After this Google memo broke over the weekend, I wanted nothing more than to ignore it. It’s another wearying example of how white men can move throughout the world completely oblivious to anyone’s feelings but their own. But I am a host on This Week in Google and so had to prepare some thoughts.

Rest assured, this is not a so-called “hot-take”. This is an extremely considered take that I’ve developed over the last decade having heard this type of stereotypical thinking (and obliviousness to it) in person, and even from my search history.

I am not going to engage in nonsense, so I’m not taking apart the memo. You can find that here and here. All I want to say is this.

If you don’t see that white men have an advantage over women, people of color and basically everyone, I can’t make you. The repeated exposure of men behaving badly in tech, in media, in manufacturing and in myriad other examples isn’t going to change your mind.

This feeling that you are persecuted for being a white male is exactly like that of a child claiming that the world isn’t fair. The world has revolved around their needs so long, that as parents begin to set limits they rebel and claim “that’s not fair” as a reflex. And you know what, that’s fine.

That’s how we grow. We reflexively cry out against things that make us unhappy or inconvenience us. And it is upsetting and inconvenient to have to adjust to a world where you can’t coast on layers of institutional advantage, or when people call you out all the time for behaving in ways that you have behaved your whole life.

But as children mature their reflexive cries of unfairness should become reflective. They will be able to look at a situation and realize that what looks like a parent favoring a younger sibling by giving them the last cookie is actually fair, because the eldest already had ice cream. They will start to evaluate the world outside the prism of their own needs.

This is part of developing empathy. And empathy is something everyone should develop. Women don’t have a lock on it. Empathy is a valuable trait because it turns those reflexive cries of frustration into something that can help people mature and improve the world around them.

And for all of the men being held responsible for their actions, their immature ideas and their unexamined insistence that their feelings matter more than anyone else’s, it’s time to reflect.

In short, for those who are frustrated with life as a white man and feel like it’s not fair that they have to now think about the effects of their actions on others and others’ experiences, I have one thing to say. Grow up.

I spent a lot of time this week talking about personal assistants thanks to Google finally announcing its operating system for the internet of things (dubbed Android Things) and taking its Weave communications protocol out of developer preview. The news was big, but that same day Microsoft said it would release a software development kit so developers could use its personal assistant platform called Cortana.

To add to this news glut, Amazon is laying out a plan to let developers bring their data to AWS where the e-commerce giant will offer custom or tunable artificial intelligence algorithms. So it’s clear that the big brains in the tech industry see a voice interface, artificial intelligence and a developer ecosystem as the necessary tools for the next era of computing.

That era of computing will be driven by a connected everything, controlled by a natural language interface driven by text or voice, and will require a back-end intelligence that can parse meaning, determine what applications are or services are needed, and then call them up. This is a fairly big shift from the era of a user searching for an app or someone typing in commands on a website.

To make this shift approachable for the rest of us, the industry has latched onto chat bots and this concept of a personal assistant.

What everyone wants to know is, “who will win?” Is Amazon’s ecosystem of developers enough to fend off Google’s astonishing AI in the form of Google Assistant? Where is Microsoft’s hardware strategy? Does it need one? Where is Apple in all of this?

These are great questions, but maybe we are jumping the gun. While I believe that most of our day-to-day decisions in 20 years will be augmented by computers, I question if a personal assistant is the right metaphor for what computing will be. It’s a seductive vision. I love asking asking Alexa what’s on my calendar for the day and getting a response, but it also seems to occlude what is awesome about computing.

For me, computing is about scale. It’s about taking gobs of information and making it accessible in a format that works for the user. And I’m not sure personal assistants always work for the user. I don’t want to have to ask for everything I want.

As an example of computers stepping in with their awesome scale and archive of facts, take spell checking. When you are typing in a text document, very few of us have to ask the spell check feature to run. It automatically will draw your attention to misspelled words with a red underline line. In some formats it may even correct it for you (the dreaded autocorrect).

Having a personal assistant that you ask for information is like running spell check manually. Having good AI that can determine what we need when we need it should move us closer to an autocorrect model. Although, like autocorrect on the phone, the times the computers get information wrong will be exponentially more noticeable and irritating.

