco, but we can't really drive the effort--all
we can do is try to document it and address interop problems before
they are cast in concrete.

Customer satisfaction with various laptop<->cloud solutions is quite
low at the moment, BTW.   I am not convinced that this model of
operation is actually the wave of the future.   Maybe they will figure
out how to do it right, but at the moment the jury is out.   A more
open development model probably would have made this better, but
wouldn't have served the interests of the incumbents.

On Thu, Feb 11, 2016 at 1:49 PM, Dave Crocker <[email-masked]> wrote:
> Second, the 'monitoring' is controlled by the original vendor and they have
> no interest in handing that control over to anyone else, no is there any
> groundswell among customers to force the change.
>
> Standards work when there is a very strong market force demanding them.  We
> ain't got that.  Yet(?)
>
> d/
> --
> Dave Crocker

---

From: [email-masked]
Date: Thu, 11 Feb 2016 22:54:33 -0500

> Yup - so much for the dire warnings about the Internet "going dark"...

The IoT will be why the percentage of the network that is dark,
that is to say unreachable, will approach 99%.  They will get their
addresses from DHCP4/6 and will be behind a firewall that will
prevent inbound connections by default.  The default-routable
customer network is history.

And if that turns out to not be the case, the world will then truly
be the traffic analyst's oyster.

--dan

---

From: Paul Ferguson <[email-masked]>
Date: Thu, 11 Feb 2016 20:32:25 -0800

On 2/11/2016 7:54 PM, [email-masked] wrote:

> that is to say unreachable, will approach 99%.  They will get
> their addresses from DHCP4/6 and will be behind a firewall that
> will prevent inbound connections by default.  The default-routable 
> And if that turns out to not be the case, the world will then
> truly be the traffic analyst's oyster.
> 

I am very much liking the way you are thinking here, Dan Geer. :-)

Cheers,

- - ferg

- -- 
Paul Ferguson
PGP Public Key ID: 0x54DC85B2
Key fingerprint: 19EC 2945 FEE8 D6C8 58A1 CE53 2896 AC75 54DC 85B2

---

From: Robin Wilton <[email-masked]>
Date: Fri, 12 Feb 2016 09:01:03 +0000

True... but as I say, a large proportion of those devices will generate data which comes out from behind the firewall and therefore becomes accessible. Businesses based on the monetization of personal data stand to gain from IoT because it represents a massive increase in the generation of their 'raw material'; but to be useful, that raw material has to get to them and be mined.

R

Robin Wilton

---

From: Brian Trammell <[email-masked]>
Date: Fri, 12 Feb 2016 11:11:35 +0100

And why would I (as an intel analyst) care about getting data directly off a bunch of behind-the-firewall devices when I can just compromise the link between the IoT startup and their cloud providers to get *all* the data conveniently packaged and preanalyzed?

On perimeters: I agree, but there's still a lot of scope for reducing the exposure of devices with, shall we say, a relaxed approach to software engineering, operational security, and security vulnerability testing and management. The MUD approach (draft-lear-mud-framework) seems promising for helping to shore up the perimeter of home and enterprise frameworks, but the fact that that needs shoring up is more an implementation-level failure than an "IoT architectural" one. The architectural failure in a world where we care about mass surveillance of civilians is the centralization-eases-monetization pattern, which is the entire thing driving IoT through the hype cycle in the first place.

Cheers,

Brian

> On 12 Feb 2016, at 10:01, Robin Wilton <[email-masked]> wrote:
>

---

From: Michael Richardson <[email-masked]>
Date: Fri, 12 Feb 2016 09:25:23 -0500

> still won't happen, but without that, it definitely won't happen.

All true, and the privacy situation for Web-Connected Things is going to
continue to be bleak as long as the companies are market verticals, rather
than elements of cooperative interchange.

Or to put it another way: the current Web-Connected Thing market suffers from
all the insecurities due to centralization that the PSTN suffered from, and
the solutions to it are the same e2e principales that the IETF has championed
for decades.

At the pub at the London IETF, ran into former IAB member Jon Crowcroft (he
was like: hey! I recognize those badges!), and he introduced us to his
project:
        hubofallthings.com

Some good videos:
     http://www2.warwick.ac.uk/fac/sci/wmg/research/business_transformation/ssg/research/value/hat/

I think it is has significant potential, and seems to be making a good market
transition, although I haven't followed it as closely as I'd like.

I think that the Thread Group is going in a similar direction as well as OIC,
but with significantly less visibility.

