Consumer Reports Proposes Open Source Security Standard To Keep The Internet Of Things From Sucking

from the Russians-hacked-my-toaster.-Again. dept

Thanks to a laundry list of lazy companies, everything from your Barbie doll to your tea kettle is now hackable. Worse, these devices are now being quickly incorporated into some of the largest botnets ever built, resulting in some of the most devastating DDoS attacks the internet has ever seen. In short: thanks to "internet of things" companies that prioritized profits over consumer privacy and the safety of the internet, we're now facing a security and privacy dumpster fire that many experts believe will, sooner or later, result in mass human fatalities.

Hoping to, you know, help prevent that, the folks at Consumer Reports this week unveiled a new open source digital consumer-protection standard that safeguards consumers’ security and privacy in the internet-of-broken things era. According to the non-profit's explanation of the new standard, it's working with privacy software firm Disconnect, non-profit privacy research firm Ranking Digital Rights (RDR), and nonprofit software security-testing organization Cyber Independent Testing Lab (CITL) on the new effort, which it acknowledges is early and requires public and expert assistance.

As it stands, most of the proposals are common sense and take aim at most of the common issues in the IOT space. For example, encouraging companies to spend a few minutes engaged in "penetration testing" of their products before shipping (a novel idea!). The standard also hopes to ensure companies notify consumers of what's being collected and who it's being shared with, and that devices aren't using default login credentials. But Consumer Reports also notes that it hopes to develop these standards with an eye on more broadly incorporating them into product reviews:

"The standard should be easy enough for consumers without a technical background to understand, yet sophisticated enough to guide testing organizations such as Consumer Reports as we develop precise testing protocols. We want to rate products on measures such as security, in much the same the way we currently assess products for physical safety and performance."

This isn't the first effort of this type. Both the Department of Homeland Security and the FCC have started pushing for some voluntary sort of consistent standards. Of course the problem is that these standards are voluntary, meaning that the kind of companies that cut corners in the first place to sell unsecured products, aren't likely to give much of a damn. It's why folks like Bruce Schneier have advocated for stronger regulations. But with government agencies already walking back even existing consumer privacy protections under Trump, that doesn't seem likely anytime soon. And even if they were open to it, does anyone actually think that federal bureaucrats would come up with reasonable, workable standards that didn't do more harm than good? Having prominent reviewers, such as Consumer Reports take this on through an open standard and reviews seems like a pretty good way of shaming companies into better behavior.

Consumer Reports is quick to acknowledge this is just the beginning of what they hope evolves into a more comprehensive standard:

"The standard as it’s now written is a first draft. We hope that everyone from engineers to industry groups to concerned parents will get involved in shaping future versions of it. We’ve placed the standards on GitHub, a website that’s widely used by software developers to share ideas and work on group projects. Because GitHub can be hard for newcomers to navigate, we’ve also built a website that has the same information."

Folks that are curious or want to lend their assistance can check out the full standard here.

Filed Under: iot, open source, security, standard
Companies: consumer reports

DailyDirt: Meet Your Meat, And Cook It Thoroughly

from the urls-we-dig-up dept

Penicillin and its derivatives haven't actually been around for that long in the scheme of things, but antibiotics have enabled an incredible age of prosperity without people having to worry about common infections killing us off. Unfortunately, nature has a way of evolving and adapting to our not-so-clever use of antibiotics, and we've been breeding superbugs in our hospitals and in our industrialized food chain. Sketchy meats have been around for a long time, but hopefully, it won't take a public health nightmare to get folks to take a closer look at food safety.

• The overuse of antibiotics in the meat industry could be creating superbugs in our food chain -- and a surprising amount of these resistant microbes are already in commercial foods. Consumer Reports looked at a variety of meat samples and found over 80% of the turkey meat it tested contained superbugs. Ugh. Cook your Turkeys thoroughly next Thanksgiving.... [url]
• The 1993 E. coli outbreak from hamburger meat killed at least four kids and poisoned hundreds of people. That outbreak was followed years later by other infectious contamination in produce, cheese and cookie dough... and the food safety system still isn't perfect. Salmonella in chicken is another potential problem, and the food industry is responding -- though perhaps a bit slower than some would like. [url]
• Bacteriophages as biocontrol agents in foods were approved by the FDA in 2006, but it's not approved for infant formula. Bacteriophages -- viruses that specifically attack bacteria -- are abundant everywhere, so they're presumably safe and environmentally friendly -- and could prevent babies from getting terrible illnesses. These phages could be an important tool to combat food-borne microbes, but we may still want to be careful not to over-use them or over-engineer them to the point that they might attack microbes indiscriminately. [url]

After you've finished checking out those links, check out this holiday gift guide for some awesome deals at the Techdirt deals store.

Filed Under: bacteriophages, e coli, fda, food, food safety, hamburger, meat, microbes, outbreak, penicillin, salmonella, superbugs, turkey
Companies: consumer reports

DailyDirt: I Scream, You Scream... At These Ice Creams?

from the urls-we-dig-up dept

Who doesn't like ice cream on a hot day? Kids and adults alike enjoy ice cream, and ice cream products have gotten some technological improvements over the years through food science. Ice creams that don't melt as fast. Ice creams that have fewer calories but still taste rich and creamy. Check out a few of these ice cream novelties before summer is over.