So what do we need for the next generation of computing? Less of a personal assistant that we ask questions of and more of an anticipatory model infused throughout our devices and services online. And for that, the current model of having two or three big players who are trying to develop along different platforms and capabilities with different vocabularies to set off various actions is too complicated.

The winner here won’t force users to call for a particular digital butler, whether it’s Siri, Cortana or Alexa. Instead, it should have a natural user interface that allows text, voice and possibly even cues like where a person is in their home or office, to feed them information as it’s needed. It should also have a way to identify users and store information about them, such as their preferences and payment options. When it comes to identity Amazon has a big lead here. So does Apple.

I’m not against personal assistants, I just think it’s too small a metaphor to cover where computing is heading. And I think that if we want to talk about winners and losers, we should understand what metaphor the big players are actually using when they picture the future. We should seek to shape those metaphors with our own imaginations. Because unlike the past, computing is about to become a lot more flexible even as it takes a larger role in our lives.

Let’s try to make it work for us.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

Do we really need a personal assistant? was originally published in IoT For All on Medium, where people are continuing the conversation by highlighting and responding to this story.

The Orange Chef, a smart kitchen startup that managed to get its connected scale into Williams Sonoma stores and score $1.2 million in funding from Google, has finally closed the book on its hardware business. The company, which made an iPad cover and a connected scale called The Prep Pad, has sold its Prep Pad hardware assets to Perfect Co., which also makes a connected scale.

The Orange Chef sold its software and employees to recipe startup Yummly last year. The deal was a good one for The Orange Chef, but it left the consumers who purchased the $150 Prep Pad without a software update, since the Prep Pad hardware wasn’t part of the Yummly deal. The Orange Chef founder Santiago Merea had pledged to keep the software as up to date as possible, but it was a burden for him while trying to hold down his day job at Yummly. The neglect showed in the reviews of the product online.

Merea didn’t want to end up as a cautionary tale for buyers of connected gadgets who saw their expensive purchases become useless if the company sold or failed. So he kept searching for a buyer for the hardware assets.

He found one almost a year later in Michael Wallace, the CEO of Perfect Co. Perfect Co. makes connected scales that work with apps that measure out cocktails, baked goods and smoothies or blended products. Perfect Co. has purchased the hardware IP from The Orange Chef and will update the app powering the Prep Pads that are out in the market. He has pledged to keep it running for the next two to three years.

Wallace bought the Prep Pad assets for the intellectual property, in particular a patent that lets an app connected with a scale interactively record a recipe as the chef is measuring the ingredients. As part of the deal to get the IP he agreed to update the Prep Pad app so it will work with the latest version of iOS. “Santiago felt pretty strongly that we had to keep supporting the users,” said Wallace.

However, he has no idea what that support could cost Perfect Co. He doesn’t know how many Prep Pads were sold and until the app is updated and people use it, he doesn’t know how many people will need support. That, in turn, will dictate things like server and developer costs.

In many ways, the stories of these two connected scale companies are a study in opposites. The Orange Chef was based in San Francisco, had backing from Google and a vision to digitize food tracking and recipes with a tech brand centered around a connected scale.

On the other hand, the Perfect Co. was built in Vancouver, Washington with the funds from a previous enterprise that Wallace had started that had licensed ideas for toys. Perfect Co.’s first sale capitalized on the relationships Wallace had built selling tech toys. It was an order for 50,000 of Perfect Co.’s cocktail creation scales to Brookstone.

It seems unlikely that the Prep Pad sold 50,000 units, ever.

Wallace said that after the Perfect cocktail scale launched in 2013 it began selling well, so they incorporated the business as Perfect Co. in 2014 so it could raise a Series A round of $6 million. Now, as the company prepares to raise its Series B round, it has sold hundreds of thousands of scales designed to work with one of its three apps.

The next phase is taking a bigger step into the health and wellness market with calorie counting (something it already does with its Blend App and a partnership with Vitamix) and using the IP it just purchased. If you haven’t seen one of the Perfect Co.’s $50 to $100 scales yet, it’s highly likely you will in the not-too-distant future.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

Roughly 5.1 million Amazon Echo devices have been sold since the product’s launch in Dec. 2014, according to data from the Consumer Interest Research Group. This startling number for a product that most people couldn’t even describe at launch (I told people it was a cross between Siri and Sonos) has led to an intense focus on personal assistants.