Marshall Rose also leads a project: http://thethingsystem.com/ which has
different aims, seems much more grassroots, which is both good (easy to get
involved), and bad (doesn't seem to have attracted much market interest).
The Thing System seems to be more about adapting itself to stupid devices,
rather than creating better (more secure, more private) standards for devices
to adhere to.  Marshall has the advantage of not needing an income in order
to be able to work on this stuff.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Dave Crocker <[email-masked]>
Date: Fri, 12 Feb 2016 06:32:37 -0800

On 2/11/2016 10:57 AM, Ted Lemon wrote:
> home where data collection apps could run...

I do not know of any reason the model for IoT needs to be different from 
email.  That is, yes, servers are needed.  They might reside with 
end-users, but they do not have to.

The essential point is to have an open interconnection specification 
that permits mixing different vendors' products together.  (This is true 
for mixing IoT end devices, not just IoT data servers.)

I think the real issue here is that the vendors have a strong incentive 
to /retain/ their data acquisition role.  So they won't give it up 
unless and until there is a strong consumer-driven pressure for it.

> get it wrong.

Well, you are more optimistic than I.  Absent involvement of folk with 
subject matter expertise, the likelihood of getting the design right is 
zero, IMO...  That is, 'certainly' rather than 'probably'...

d/

---

From: Dan York <[email-masked]>
Date: Fri, 12 Feb 2016 16:14:12 +0000

Dave,

On Feb 12, 2016, at 9:32 AM, Dave Crocker <[email-masked]<mailto:[email-masked]>> wrote:

I do not know of any reason the model for IoT needs to be different from email.  That is, yes, servers are needed.  They might reside with end-users, but they do not have to.

On this point, I think RFC 7452 ( https://tools.ietf.org/html/rfc7452 ) did a nice job with spelling out the different "communication patterns" seen in IoT deployments.

To Ted's point, what I think we're seeing is a very large number of vendors pursuing the "Device-to-Cloud" model (section 2.2) of sending all the data back to some central application service provider, versus the "Device-to-Gateway" model (2.3) where there is a local hub in the home.

You're right, Dave, that this is quite similar to email... people *could* operate their own home email servers, or they could just use some big cloud-based vendor (<insert favorite name here>).

The essential point is to have an open interconnection specification that permits mixing different vendors' products together.  (This is true for mixing IoT end devices, not just IoT data servers.)

This *is* the ideal I think we want to shoot for, BUT...

I think the real issue here is that the vendors have a strong incentive to /retain/ their data acquisition role.  So they won't give it up unless and until there is a strong consumer-driven pressure for it.

... I think you're right on target here.  I think with IoT consumer devices we're still in the early deployment stages where the vendors are trying to capture the ecosystem and obtain de facto standards purely by market success.   I think it will take some significant level of consumer frustration with not being able to buy, for instance, two lightbulbs from different vendors and have them work together before there will be enough pressure to get vendors to start interoperating.

My 2 cents,
Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked]<mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked]<mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/

---

From: Dave Crocker <[email-masked]>
Date: Fri, 12 Feb 2016 08:20:57 -0800

On 2/12/2016 8:14 AM, Dan York wrote:
> To Ted's point, what I think we're seeing is a very large number of
> vendors pursuing the "Device-to-Cloud" model (section 2.2) of sending
> all the data back to some central application service provider, versus
> the "Device-to-Gateway" model (2.3) where there is a local hub in the home.

As email has demonstrated over many years, these are choices in 
operational configuration, but need not be choices in protocol.

That said, one might argue that SUBMIT vs. SMTP demonstrate email's 
moving toward a similar distinction, but I'm inclined to say it doesn't. 
  For the current discussion, the issue is equivalent to asking where 
the SUBMIT server is.  And the technical answer is: anywhere, and run by 
anyone.

I do not see a technical or operational reason for IoT to impose a 
different range of choices.

The business issues are an entirely separate matter, but for now the 
result is both a loss of choice in privacy /and/ vendor lock-in.

d/

---

From: "Olle E. Johansson" <[email-masked]>
Date: Fri, 12 Feb 2016 17:24:21 +0100

> On 12 Feb 2016, at 17:14, Dan York <[email-masked]> wrote:
> 
> Dave,
> 
>> On Feb 12, 2016, at 9:32 AM, Dave Crocker <[email-masked] <mailto:[email-masked]>> wrote:
>> 
> On this point, I think RFC 7452 ( https://tools.ietf.org/html/rfc7452 <https://tools.ietf.org/html/rfc7452> ) did a nice job with spelling out the different "communication patterns" seen in IoT deployments.
> 
There is a technichal issue that also drives vendors to the cloud. As long as we have NAT, we won’t be able to reach the stuff in the home with apps on a mobile device. We need to come up with some sort of standardized “back to my mac” like platform that works both over IPv4 and IPv6 with a security architecture that is trustworthy.

