• 0 Posts
  • 90 Comments
Joined 3 years ago
cake
Cake day: June 12th, 2023

help-circle


  • I don’t work directly with PLCs but we do have them at my work. The main thing that makes these different from any other devices is that they typically control physical machines. Which means there is a real danger that them becoming compromised could lead to damaged equipment or even death.

    Additionally, many PLCs use older OS versions like xp because their software is notoriously out of date (if it’s working why rewrite it when that could introduce safety concerns)

    This “urgent” message from CISA does not prove that any of these devices are internet accessible just that if they are then they should be removed. If CISA wanted to require this then they would have released a binding operational directive (BOD) or an emergency directive (ED). Both of which are publicly viewable on their site.





  • I’m sorry I am really not seeing what you are referencing from your link. This appears to be a link to the state administration manual which deals with how departments in the state of California operate.

    This does not appear to be a law especially when you look at the procedure for revising the SAM.

    Responsibility for updating SAM content is assigned to authoring state departments

    Ie. Not assembly members.

    Edit: sorry I didn’t respond to your second point. From the Cali law:

    1798.503(b) An operating system provider or a covered application store that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age range or any conduct by a developer that receives a signal indicating a user’s age range.


  • exasperated sigh I don’t want to get too deep in it with people again. Here is a link to the California law and some clarifications. (I cannot speak for the Brazilian law as I am not from Brazil)

    https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043

    • The law does not require ID verifications it only required that a parent indicate the age of their child when setting up their account.
    • The law’s definition for operating system provider includes “general purpose computing device” so no, your toaster, microwave, and fridge are not included. (please remember that legal definitions do not always match how we would use the term in everyday conversation)
    • An “accessible interface” is not well defined here. But it could be as simple as a system call rather than a REST API call. Similar to open file or malloc. (this means no centralized government server storing the data)

    I have said this in other posts, but the linux community sticking their heads in the sand and pretending these states don’t exist just leave MS, Google, and Apple to decide how this is implemented. I am glad some distro maintainers are taking this seriously and looking at what is the minimum they would need to implement to comply with the law.

    To be clear I do not support this law. The definitions are written so loosely that it leaves much of it up to interpretation. It is clear that they did not meet with anyone in the industry before voting.



  • Just want to clarify something about your comment since it feels like you have not had a chance to read the law yet.

    (this is in reference to the Cali law but I am told the Colorado one is basically identical). The Cali law does not, in any way, require ID verification, it only requires that a parent attest to the age of their child when setting up an account for them.

    This is not my argument for this exact law or any of these laws. I just want to make sure we all understand what we are talking about before going for the pitchforks.