Google Home is now on the market and Google CEO Sundar Pichai credited Amazon with the idea behind a speaker and voice-activated personal assistant for the home. There are also rumors that Apple may try something similar with Siri.

Now the tech media is obsessed with the concept of personal assistants. They will make small decisions easier. They will influence your buying choices. They will invade your car, your office and even hotel rooms.

If this was a fight to be the digital butler of choice then I would bet on Google. In reality, I think the fight today is about something much simpler. It’s about who will control the voice user interface. Voice is the natural interface for connected devices that often have no screen to touch or keyboard to type with.

Voice comes in many flavors. If I’m in my car, I press a button and tell my Tesla to “navigate to,” “call [someone]” or “play [song].” I can also tell it to send a log to Tesla if I press the voice button and say, “bug report.”

When I’m in my kitchen, I tell Alexa to “set a timer,” “play [song]” or any number of thousands of commands as long as I have activated the skill I want to use.

I’m exhausted just typing this, much less trying to figure out what computer I need to tell to turn on my hall lights and how to phrase my request.

I can also talk to my Google Home by saying “Hey Google,” or “Okay Google.” Its vocal commands are similar to the Amazon Echo’s although it doesn’t have the more than 5,000 skills that the Echo ecosystem has. Plus, most of us have a phone capable of taking voice commands that can find information or even (in the case of Siri) control your home.

Currently, I have half a dozen different computers to talk to in my life. Remembering how each one functions and what it can do can be a challenge. When I’m in my car, I have to remember that it’s way more limited than my Echo and speak accordingly.

When I’m in my home, I have to remember that only Google can speak to my Chromecast so I have to use that for TV stuff. Unless I want to see the content on my Kindle tablet, which means I have to talk to Alexa. I’ve linked SmartThings to Google so I need to know what devices I can control with Google as opposed to the dozens of devices that the Echo can control.

I’m exhausted just typing this, much less trying to figure out what computer I need to tell to turn on my hall lights and how to phrase my request. Or which computer I should use to text a friend using voice.

This is why I feel like the battle for personal assistants will happen eventually, but for now, the battle is really about setting the voice interface. Much like Apple helped codify what a swipe did on a handset, Amazon is trying to define how we’ll talk to the internet of things.

With the 5 million sold, deals to put Alexa in Ford cars, in dozens of new devices like speakers and intercoms, and an open ecosystem that lets anyone bring voice control to their services, Amazon has taken a strong lead in becoming the standard bearer for voice.

In the future, a good voice-based platform will need several talents that go beyond good artificial intelligence. It will need the ability to discern different voices for authentication purposes.

It needs to go beyond having a decent knowledge graph about a person to having a strong knowledge graph about the millions of devices we’ll want to control with voice. Finally, it will also need a sophisticated model of how to derive our intent and then execute a task based on that intent given the device we own.

Google has a good knowledge graph about a person’s interests and movements, while Amazon has a good sense of what devices people have to work with. It’s still an open question of who will combine those things and develop a strong model to let you ask your digital assistant if everything is okay at home, and get a response.

Taking the long view, the race today is about controlling the voice UI. Everything else is still in development.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

Forget personal assistants, The real battle is for voice UIs was originally published in IoT For All on Medium, where people are continuing the conversation by highlighting and responding to this story.

In the last few weeks, I’ve had some of the most encouraging discussions I’ve ever had when it comes to security and the internet of things. As part of that, I’ve gathered several ideas about how we improve IoT security.

I participated in a discussion about IoT security at the Techonomy conference two weeks ago where folks discussed a label or seal for devices that would indicate their level of security. The thinking was that the industry could develop a Five Star rating or maybe a nutrition-style label for explaining to consumers how secure a device is and where their data goes.

Also in that conversation, we talked about the need to get government to coordinate around the internet of things in a more unified manner.

