3 ms·

"If it ain't broke don't fix it" is always good advice. But some ancient duct-taped WAMP situation with insecure passwords needs to just be set on fire. Jesus c

by cultus 7y ago

"If it ain't broke don't fix it" is always good advice. But some ancient duct-taped WAMP situation with insecure passwords needs to just be set on fire. Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet.

InvaderFizz 7y ago
> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck getting it to run on anything except Windows XP/95/3.11. 3. The tester is LONG out of support. 4. The company that makes it is either out of business or was bought up by Teradyne/Advantest 5. The software is licensed specifically for that hardware it came with(CPU/Motherboard guids/serials, MAC addresses, etc). 6. If there is even a replacement for the tester, it will cost a minimum of $500k to replace, probably $1MM or more. 7. A customer requirement is to have external access, as much as IT fights it, the tester must also have internet access so the customer can send/receive files with their own workflow. Sometimes we got lucky and I was able to push forward multiple upgrade projects moving testers from Windows XP to Windows 10. This was the case with most anything using a National Instruments GPIB where the software wasnt also locked down. Since National Instruments makes drives compatible with Windows 10 for their PCI cards, we were able to transition to Windows 10 on an entire floor once I developed a compatibility shim to get around the non-UAC assumptions of the tester software. Example from 2018: A tester that runs on Windows XP meets all of the above. Capacitors on the P4 motherboard blew up, company was bought by Advantest, but they dont make that tester anymore or even have a replacement. It is one of three left on planet earth. What do we do? Replace everything we can. New RAM, SSD using an IDE to SATA bridge, PSU, etc. We sent the motherboard to one of our internal techs who replaced every single cap on the motherboard, by hand. A few days later, it is back in action. It will remain in this condition for another decade or more, with internet access. This is normal in anything involved with manufacturing, and yes, it will all end badly. Thankfully, I am out of the Bay Area now and not at all involved with hardware manufacturing or that company, no longer supporting internet connected Windows 3.11, RHEL3, AIX4, and SunOS 2.6 machines.
- cultus 7y ago
  Yikes. I get that there's situations where you can't get newer compatible hardware, etc. But if it's that important, you'd think security would be important enough to go through the trouble of air-gapping it.
  - InvaderFizz 7y ago
    It is worse than that, customers run their own workload on these testers using one of two methods: 1. In person. 2. Using VNC/telnet over a SSH gateway that dumps them onto the single broadcast network with all these testers. Did I mention that changing the IP address on many of the testers is not possible without triggering a $10k+ licensing event because a change in the IP address invalidates the license file?
- ryacko 7y ago
  At $500k wouldn’t be cheaper to reverse engineer it, or even start a clean room reverse engineering project and open source it?
  - InvaderFizz 7y ago
    There is a cost-benefit-analysis at play, and even if one makes the security argument, that is "what if" talk, not concrete numbers that are coming out this year. A $500k tester's depreciation is based on a 10+ year service life. The ones that make it past that point turn into security nightmares and profit centers at the same time. These are large and complex machines, with hundreds or thousands of moving parts. A competent reverse engineer and driver developer likely could solve many of the driver interface issues and move things to newer platforms, but why invest hundreds of thousands per year in maybe updating something that still works? Who is going to pay for that? Oh, you want to raise your rates to pay for it? I guess they'll move all of their testing development to the competitor in Asia. This isnt some big name you have heard of, but this is one of the places that all the big names go to to test their silicon during development.
  - pritambaral 7y ago
    I guess the idea there is that it will always be cheaper to just not touch anything.

by cultus 7y ago

InvaderFizz 7y ago

> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck getting it to run on anything except Windows XP/95/3.11. 3. The tester is LONG out of support. 4. The company that makes it is either out of business or was bought up by Teradyne/Advantest 5. The software is licensed specifically for that hardware it came with(CPU/Motherboard guids/serials, MAC addresses, etc). 6. If there is even a replacement for the tester, it will cost a minimum of $500k to replace, probably $1MM or more. 7. A customer requirement is to have external access, as much as IT fights it, the tester must also have internet access so the customer can send/receive files with their own workflow. Sometimes we got lucky and I was able to push forward multiple upgrade projects moving testers from Windows XP to Windows 10. This was the case with most anything using a National Instruments GPIB where the software wasnt also locked down. Since National Instruments makes drives compatible with Windows 10 for their PCI cards, we were able to transition to Windows 10 on an entire floor once I developed a compatibility shim to get around the non-UAC assumptions of the tester software. Example from 2018: A tester that runs on Windows XP meets all of the above. Capacitors on the P4 motherboard blew up, company was bought by Advantest, but they dont make that tester anymore or even have a replacement. It is one of three left on planet earth. What do we do? Replace everything we can. New RAM, SSD using an IDE to SATA bridge, PSU, etc. We sent the motherboard to one of our internal techs who replaced every single cap on the motherboard, by hand. A few days later, it is back in action. It will remain in this condition for another decade or more, with internet access. This is normal in anything involved with manufacturing, and yes, it will all end badly. Thankfully, I am out of the Bay Area now and not at all involved with hardware manufacturing or that company, no longer supporting internet connected Windows 3.11, RHEL3, AIX4, and SunOS 2.6 machines.

cultus 7y ago
Yikes. I get that there's situations where you can't get newer compatible hardware, etc. But if it's that important, you'd think security would be important enough to go through the trouble of air-gapping it.
- InvaderFizz 7y ago
  It is worse than that, customers run their own workload on these testers using one of two methods: 1. In person. 2. Using VNC/telnet over a SSH gateway that dumps them onto the single broadcast network with all these testers. Did I mention that changing the IP address on many of the testers is not possible without triggering a $10k+ licensing event because a change in the IP address invalidates the license file?
ryacko 7y ago
At $500k wouldn’t be cheaper to reverse engineer it, or even start a clean room reverse engineering project and open source it?
- InvaderFizz 7y ago
  There is a cost-benefit-analysis at play, and even if one makes the security argument, that is "what if" talk, not concrete numbers that are coming out this year. A $500k tester's depreciation is based on a 10+ year service life. The ones that make it past that point turn into security nightmares and profit centers at the same time. These are large and complex machines, with hundreds or thousands of moving parts. A competent reverse engineer and driver developer likely could solve many of the driver interface issues and move things to newer platforms, but why invest hundreds of thousands per year in maybe updating something that still works? Who is going to pay for that? Oh, you want to raise your rates to pay for it? I guess they'll move all of their testing development to the competitor in Asia. This isnt some big name you have heard of, but this is one of the places that all the big names go to to test their silicon during development.
- pritambaral 7y ago
  I guess the idea there is that it will always be cheaper to just not touch anything.