Dan Kaminsky

@dakami @octal Leaving aside consumers, this vastly sways the corporate response to updates, which could be worse.

@munin @octal well I mean MS jumped on this pretty fast

@dakami @munin I think it's time to congratulate the people at Microsoft again who made the ~2001 180 on security as a core corporate value.

@octal @munin 2001 was the memo. 2003 was when the world came to an end.

@dakami @munin I'd be surprised if another company that size could make that big a shift in only a few years.

@dakami deep down inside we both know that there has never been a security part to any automatic update system. It was misplaced trust.

@KirilsSolovjovs that's crazy. Closing the window on exploits has been hugely security positive. Ms08-067 died.

@dakami Oh. I cannot possibly disagree with that. Still I think any human-operated machine should not auto-update without user's consent.

@KirilsSolovjovs user's consent shouldn't be demanded each time

@dakami if not required, you’ve got yourself a backdoor to an army of machines (a botnet).

@dakami It reminds me of a more dangerous version of the satellite dish update/disabling hack. Signal thieves did it to themselves

@arclight different. Everybody in that context *knew* they were stealing service.

@dakami That's what I mean. Who knows which lots of which devices have counterfeit FTDI chips? Tainted supply chain could hit anyone

@dakami What can we do to manage #FTDIGate?

@dakami there needed to be a precedent set sooner or later, so people will be more careful with allowing updates