Betsy Cooper of the UC Berkeley Center for Long-Term Cybersecurity said that the creation of a dedicated IoT agency might make sense under an existing department, but noted that established government fiefdoms would never relinquish their power (and budget) associated with the internet of things, so it is unlikely to happen.

For many IoT experts, it’s clear that security should be something that government takes control of either through regulation or a series of clear rules with punishments for companies that are careless with their products or consumers’ data. But it is also clear that the government wants no role in the security challenge.

Fears of stifling innovation loomed larger than fears of the Mirai botnet and the risk of an army of old-school connected devices used to attack networks. Chris Rill, the CTO of Canary (maker of a connected security device), isn’t waiting for the government. Devices that have good security are so important to a consumer brand that he is prepared to spend $30 more per device to build a secure product.

Secure products can only protect that individual device, though, which is why the network itself and the traffic flowing across it matter. Nicole Eagan, CEO of security firm Darktrace, made the pitch at Techonomy that artificial intelligence and bots could battle malicious bots. Darktrace already uses AI to monitor network traffic in enterprises, and Eagan said that within the next half year we will see the technology applied to a smart hub or router.

So what does this mean? A report out this week from BITAG, the Broadband Internet Technical Advisory Group, tries to wrap it up in a neat package. BITAG is a group of engineers helping make sense of technical issues that span industries. Their report on IoT security offers dozens of scary stories about security and privacy weaknesses already apparent in the connected world.

It also offers some solutions, and none of them involve the government. Some of the solutions have already been discussed at length, such as requiring people to change default passwords and requiring devices that are connected to have the ability to update over the air.

But it goes a bit further. For example, when it comes to updates, the report leans in favor of the device being able to authenticate the update before downloading it and implies that automatic updates as opposed to user accepted updates are the way to go. The report acknowledges that users may dislike the new functionality and those updates may also introduce bugs.

It also suggests that companies making connected gadgets commit to updating the product for the life of the device, with a clear delineation of what that time frame will be. This is an idea that is common in enterprise IT and would be a sobering best practice if employed for consumer devices. For example, if you knew your latest Android phone or Nest thermostat would only get software and security updates for two years or five years respectively, that may change how you view the price or functionality of the product.

Right now, when it comes to connected products there is no discussion about the expected lifespan, which feels a bit disingenuous especially because their “dumb” counterparts have decades-long lifespans in some cases. It’s ridiculous to think that your “smart” products will last that long. Even if they do cost three times as much.

Many of the other recommendations seem poised for a router company to really benefit. They include being able to see what devices are on the network and alerting users to odd traffic patterns. The report also points out that in the connected home with devices already talking to each other, there is no firewall behind the network, which means that devices are at risk. One option to help limit the risk from this is to put devices on a separate network. Create a guest network for as many devices as you can.

Finally, the report offers a big vote for encryption of data at all points of its progress. No data should be sent using clear text whether it’s location data for getting weather information or Wi-Fi passwords. There’s a lot of innovation happening in encryption for resource-constrained devices that can help here. Chip technology from ARM is one option, but even encryption from a company like SecureRF or WolfSSL could help.

We still have a long way to go, but it’s clear that the industry is waking up to the problem. It’s a shame the government is so passive about it, though.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

Despite the demographic tsunami about to hit with the aging of the baby boomers, few companies are successfully marrying connected devices and elder care. It’s not for a lack of trying. I’ve seen a few startups go after the market and fail, but I do believe there’s a strong business to be had if someone can get the user experience right for both the elderly and the caregivers.

Maybe the Amazon Echo and its voice user interface is the answer. That’s what Dennis Fontaine believes. Fontaine is the head of a company called Transcendent Technologies that develops businesses based on demographic trends. His most recent idea is LifePod, a device that uses the Amazon Alexa Voice services to help provide a companion and assistance for the elderly.

Prior to coming up with the LifePod, Fontaine worked on a roving robot that could interact with elderly people in their homes. But research proved that idea would be a disaster, he said. “In the U.S. people aren’t ready for a robot that can move around your home,” he said.

After buying an Echo, he realized that it might be the right form factor. It stayed out on a counter and theoretically could provide assistance and even conversation, helping ease the loneliness that some elderly feel. So he hired a firm called Macadamian and the two companies created the LifePod.

