Counter argument to patching embedded devices

[Duckpaddle]

https://embeddedcomputing.com/technology/security/why-security-patching-does-not-fit-iot-devices

Statistical argument to Steve's "make everything with a cpu OTA update capable."

 

[PHolder]

That sounds like so much baffle-gaff. You should not be designing a system, even an embedded one, so close to the minimal specs that a small change like new firmware will alter system capabilities in a measurable way. If you're counting pennies that closely, then you need to consider whether your system should be put on the market at all. Spending an extra, say $5-10, to double the flash storage so you can have a backup system image and also to increase the system CPU so it can handle a little variability in memory access speeds is just spending some money for good future proofing for the life of your system.

 

[hyperbole]

That sounds like so much baffle-gaff

While I agree with your entire answer, I totally love the term "baffle-gaff".

 

[PHolder]

I totally love the term "baffle-gaff".

Turns out I used a mondegreen and I think the correct word is the equally fun bafflegab. I think either one is a good word/phrase for the intended purpose though

 

[Duckpaddle]

I recently attended a conference where I met an engineer that had a bad experience with 2FA. Apparently, during a Hurricane the 2FA system failed and the technicians couldn't access a critical system. So, there are use cases where a little weaker security is appropriate.

 

[miquelfire]

Question, was it the type of 2FA that required access to a 3rd party system (something that wasn't self-contained to the system)? Or was it something that wasn't talked about?

 

[Duckpaddle]

Question, was it the type of 2FA that required access to a 3rd party system (something that wasn't self-contained to the system)? Or was it something that wasn't talked about?

The type of 2FA wasn't disclosed, yet from his statement it required coms with a remote server.

 

[miquelfire]

Any time it requires comms with a remote server, that's 3rd party in my eyes. I hate that style because if I'm on my tablet, and I'm nowhere near my phone, I might need to get up, and maybe walk to the other end of my house to react to the prompt on my phone to log into a site. TOTP is often the best MFA for me, and my YubiKey if I'm on a computer, as I won't need to unlock my phone to access TOTP or whatever app I had to install.