Anatomy of a #fail ... the internet of broken software stacks

So I’ve been trying to diagnose a problem with my Android devices running out their batteries very quickly. And at the same time, I’ve been trying to understand why my address bar on Thunderbird has taken a very long time to respond. I had made a connection earlier today when I had noticed the 50k+ contacts in my contact list, of which maybe 2000 were unique. I didn’t quite understand it. Why … no … where … were all these contacts coming from? And why were there so many duplicates? In the brave new world of #IoT, we are going to have many interacting stacks. And these stacks are going to have bugs. And some of the failure modes are going to be … well … spectacular. This is one such failure mode, that I happily caught in time. Here is how I have pieced it together thus far. We had a run-away amplification of contacts due to some random buggy app. It may have been one of the sync bits in thunderbird, or on my old iphone and ipad, or on my new android, or whatever. It doesn’t matter what it was. What matters is what happened, and how the failure progressed. And it shows why remarkably simple, and stupid (e.g. #IoT level) code can result in something akin to a positive feedback loop. One of the buggy apps apparently either pulled an extra set of contacts from google, or pushed an extra set to google. Doesn’t matter what. Google’s contact manager is dumb. It could be smarter. Far smarter. Say for example, if another app attempts to push a duplicate contact to it, instead of accepting it, it should simply move on to the next contact. Rinse and repeat. This would have stopped what amounted to a denial of service on my devices, cold. But it didn’t. So some buggy app synced. And then resynced, and then resynced. And the poor little androids and other devices spent more and more time syncing. And more and more battery syncing. This is the ultimate in secondary denial of service attack. Don’t attack the device, but cause it to run out its power by leveraging its normal functionality. The denial of service is through a shutoff due to running out of the battery. A second order, or indirect attack vector. Neat, huh? This is what we have to look forward to. For reasons beyond my comprehension, each sync resulted in a doubling of contacts. How often they have synced is not known. What is known is that I had well over 10k contacts for one person, that were identical. So I cleaned that out. And later today, I found I had that again. So I stopped everything from syncing against it. Everything. Its now a one way pull from google’s contact manager. Because google’s contact manager is really, hilariously, stupid. Though the remove duplicates function? Good idea. Though, I dunno, why not make it automatic? But thats not the main point of this. The real point of this is that IoT is going to be ripe for un-intended abuse, not to mention intentional abuse. Denial of service at a level not comprehended before. Tis a brave new world. Also known as, be careful what you wish for, you just might get it. Software has eaten the world, and we might just regret letting this happen.