The device is rectangular and can rest on a support or be mounted on a wall. It has a smoke detector, a nightlight and a touchscreen. And of course, it has a variation on Alexa. The variation allows the device to talk back to consumers and to check in with them throughout the day. So it can remind someone at 10AM to take her pills, or even ask how she’s feeling.

If the response isn’t good, the device can send a text to the caregiver, or perhaps call 9–1–1 if needed. Fontaine has already signed deals with doctors and mail-orders pharmacies that will allow for prescription refills and the ability to call an on-call physician if needed. The device also has a microphone that is always listening for falls.

If a fall is detected it will ask the person if they are okay, and escalate the situation as needed. It also has a camera, although it can be turned off for privacy.

Fontaine is hoping to find a partner to help bring the device from the current pre-production model to general availability. He estimates it would take about four to five months to get it to full-scale production, and he hopes to sell it for a $35 per month subscription fee or $899. That’s comparable to a Lifeline necklace sold by Philips.

Fontaine has also built versions of the device for the hotel and restaurant industry called Rosco. It could let guests in hotels control their lights and A/C in their rooms, and communicate with servers and staff in hotels and restaurants. I’d welcome voice control in the hotel room as someone who loathes playing the popular hotel room game of trying to figure out where the light switch on the bedside lamp is located.

He’s also playing with a consumer device called Alexx which would command the smart home and let users aggregate many commands for the Echo. This has less appeal to me for now, but I’m curious where it could go. A tutoring function could be really useful.

Fontaine says the technology his company has built could be ported to the Google Home or even Siri, but he’d most like to work with Amazon since he’s a fan of the Echo.

As services go, LifePod joins newer connected devices such as PillDrill (it just raised $3 million) and EllieGrid which are trying to help create tech-friendly products to help people age in place. Frankly, we need more ideas here.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

Months before Donald Trump became the president-elect of the U.S. someone asked me to do a deep dive into what he would mean for the tech industry. At the time I said I couldn’t do it because Trump didn’t seem to have any deeply held beliefs about technology.

Like many older politicians, he seemed to view it as an add-on instead of something that is part of the fabric of life as we live it today. Plus, there was always the sense that Trump would say anything on the campaign, whether it was about a wall or deporting a few million American citizens because of their religious beliefs.

How could someone trying to understand his tech policy trust in anything he was saying?

But the electorate has spoken and Trump is now the president-elect. So now every tech journalist has to figure out what his presidency will mean for tech. For me, this means the internet of things.

The biggest impact will likely be felt as a matter of momentum. The Obama administration believed that tech was a powerful tool to advance long-term human goals such as improving longevity. Witness the precision medicine effort that allocated research funding to try to cure cancer using personalized medicine enabled by big data and cheap computing.

At the same time, the Obama administration was aware of the potential for civil rights violations and injustice that could be wrought when applying biased data or releasing certain types of data into the wrong hands.

Will Trump’s administration turn to science and technology in a similar way, while also understanding the risks? It’s doubtful. So far Trump’s proposed cabinet picks are established Trump loyalists as opposed to those with tremendous technology and scientific experience.

Trump’s administration seems more focused on trade issues that could lead to an increase in the cost of tech manufactured elsewhere and imported here. That could have negative implications for everything from the cost of chips used in connected devices to the physical assembly of products like connected door locks and light bulbs.

Outside of Trump’s challenge to the current trade agreements, I’m concerned that Trump’s attention to fossil fuels and promise to cut Obama’s Clean Power Plan to reduce pollution at power plants, means that electric vehicles and energy conservation programs that rely on connected devices will likely lose subsidies and importance.

That also has implications for smart cities, since many of those programs start with replacing older, less efficient lighting with newer, connected street lamps that use LEDs. Some of that funding comes from local governments and grant programs, but there are also programs such as the Department of Transportation’s $40 million smart city competition that may lose out as a priority.

However, if cities de-emphasize their “green” focus, smart cities may get a boost. According to the Trump transition web site: “Americans deserve a reliable and efficient transportation network and the Trump Administration seeks to invest $550 billion to ensure we can export our goods and move our people faster and safer. We will harness technology and make smarter decisions on how we build and utilize our infrastructure.”

