Liability on a Chip
Early this year Apple shipped the version 5.2 software update for the Apple TV, enabling support for Bluetooth keyboards. This feature was definitely a welcome addition but not one I was expecting—I had no idea the Apple TV even had Bluetooth hardware in it.
Curious, I found a tear down of the device and looked for the Bluetooth chipset. The BCM 4330 used looks like a fantastic chip. It supports wireless a/b/g/n, Bluetooth, and even has an FM transceiver. An FM transceiver? That’s even more functionality I had no idea this tiny computer in my living room was capable of.
Does Apple have big plans to broadcast FM radio from my apartment? Well, they could. But it’s more likely that this wireless chip satisfied all of Apple’s communications requirements nicely and just happened to have FM transmission capabilities. Maybe one day they’ll flip on FM reception. I mean, it’s not a crazy feature for a media center device. And the functionality is there—it’s just waiting for software to activate it.
As chips get cheaper to produce it makes more sense for manufacturers to create multifunction chips they can sell for many purposes instead of making limited-feature chips to sell for specific uses. Replacing a variety of chips with a single multifunction chip means fewer manufacturing lines, reduced staffing, testing, logistics, transportation, marketing, and certification costs. Just ship a host of functionality and let the purchaser decide which capabilities to use.
We’re starting to see the results of this in consumer technology. One such result is increased flexibility of devices, sometimes going beyond the feature set the devices openly launch with (like the Apple TV), or even beyond what the creators had initially thought to do with the device. Over-the-air updates mean features can be added in later. We’ll probably see lots of new capabilities—some frivolous—in upcoming generations of products. My bathroom scale measures CO2 levels. Why? Well, it’s not completely useless, but part of me wonders if the question posed was something more like “why not?”
There are other, less desirable effects. In 2011, when the U.S. Chamber of Commerce was the victim of a large scale data breach at the hands of Chinese hackers, one point of infiltration was a hacked thermostat “at a town house the Chamber owns on Capitol Hill”. It seems a bit ridiculous that a thermostat would even have the technology to be hacked, but this is the future and we may as well prepare ourselves for it. Anything with a generic microprocessor and a network connection is a possible candidate for hacking. And soon this will be everything from microwaves to baby monitors.
Putting objects online makes sense. Internet connectivity allows for updates to fix bugs, enables intelligent behavior, backups, synchronization, sharing of data, and even the ability to alert us to recalls. The smartness of “smart” devices is often not so much in the devices as it is in their ability to coordinate with other devices in the same environment.
Generic, flexible hardware architectures also make sense. Not just from a manufacturing standpoint, but also so that developers can work rapidly on systems and with toolchains they have familiarity with.
In fact, there’s a whole movement underway in the software world as programmers are suddenly able to interact with hardware. Systems-on-a-chip and platforms like the Arduino and the Raspberry Pi have empowered a generation of developers to create over-engineered hardware solutions. Full-versions of Linux on desktop-grade machines running high-level programming languages in order to blink a couple of LEDs. It’s an embarrassment of technological riches.
As a developer, it’s exciting to be able to interact with the physical world. But most of us are new to it. And the risks are different.
Imperfect software security is a fact of life, and we’re opening up myriad new ways to be monitored and to have our data stolen. Our Kinects watch (and listen!) to us constantly. Our WiFi-enabled scales can sniff our network traffic. There are scores of IP-enabled devices within our networks on which malware can live. It can even be carried inside of our bodies on devices like pacemakers, and these devices will be transported into even the most restricted of areas. The implications are complex, opaque.
I have more questions than answers on this subject. Maybe we’ll develop better tools for monitoring how our data is used. Maybe we’ll invent watchdog devices to keep an eye on the data other devices send and receive. Perhaps well add standard security daemons or OS extensions to these common systems and create new certification standards so consumers have some idea what they’re getting inside that shiny plastic case. Maybe we won’t. Right now there’s really no incentive for product makers to care. And honestly, most of us don’t really know what’s in our devices (let alone ask or understand).
But one thing I know is that if you’ve ever considered a career in the software industry, go for it. Because on a long enough timeline, software guys always win. Hardware ➡ firmware ➡ software. And the only thing beyond software is more software.