The Internet of Things Isn't Just About Bad Security

The problem isn't just that the software has gaping security holes, it's that software driven everything appears to be a recipe for disaster.

EE Times reports this week that Consumers are feeling the peril of all the connectivity.  There's a "smart thermostat" for air conditioners called the Nest (which I mentioned here).  It offers convenience features such as the ability to set the temperature from elsewhere.  Your first thought is probably a widespread hacking, but in this case, that isn't the "uh oh".

Earlier this month, Nest’s smart thermostat reportedly stopped working, leaving many users frustrated and their homes freezing cold.

Users took their problem to social media, blaming a mysterious software bug that drained Nest’s battery, and complaining that the thermostat can’t connect to the Internet.

Later, company officials explained that during a December software update which was pushed onto the customers' thermostats, they introduced a bug that didn't show up until January.

Richard Doherty, research director of Envisioneering Group, called the Nest fiasco “the worst possible consumer experience imaginable.” All the more egregious is that most of the time “customers do NOT know of the update; or even the purpose of the ‘fix’ it was supposed to deliver,” he added.

You're not the only people getting concerned about this.  Apparently, that concern is getting pretty widespread.

Take a look at the 2016 Accenture Digital Consumer Survey in which 28,000 consumers in 28 countries were polled on their use of consumer technology.  One result that jumps out is that consumers’ “security and privacy” concerns over IoT devices are much more prominent, compared to 12 months ago, John Curran, managing director of Accenture, told us. 
...
An even bigger surprise is how many consumers said they are going out of their way “to quit or terminate an IoT device or services until they are assured of safety,” explained Curran. “It’s not a majority, but close to 20 percent of people told us that. It’s a big number.”
...
Curran said, “the most sobering view of where we are today is captured by a sharp drop of the purchase intent of smartphones among Chinese respondents.” Globally, the purchase intent for smartphones is declining. Only 48% of consumers plan to buy a smartphone in the next 12 months. The drop is sharpest in China, down from 82 percent last year to 61 percent this year.

I think this maturation of the IoT market is like the quote from the CEO of Big Ass Fans I used back on January 7th:

 "[The connected home] [or in this case IoT - SiG] is in the very early stages," Smith says, "and when people ask why hasn't this caught on, well, what the hell is there to catch on? There's nothing there. I mean, taking something off of the wall and putting it on your telephone...it's a conceit to imagine that that's anything interesting or important. You aren't doing jack is what it comes down to." 

A running joke in the electronics hardware business is that software is going to cause the end of the world.  The way the software business is run is so fundamentally different from the way that hardware works that most of us are perpetually astounded.  Can you imagine buying a car where many features just don't work right, and the companies have you return to the dealer to install new hardware?  I suspect that would raise a pretty loud howl from their owners.  How is that different from a software patch to fix something that doesn't work properly?  Now imagine you don't take the car to the dealer, but someone comes to your car in the middle of the night, installs the new hardware, and the car won't work the next morning.  That's what Nest did. 

In the aviation business, commercial or military, software is deadly serious and the emphasis on the way software is created is unlike anything you'll find in a place like Nest.  In the commercial world I just came from, the industry specifications essentially require that every single line of code can be shown to come from a system level requirement; that every single line of code be inspected, tested and verified to work as intended.  The verification has to be done by someone independent from the software engineers.  That reduces, but doesn't eliminate, the chance the system won't work as intended.  The military and commercial aviation markets are so tough on software that the old cliche' of "fix it in software" has turned into "fix it in hardware".  The equivalent rigor for hardware is mostly aimed at complex digital components, such as FPGAs, ASICs, CPLDs and other hardware that's largely created by writing software.
 
Software issues have killed people already.  The Nest probably didn't kill anyone, but may have allowed some pipes to freeze and flooded some houses.

(found here, but the image is from Cisco, whose version is much more involved and interesting)