> This *is* the ideal I think we want to shoot for, BUT… 
+1

But as stated below, this will not happen without significant market pressure. I work a bit
in the health care area and every vendor is building their own systems, which will drive
public spending up through the roof at the same time as it causes severe issues with
regards to privacy laws - data flowing in uncontrolled ways, ending up on clouds anywhere
on the planet provided by more or less unknown vendors. Hopefully the public sector
can control their spending and force some change in this area.
> ... I think you're right on target here.  I think with IoT consumer devices we're still in the early deployment stages where the vendors are trying to capture the ecosystem and obtain de facto stan…
Oh yes, as long as there’s money in the big data and selling user’s privacy that will happen.

I think we need a showcase of an architecture that works to show vendors that don’t want to
play that game and as a proof if vendors claim it doesn’t work without their wonderful
superfantastic cloud service connected to Google, Facebook et al. Customers/users need
good examples and today there are not that many out there.

My 2 öre :-)
/O
> [email-masked] <mailto:[email-masked]>   +1-802-735-1624
> Jabber: [email-masked] <mailto:[email-masked]> 
> Skype: danyork   http://twitter.com/danyork <http://twitter.com/danyork>
> 
> http://www.internetsociety.org/ <http://www.internetsociety.org/>
> 
> 
>

---

From: Robin Wilton <[email-masked]>
Date: Fri, 12 Feb 2016 16:29:01 +0000

Thanks all - really interesting discussion on these points. I’m going to kind of apologise for top-posting, but really wanted to draw out 3 themes which I think stand out from several of the preceding threads… so there wasn’t really a good “in-line” way to do this.

I don’t think my thoughts here are original by the way, I’m just trying to recap the good ideas of others (I’m not proud…)

1 - this isn’t a tech-only or standardisation-only problem: whatever we try and do through IETF will be in the context of the massive economic forces that (currently) favour a model based on cloud, aggregation, and monetization of personal data.

2 - there’s a tech element in that "walled garden” IoT implementations make it much harder for users to see/control what devices are doing “on their behalf”, whereas open source/open standard implementations are more likely to make that possible. Again, the economic factors in (1) currently act in favour of walled gardens.

3 - technically, whatever system component gives effect to users’ wishes and preferences can reside in the home, at the service provider, or somewhere else. Commercially, the question is whether there’s any incentive at all for IoT vendors to include such a component… let alone whether (as per (2) ) they do so on the basis of open interfaces.

I hope this helps tease out some of the issues. I think this is another classic example where it would take the co-operative action of multiple stakeholders in order for users to get a better deal...

Yrs.,
Robin

Robin Wilton
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 12 Feb 2016, at 14:32, Dave Crocker <[email-masked]> wrote:

> Well, you are more optimistic than I.  Absent involvement of folk with subject matter expertise, the likelihood of getting the design right is zero, IMO...  That is, 'certainly' rather than 'probably'...
> 
> d/
>

---

From: Dave Crocker <[email-masked]>
Date: Fri, 12 Feb 2016 08:48:35 -0800

On 2/12/2016 8:24 AM, Olle E. Johansson wrote:
>> On 12 Feb 2016, at 17:14, Dan York <[email-masked]
>> <mailto:[email-masked]>> wrote:
>>> I do not know of any reason the model for IoT needs to be different
>>> from email.  That is, yes, servers are needed.  They might reside
>>> with end-users, but they do not have to.
...
>> You're right, Dave, that this is quite similar to email... people
>> *could* operate their own home email servers, or they could just use
>> some big cloud-based vendor (<insert favorite name here>).
> There is a technichal issue that also drives vendors to the cloud. As
> long as we have NAT, we won’t be able to reach the stuff in the home
> with apps on a mobile device. We need to come up with some sort of
> standardized “back to my mac” like platform that works both over IPv4
> and IPv6 with a security architecture that is trustworthy.

There are a number of separate issues:

1. For rendez-vous, such as the user being mobile and wanting to contact 
or monitor their IoT environment, there has to be some way for the user 
to 'find' the IoT environment from over the public Internet.  (A 
rendez-vous function is independent of any storage-and-analysis function.)

2. Other than users accessing their IoT environment from the Internet, 
what services are /required/ for IoT operation and involving a server -- 
on the public Internet or on the user's network?  What dictates using 
the public Internet?

3. From what I'm seeing, nothing technical requires the public server to 
be owned or operated by the IoT equipment vendor.  Nothing technical 
restricts the server from being a public, commodity opportunity.

Note that these issues are not restricted to  -- or new to -- IoT and 
that while rendez-vous does require some sort of public server (given 
address translation barriers at the user's network) it does not require 
the server on the Internet to be owned or operator by the IoT equipment 
vendor.

> can control their spending and force some change in this area.

Vendor lock-in has problems that are worse than just cost.  It 
significantly increases the likelihood of systemic vulnerabilities, 
since lack of transparency in the design, development, testing and 
operation of the services means far less, and far less varied, review. 
For an environment subject to the degree of information accountability 
that the health industry has, I'd expect this to be a very serious 
problem, indeed.