That’s vague but could be promising if that money actually materializes.

Trump isn’t a fan of regulations as anyone who reads his plan for his first 100 days in office or his transition web site can see. This may benefit some areas of connected technology such as autonomous cars, where too much regulation may stymie innovation. On the flip side, having a federal rule here would help companies work toward a common standard as opposed to having to certify their cars in each state or municipality.

Trump has promised to eliminate “red tape” at the FDA to speed up drug approvals. That may extend to new forms of connected medical devices.

Aside from a general attitude and these areas there are questions. I’m waiting to hear Trump’s thoughts on encryption since that is vital for securing the internet of things. In February he came out against Apple’s pro-encryption stance when the FBI demanded the company let the FBI have a backdoor into the iPhone of the San Bernardino shooter. Where does he stand today?

Based on this, many activists are using Trump’s election to renew calls on big companies to rethink their storage of user data storage, which has implications for any company with a connected device such as FitBit or Nest. A quick glance at Trump’s transition website and its privacy statement offers little comfort.

The data collected on that site is kept indefinitely, is shared with third parties and your personally identifiable information may be made available for “law enforcement purposes” and for site security. This isn’t all that different from other privacy policies on popular websites, although some delete data after a certain period of time. Not all sites share your information with third parties, either.

Again, we’ll learn more as time passes and Trump actually takes office. And like any president, Trump will also be forced to react to realities around him, dictated by outside events, budgets and even popular opinion.

So start working on that smart infrastructure proposal.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

After IoT World, the list of companies with an IoT platform has expanded considerably. If you are a big enterprise IT provider or a big industrial player and you don’t have some kind of cloud-based service that you can call an IoT platform, you’re naked at the industry’s latest fancy dress party.

With everyone slinging an IoT platform around it’s worth trying to figure out what exactly is happening, what it tells us about the internet of things and who is on top today.

As I’ve said before, the internet of things isn’t just the latest buzzword. It’s a way to digitize information about more of our world for crazy low costs. Making use of that information requires two things: (1) subject matter expertise and (2) a platform that lets you manage the inflows of that information, the devices that information is coming from and then make sense of that data. That’s easier said than done.

On one side you have the GEs, the Bosches, the Hitachis, and subject matter experts in the analog world of machines. They are trying to launch software to handle the tech platform side of the equation. These providers are good at understanding what types of data a company will need to automate their factories or products, and how to build models so companies can deliver services like predictive maintenance. They understand the problem companies are using the data to solve.

On the other side, you have the tech giants like Microsoft, Amazon, IBM, Samsung and Cisco trying to provide the cloud infrastructure. This infrastructure should include several things. It starts with the tools to manage the information coming in from what may be millions of devices, and then includes data analytics that must handle both a repository of historical data to build models with and the ability to apply these models to real-time incoming data.

Finally, the results of these analytics must be provided to business users in some intelligible format. It also should offer APIs or other ways to connect whatever insights the platform derives to some sort of action. Predictive maintenance is not scalable if you simply have a dashboard show a notice in your factories when something is about to fail. It’s far better if that notification goes to a technician who is then scheduled to fix it. The next job shows up automatically on that tech’s schedule and is scheduled based on business rules applied by the company.

Very few cloud providers offer all of this today. Microsoft does. IBM appears to, and so does Amazon. Google has a lot of it, although its data visualization efforts for businesses are weak. Correspondingly, there is almost universal agreement among people working in industrial IoT that Microsoft is the furthest along as a tech company when it comes to delivering a complete platform as a service.

This doesn’t get into the role of gateways and different ways to connect edge devices, so it’s a simplified view. But when push comes to shove, these are the relevant dynamics behind the platforms everyone is launching. Today we are seeing the tech companies sign partnerships to gain industry expertise while the industrial guys try to build their own cloud platforms. In some cases, these are even hosted on the computing platforms of their cloud PaaS rivals.

