3 ms·
> it's not clear that the organization has any real liability for the security faults. If everyone is allowed to point the finger at everyone else, nothing wil
by omegaworks 10y ago
> it's not clear that the organization has any real liability for the security faults.
If everyone is allowed to point the finger at everyone else, nothing will get fixed.
This organization profited from the sale of opaque, unserviceable devices with known flaws. Anyone with a basic understanding of the internet knows a default password is an accident waiting to happen. When will we consider this an unacceptable product defect and mandate that manufacturers be responsible for implementing fixes?
That's the only way we'll see sustained investment in open, vetted architectures and push back against security corner cutting for business reasons.
- djsumdog 10y agoWhat about all the open source products out there with default passwords? Most distributions with ARM ports (Arch Linux Arm, Bananapian, etc.) have default passwords. At least Openwrt doesn't (it allows one-time telnet access to set a password, then disabled telnet and enables SSH), but should other oss devs be liable for this bad practice? You might be like, "Well hobbies have to install those images on their hardware." Well what if those projects sold hardware on the side to raise funds? Or a 3rd party sold hardware+software bundles? Who in the chain is liable?
- angry-hacker 10y agoAlso the default goto distro raspberry pi had at least few years ago. Who would then be responsible?
- omegaworks 10y ago> "This organization profited from the sale of..." Usually not the case for OSS projects.