3 ms·

Assuming everything went as planned, no problem. But to play devil's advocate... The risk with these things is always the "what if?". What if during that patch

Assuming everything went as planned, no problem. But to play devil's advocate... The risk with these things is always the "what if?". What if during that patch it bricked my device due to some fluke? What if I had a special customization that relied on a specific behavior on the component that was just updated without my consent? What if that patch attempt to a vehicle fails, leaving it unable to turn on? What if that vehicle was an ambulance?

anon4 11y ago
I think their answer would be "the needs of the many outweigh the needs of the few"... And to flip that argument again - would you prefer your device to be bricked by someone trying to run a webserver serving child pornography, or by someone trying to protect you from the first?
- ethbro 11y ago
  Aka the "yelling 'Fire!' in a crowded movie theater is not free speech" exception. It's good for the guy who wants to yell "Fire", but is it good for the majority? If you patch routers and 1% get bricked by some fluke, is that not a win for society? Also, to rebut the "How dare you change the firmware on my router without my consent?!" point, let's not forget these were essentially unprotected routers at this point in the applied_patch vs known_vulnerability cycle. If you don't want anyone patching your router without your permission... SECURE YOUR OWN PROPERTY. If I leave something on the sidewalk, I don't get angry when people cart it off / step on it. I especially don't get angry when they glue the broken bits back together and leave it on my doorstep with a note saying "We noticed this was broken. Superglue works wonders! Here's the number for a hardware store where you can buy it."
logfromblammo 11y ago
What if someone could do any of those things intentionally and maliciously, instead of merely by accident? If the vehicle is an ambulance, a well-intentioned intruder could break it at any time, whereas a malicious one could break it at the worst possible time. While either one could cause a disaster while carrying a trauma patient at full speed on the highway, the accidental damage might also occur while motionless and empty in a parking lot. If grey-hats can patch a vulnerability against your will, it is very likely that they first tried disclosing the vulnerability to the manufacturer of your device, and they declined to fix it within a reasonable time, or you didn't run that update. Either way, whatever damage done to the device as a result of exploiting vulnerability would not have occurred if the vulnerability had already been repaired.
tajen 11y ago
If the device gets bricked while updated through a breach, then go back to the manufacturer telling them what you think of their device.
duaneb 11y ago
> What if that patch attempt to a vehicle fails, leaving it unable to turn on? If a router ships with a brickable vulnerability, the warranty SHOULD cover it. I don't know if it WOULD.

anon4 11y ago

I think their answer would be "the needs of the many outweigh the needs of the few"... And to flip that argument again - would you prefer your device to be bricked by someone trying to run a webserver serving child pornography, or by someone trying to protect you from the first?

ethbro 11y ago
Aka the "yelling 'Fire!' in a crowded movie theater is not free speech" exception. It's good for the guy who wants to yell "Fire", but is it good for the majority? If you patch routers and 1% get bricked by some fluke, is that not a win for society? Also, to rebut the "How dare you change the firmware on my router without my consent?!" point, let's not forget these were essentially unprotected routers at this point in the applied_patch vs known_vulnerability cycle. If you don't want anyone patching your router without your permission... SECURE YOUR OWN PROPERTY. If I leave something on the sidewalk, I don't get angry when people cart it off / step on it. I especially don't get angry when they glue the broken bits back together and leave it on my doorstep with a note saying "We noticed this was broken. Superglue works wonders! Here's the number for a hardware store where you can buy it."

logfromblammo 11y ago

What if someone could do any of those things intentionally and maliciously, instead of merely by accident? If the vehicle is an ambulance, a well-intentioned intruder could break it at any time, whereas a malicious one could break it at the worst possible time. While either one could cause a disaster while carrying a trauma patient at full speed on the highway, the accidental damage might also occur while motionless and empty in a parking lot. If grey-hats can patch a vulnerability against your will, it is very likely that they first tried disclosing the vulnerability to the manufacturer of your device, and they declined to fix it within a reasonable time, or you didn't run that update. Either way, whatever damage done to the device as a result of exploiting vulnerability would not have occurred if the vulnerability had already been repaired.

tajen 11y ago

If the device gets bricked while updated through a breach, then go back to the manufacturer telling them what you think of their device.

duaneb 11y ago

> What if that patch attempt to a vehicle fails, leaving it unable to turn on? If a router ships with a brickable vulnerability, the warranty SHOULD cover it. I don't know if it WOULD.