We’re also seeing a rash of acquisitions as companies try to build the features they know they need but don’t have into their cloud platforms. I’m skeptical that the industrial giants will deliver a credible cloud platform for customers, and they should likely invest more in partnerships to make it easy for their customers to send their data to the IoT platform of their choice.

Fundamentally what the industry is trying to work out is a question of value. What is the value of providing a cloud platform as a service? What is the value of knowing how to collect, organize and interpret data?

The last decade has been about moving people away from trying to build the computing infrastructure themselves. Spending by Hitachi or Bosch to build something like that internally makes little sense when their value is far more about trying to build scalable ways to help their customers use their data to make their business more efficient.

Meanwhile, it’s hard to see how a tech giant could move into the role of systems integrator or subject matter expert. One question we’ll have to wait to see is how the industry creates clusters of industry specific knowledge. Will these be owned by the subject matter experts? GE has launched Current in the building automation/energy management space, so there is a precedent. Or will the computing companies buy some of that expertise and build it into their platforms?

Right now it’s a mess and clouded by marketing. Hopefully, when you hear about the launch of yet another IoT Platform, this helps you vet what’s really on offer.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

Last Friday’s distributed denial of service attack against a company that provides the equivalent of an address book for the internet has left consumers wondering what to do about their connected devices. I covered the attack and the response of popular smart home product vendors, but here is a breakdown for anyone wondering if she is harboring a compromised device or discovered that he has devices that are part of the Mirai botnet.

How do you know if your devices have been compromised?

The short answer is you don’t. You can use a service like IoTScanner to see if any devices on your home network have ports open to the internet, which means they could be at risk. You can also check this list of devices that have proved popular hosts for the Mirai botnet, Chinese electronics maker Hangzhou Xiongmai Technology Co Ltd has issued a recall, but because its products are also sold to other companies, it’s unclear if consumers can tell if they have a problem device.

Finally, you can use a monitoring tool on your home networks to see if there’s unusual activity at odd times, or just generally see if your bandwidth is constrained. A distributed denial of service attack gets it’s power from using your available bandwidth to fire messages at the target’s servers to overwhelm them. So when your device is used in an attack it’s effect on your network is noticeable.

My device is compromised. What should I do?

If you have a device with a hard-coded password, you are out of luck. Unplug it and hope for a recall. If you have a device where you can reset the password, do that and check for a security patch from the manufacturer. You may have to take the device offline as part of an update. If it’s a router, I’d suggest buying a new one that follows today’s security standards. One that does not have a hard-coded password, forces users to change their passwords during setup, allows for over-the-air updates and a made by a company that issues regular security patches.

This sucks. What can be done to prevent it?

This is a tough problem to solve, because security is expensive to implement, and in today’s world requires constant vigilance. Good security also generally requires more from the consumer during the set up process or through occasional updates that consumers find annoying. Finally, there are no real standards for saying if something is secure.

Broadly, consumers need to pay for security, recognizing that a cheaper product may have cut corners. Manufacturers need to get behind a security framework that can help consumers navigate device security, much like the five-star safety rating on a car. Most people don’t know all of the safety features in a five-star rated vehicle, but it is a managed framework that provides reasonable confidence.

I am The Cavalry is developing such a framework for connected home devices. Underwriters Laboratory is also trying to develop a security certification. So it’s likely we’ll see work on this in the coming year. Regulators also need to have the tools to punish companies that take a laissez-faire view of security (those standards will help here too). The latest attacks have fueled worries in DC about the danger such unsecured device pose to our defense networks.

Finally, don’t panic. Today’s massive connected-device fueled hacks are tomorrow’s inconveniences as our networks take on more and more traffic. Andy Ellis, the chief security officer at Akamai, says that thanks to the adoption of 4K video and live TV being broadcast online, we’re already growing our networks to a point where they should soon be able to swallow a terabit per second attacks such as last Friday’s.

So, set passwords, pay up for brands that offer security and hope the industry and government come together on a security framework. And maybe wait.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.

After IoT’s DDoS: What now for consumers was originally published in Austin Startups on Medium, where people are continuing the conversation by highlighting and responding to this story.