A coalition of consuming groups with similar concerns might be enough to 
press for open protocols and a free market for public servers and services.

>>> I think the real issue here is that the vendors have a strong
>>> incentive to /retain/ their data acquisition role.  So they won't
>>> give it up unless and until there is a strong consumer-driven
>>> pressure for it.
>>
>> ... I think you're right on target here.  I think with IoT consumer
>> devices we're still in the early deployment stages where the vendors
>> are trying to capture the ecosystem and obtain de facto standards
>> purely by market success.

It is worth remembering that commercial networking used to be entirely 
proprietary.

The move towards open standards and public networks was not a vendor 
initiative.  It came about only because of consumer and enterprise demand.

> I think we need a showcase of an architecture that works to show
> vendors that don’t want to play that game and as a proof if vendors
> claim it doesn’t work without their wonderful superfantastic cloud
> service connected to Google, Facebook et al. Customers/users need

The challenge is that open efforts tend to move slower and produce less 
functionality.  That doesn't make them very appealing as an alternative. 
So they need to provide some other benefit that is very strongly appealing.

While, yes, R&D and proof-of-concept can be useful here, I think the 
deeper challenge is to find and exploit consumer leverage.

In the case of networking, the need to have an environment in which a 
consumer/enterprise network permitted interoperability among products 
from different vendors, and interoperability across administrative 
domains, is what produced the market pressures.

d/

---

From: "Olle E. Johansson" <[email-masked]>
Date: Fri, 12 Feb 2016 17:57:41 +0100

> On 12 Feb 2016, at 17:48, Dave Crocker <[email-masked]> wrote:
> 
> 
> 
> 1. For rendez-vous, such as the user being mobile and wanting to contact or monitor their IoT environment, there has to be some way for the user to 'find' the IoT environment from over the public Internet.  (A rendez-vous function is independent of any storage-and-analysis function.)
> 
> 2. Other than users accessing their IoT environment from the Internet, what services are /required/ for IoT operation and involving a server -- on the public Internet or on the user's network?  What dictates using the public Internet?
> 
> 3. From what I'm seeing, nothing technical requires the public server to be owned or operated by the IoT equipment vendor.  Nothing technical restricts the server from being a public, commodity opportunity.
> 
> Note that these issues are not restricted to  -- or new to -- IoT and that while rendez-vous does require some sort of public server (given address translation barriers at the user's network) it does not require the server on the Internet to be owned or operator by the IoT equipment vendor.
Right. Techies like us understand that - but the average user?
> Vendor lock-in has problems that are worse than just cost.  It significantly increases the likelihood of systemic vulnerabilities, since lack of transparency in the design, development, testing and operation of the services means far less, and far less varied, review. For an environment subject to the degree of information accountability that the health industry has, I'd expect this to be a very serious problem, indeed.
> 
> A coalition of consuming groups with similar concerns might be enough to press for open protocols and a free market for public servers and services.
Mmm.
> It is worth remembering that commercial networking used to be entirely proprietary.
+1
> 
> The move towards open standards and public networks was not a vendor initiative.  It came about only because of consumer and enterprise demand.
> 
> 
> The challenge is that open efforts tend to move slower and produce less functionality.  That doesn't make them very appealing as an alternative. So they need to provide some other benefit that is very strongly appealing.
> 
> While, yes, R&D and proof-of-concept can be useful here, I think the deeper challenge is to find and exploit consumer leverage.
> 
> In the case of networking, the need to have an environment in which a consumer/enterprise network permitted interoperability among products from different vendors, and interoperability across administrative domains, is what produced the market pressures.

There is interesting stuff happening in the Open Source area. We need to invite them to the IETF and play around so that they understand there’s a need for Open Protocol development here as well. I’ve played a lot with a platform called Domoticz on a Raspberry Pi -it has a lot of tools to connect with just about anything - push services, other protocols (via MQTT) and a lot of bits and pieces that interconnects various radios and equipment. There are many platforms like this out there and they do miss the accessability outside of the NAT in an easy to use and stable way.

My wife asks me why she can’t check the temperature of the fridge from her office. I can try to go down a lot of hacks to enable that, but feel I miss a more standardized generic way of solving the problem.

What’s also missing in these platforms is security. Maybe one should try to analyze what pieces are missing and what can be provided from the IETF smörgåsbord.

Food for thought.

/O

---

From: [email-masked]
Date: Sat, 13 Feb 2016 21:13:47 -0500

> The Thing System seems to be more about adapting itself to stupid
> devices, rather than creating better (more secure, more private)
> standards for devices to adhere to.

In the IoT must we re-enable Postel's Law?

--dan