• Researchers have identified a protein called BsIA that can make a slower-melting ice cream. This is a naturally-occurring protein that's already in the food chain, so it will avoid regulation (and might even be "organic"). Still, the resulting ice cream might be a bit disconcerting. [url]
• Walmart's Great Value brand ice cream sandwiches received some attention for not melting when left out in the summer heat. Walmart says no one should be concerned, and that melting rates for ice cream vary with certain ingredients, such as cream content. Food scientists point out that stabilizers such as guar gum can greatly affect how ice cream melts, and different brands were tested by Consumer Reports to show how different ice cream sandwiches melted. [url]
• An ice cream called Xamaleon changes colors when you lick it. This isn't Willy Wonka magic, but eating food coloring that changes when it touches your tongue doesn't seem normal (yet). [url]
• How about some glow-in-the-dark ice cream made from protein normally associated with jellyfish? There's also a glow-in-the-dark sorbet version made without jellyfish proteins... for the vegans who don't want to miss out. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Filed Under: bsia, desserts, food, glow in the dark, gmo, ice cream, protein, sorbet, vegan, xamaleon
Companies: consumer reports, walmart

Apple Deletes Thread About Consumer Reports Not Recommending An iPhone [Updated]

from the we-were-always-at-war-with-eurasia dept

Apple, of course, became a household name with its infamous 1984 commercial, about how Apple equipment would make sure that "1984" wasn't like 1984. However, now that it's 2010, apparently it's fine. As you may have heard, Consumer Reports yesterday posted that it could not recommend the iPhone 4 due to the widely discussed antenna problems. Apparently that was double-plus-ungood to the folks at Apple.

Ragaboo alerts us to the news that Apple has deleted a thread discussing this at the Apple support forums. And when they delete it, they mean it. People created a new thread, and it got deleted again. And again. And again and again. At least six such threads have been deleted, according to that TUAW article. Of course, all this is doing is drawing more attention to the issue and the fact that Apple is trying to deny it exists. Oh, and we were always at war with Eurasia.

Update: Apparently some of the threads have now come back... and people are suggesting that it may have been a glitch with Apple's forums, rather than anything malicious... We haven't yet seen a full explanation, but perhaps that's the case.

Filed Under: iphone, support
Companies: apple, consumer reports

Cash4Gold Drops Lawsuit Against Consumerist... Still Suing Whistleblowers

from the dear-streisand... dept

It looks like the folks over at Cash4Gold have finally realized that it wasn't a particularly smart move to sue Consumerist for reporting on various allegations made against Cash4Gold. The company has dropped that part of the lawsuit, though it continues to sue the ex-employees it accuses of both defamation and "publishing any more confidential, proprietary information" (and, note, they don't say which info was defamatory or which was confidential and proprietary). Consumerist makes it very clear that this wasn't a settlement. They didn't ask to be dropped from the case or agree to anything. One would guess that somewhere down the line a lawyer explained to Cash4Gold that its likelihood of winning such a case was about as close to zero as you could imagine...

Filed Under: defamation, whistleblower
Companies: cash4gold, consumer reports, consumerist

Cash4Gold Sues Consumerist, Complaints Board Over Reports On Cash4Gold Practices

from the how-much-for-that-gold-Streisand-Effect? dept

Earlier this year, we wrote how odd it was that the company Cash4Gold (made famous by its cheesy late night commercials) was threatening to sue bloggers for defamation for merely repeating and linking to a Consumerist article that quoted a former Cash4Gold employee about allegedly underhanded tactics used by the company. The defamation threat was odd for a variety of reasons. First, Cash4Gold itself was talking about these same allegations on its own website (which is actually the best way to deal with them: respond to them, rather than trying to silence them). Second, going the legal route only guaranteed much more attention to the issue and questions surrounding Cash4Gold's activities. Third, it made little sense to threaten someone who was merely summarizing what others were saying.

While Cash4Gold apparently backed off such threats, it did go forward and get an injunction against the former employee to stop her from "publishing any more confidential, proprietary information, and any defamatory information on the internet." I like how it mixes in confidential, proprietary and defamatory information -- so now we don't know which the original reports were. Were they defamatory lies? Or were they just confidential, proprietary information?

Either way, with that injunction, the company contacted Complaints Board -- the site where the employee originally put forth the allegations -- and Consumerist, who also posted on the allegations, and demanded they remove the posts. Of course, with no legal order, both sites refused to do so. In response, Cash4Gold has now sued both sites, once again guaranteeing that much more media attention is paid to alleged claims of underhanded business practices by the company.

Of course, rather than backing down, Consumerist is fighting this and has posted a lengthy and detailed article reviewing the original claims, backing many of them up with additional reporting details and pointing out that this is an ongoing news story that it believes it has every right to write about. Once again, though, we're left wondering why Cash4Gold would do this. All it's doing is drawing that much more attention to the claims against it.

The Citizen Media Law Project post above details two additional factoids about how Cash4Gold's lawyers are trying to get around the rather obvious (it seems) Section 230 safe harbors that almost certainly protect Complaint Board. First, they claim that because Complaint Board edited the title of the post, they're no longer just a service provider, but "created, developed and published." That seems like a long shot. Perhaps more likely to succeed is a reference to the recent Barnes ruling, where Section 230 was tossed out the window after the company promised to delete the content in question (and then didn't). Of course, it's not clear if Complaint Board did, in fact, promise that, but Cash4Gold claims that it did.

Filed Under: defamation, whistleblower
Companies: cash4gold, complaints board, consumer reports, consumerist