This weekend it felt like the entire world woke up to the issue of IoT security. Ironically it wasn’t the hacked door locks or threats of a light bulb being taken over that sparked massive conversation and coverage. Instead it was someone using an army of connected devices to attack Dyn, one of the companies that provides the address book for the internet.

The result was that Twitter, Amazon, Reddit and Spotify all struggled with intermittent access. But these attacks require perspective more than panic.

Want to know if your devices are compromised and what to do if they are? I wrote about it here.

There are two issues here. The first is that we have a pretty binary concept of security where something is either secure or it isn’t. That idea doesn’t actually allow for the complexity of the types of attacks that can exist online and with connected devices. In this attack, the issue was powerful computing devices that connected directly out to the internet, with hard-coded passwords or unchanged default passwords.

Hackers using source code available on the internet started scanning for these devices and took control of them easily because the passwords were easily accessible. It was easy to take them over and automate a process by which these compromised machines sought out more compromised machines. These distributed denial of service attacks used connected devices as the “battering rams” to beat at Dyn’s servers.

But this leads directly to the second issue. While news stories blame this on the internet of things, your light bulbs or refrigerators are unlikely co-conspirators in a botnet. In part that’s because many home connected sensors and other devices work through a hub. They don’t connect directly out to the internet, opening a port that hackers can exploit.

The other reason is they don’t have the raw computing power necessary to do much damage in a denial of service attack.

Security researcher Brian Krebs has discovered that the most common devices used in the attacks were IP cameras, routers and networked DVRs. There were also some printers thrown in there. This hardly is a representative sample of the internet of things. It feels like a minor quibble, but if we’re trying to talk about securing the internet of things we have to understand what we’re defending against (in this case, DDoS attacks) and what the culprits are (powerful computers with a direct connection to the internet).

Andy Ellis, the chief security officer at Akamai, suggests that hubs might be the best way to prevent all of your devices from talking directly to the internet while still ensuring offline functionality. This is of course, after doing away with hard-coded passwords that the current generation of botnet software is targeting.

Nathan Smith, the CTO at Wink, a smart home hub, echoed that opinion.

“These cameras and routers are getting taken over because they are accessible through ports instead of going through a cloud and getting access to your data,” Smith said. “You are basically opening a window to the home network over a port, so the architecture at the most basic level is what is at fault here.”

But hubs aren’t the only security precaution. I asked several of the companies with popular brands in the connected home about their security procedures. For example companies like Nest, SmartThings, WeMo and Wink all monitor devices in the field and were confident they would notice if many of their products were going offline or changed behavior in a way that indicated a botnet attack.

All of these companies plus Philips Hue, Chamberlain (which makes the MyQ garage door sensor) and August also can offer over the air updates that would push security updates to devices that could fix a problem. None of these devices come with hard-coded passwords or even default passwords. Part of the act of setting up any of these devices on a network involves creating an account with a new password.

I didn’t hear back from August, the maker of both a connected door lock (which communicates by Bluetooth so would not be useful in a DDoS attack) and a video doorbell, but it did experience service issues as a result of Friday’s attack, so presumably preventing its devices being used in a bonnet are top of mind. It does force users to change their password.

Ecobee, the maker of a connected thermostat declined to comment, and Netgear did not respond.

But preventing a device from becoming part of a botnet is only part of the security battle IoT device makers face. They have to encrypt data as it travels over the internet (and ideally as it travels within the home). They should encrypt that same data in the cloud and ensure that user credentials are stored in securely. Even today we’re still reading about user names and passwords being stored in plain text on unsecured databases.

Device makers also need to think about the data they collect. Several CEOs tell me they don’t store a users’ Wi-Fi password because they don’t want the liability. All stored data can become a treasure trove for a determined hacker, so it is worth thinking about the data your devices or service really needs.

Companies should also conduct regular penetration tests to see if their products can be hacked. Brian Knopf, director of IoT Security Research at Neustar and former head of security at Wink and at Belkin/WeMo, says that consumers should look for devices that have a security section on their web site and a bug bounty program. “That shows they are thinking about security,” he says.

After this weekend every connected device company and consumer should be.

Did you like this story? Want more? Sign up for Stacey Knows Things, a newsletter covering the internet of things, to get this essay and more.