No need for backdoors when the front door is perfectly legal. The need to monitor for bad actors is still correct, though; mostly because they skimp on development costs and penetration testing. Like they say, “never attribute to malice that which is adequately explained by incompetence.” Or in this case, slashing budgets.
I hate Hanlon’s Razor with a passion. It’s just a way to introduce plausible deniability for cases that do involve malice. Not that this stuff necessarily is malicious, I just think it’s dumb to rule out maliciousness any time it could be incompetence.
If I were to rewrite Hanlon’s Razor today, I would update it as so: “Never attribute to malice that which is adequately explained by incompetence or indifference.” Because yes, it does introduce plausible deniability; but most of the most harmful things in our modern world aren’t malice, but simply big companies caring less about you than about their own precious profits, or politicians caring less about their constituents than about their kickbacks and campaigns.
But admittedly, the word “adequately” does do a lot of heavy lifting in the original and in my update, because I’d counter your (quite reasonable) objection with the corollary that if malice is evident, incompetence is no longer an adequate explanation.
In general, though, I’ve had simply too much experience in this world to believe that there’s a grand conspiratorial plan behind anything awful people do these days.
Good comment, I can agree with it. Though to address your last paragraph, I wasn’t trying to say that it’s usually maliciousness or best to assume it, I just don’t think it should be summarily dismissed.
I’d also say that there’s not much functional difference between a pattern of malice, incompetence, or indifference.
Totally true. Though you might address the various patterns differently (malice = legal action, incompetence = mandated education, indifference = financial penalty), the results of the patterns are often the same.
What would the “front door” even be in this case? What comes to my mind is the corresponding app on your phone, but that doesn’t really make sense in this context.
In this case, the “front door” would just be not hiding it. Normal, un-hidden APIs. A back door is usually something that the developer includes without informing the user, but they don’t need to be surreptitious; there’s no legal reason to pretend that they’re not collecting the data, and unless you’ve built your brand on privacy and security, there’s no business reason to do so either in the current cultural climate.
And given that the appliance needs to communicate with the app on your phone while you’re not home in the first place, there probably isn’t even a separate tracking API vs. data just being harvested as part of normal operations. So “back door” doesn’t really fit. “Broken by design” or “spyware” would be more apt, I think.
Still, I’m really not a fan of calling any spying/data harvesting a “front door” – IIRC, the term was coined by an FBI head pushing for back doors in our phones so the FBI could scan our messages. But he called it a “front door” as a way to dodge the reasons why building back doors in our security software is a terrible idea.
It’s just another step in the terrible trend of “let’s pretend that this horrible idea is ok if we just rename it” :(
No need for backdoors when the front door is perfectly legal. The need to monitor for bad actors is still correct, though; mostly because they skimp on development costs and penetration testing. Like they say, “never attribute to malice that which is adequately explained by incompetence.” Or in this case, slashing budgets.
I hate Hanlon’s Razor with a passion. It’s just a way to introduce plausible deniability for cases that do involve malice. Not that this stuff necessarily is malicious, I just think it’s dumb to rule out maliciousness any time it could be incompetence.
If I were to rewrite Hanlon’s Razor today, I would update it as so: “Never attribute to malice that which is adequately explained by incompetence or indifference.” Because yes, it does introduce plausible deniability; but most of the most harmful things in our modern world aren’t malice, but simply big companies caring less about you than about their own precious profits, or politicians caring less about their constituents than about their kickbacks and campaigns.
But admittedly, the word “adequately” does do a lot of heavy lifting in the original and in my update, because I’d counter your (quite reasonable) objection with the corollary that if malice is evident, incompetence is no longer an adequate explanation.
In general, though, I’ve had simply too much experience in this world to believe that there’s a grand conspiratorial plan behind anything awful people do these days.
Good comment, I can agree with it. Though to address your last paragraph, I wasn’t trying to say that it’s usually maliciousness or best to assume it, I just don’t think it should be summarily dismissed.
I’d also say that there’s not much functional difference between a pattern of malice, incompetence, or indifference.
Totally true. Though you might address the various patterns differently (malice = legal action, incompetence = mandated education, indifference = financial penalty), the results of the patterns are often the same.
Right, it’s just a front door lol. I never considered that was a thing.
What would the “front door” even be in this case? What comes to my mind is the corresponding app on your phone, but that doesn’t really make sense in this context.
In this case, the “front door” would just be not hiding it. Normal, un-hidden APIs. A back door is usually something that the developer includes without informing the user, but they don’t need to be surreptitious; there’s no legal reason to pretend that they’re not collecting the data, and unless you’ve built your brand on privacy and security, there’s no business reason to do so either in the current cultural climate.
And given that the appliance needs to communicate with the app on your phone while you’re not home in the first place, there probably isn’t even a separate tracking API vs. data just being harvested as part of normal operations. So “back door” doesn’t really fit. “Broken by design” or “spyware” would be more apt, I think.
Still, I’m really not a fan of calling any spying/data harvesting a “front door” – IIRC, the term was coined by an FBI head pushing for back doors in our phones so the FBI could scan our messages. But he called it a “front door” as a way to dodge the reasons why building back doors in our security software is a terrible idea.
It’s just another step in the terrible trend of “let’s pretend that this horrible idea is ok if we just rename it” :(