7 ms·

Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be prote

Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.

hackbinary 7y ago
What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...
- asdf21 7y ago
  $50 honestly seems expensive considering how long home routers have been around. It's not as if it's novel technology. I'd expect cheap mass-produced routers to be around $15 - $25, like an immersion blender.. I don't quite understand why cheap ones are still $40-$60.
  - core-questions 7y ago
    People pay hundreds for these things on the high end; the market seems to have settled on the price. There may be room to under-cut, but you risk looking like a cheapo option when all the established manufacturers charge more.
  - kazen44 7y ago
    $50 is incredibly cheap for a home-router (which also is a wireless access point, a switch and a firewall). Prosumer or enterprise grade hardware is usually magnitudes more expensive. An edgerouter X is $50 for instance, but doesn't have wifi and lacks serious routing features. It is considered a very low end router compared to more expensive stuff from Juniper or Cisco. (even an entry grade router/firewall like an SRX300 will run you back atleast 4x the price of the edgerouter.) One thing these $50 routers lack besides proper software is stability. Most consumer networking equipment has an abysmal track record in terms of reliability.
  - quicklyfrozen 7y ago
    They are that cheap... e.g. Microcenter has models in the $15-$25 range. They're pretty much at the too cheap to not work level as they can't afford to develop complex, bloated features at that price point.
- rohan1024 7y ago
  Maybe this should be the way forward. We all should buy hardware that can run Software like OpenWRT
- dclusin 7y ago
  If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.
  - core-questions 7y ago
    > If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.
    - aduitsis 7y ago
      Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable?
      - gaius_baltar 7y ago
        > Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable? Not just financial damage, the owners of defective routers can be targets of criminal lawsuits if their connections are used as proxies for attacks, death threats, bank fraud, etc.
    - mtgx 7y ago
      It's not just "one unpatched router". It could be millions. Or millions or billions or IOT devices in the future that are unpatched. That does have the potential to create some damage if anyone takes control of them. Maybe even kill some people, if say they DDoS the V2I network for self-driving cars in the future, or a hospital network over which remote surgeries are performed, etc. I feel like this argument that "you get what you pay for" is pretty lazy. Usually, or ideally, consumer regulations are about setting standards and raising the bar. So that means that if there were strong laws for stuff like this, then the minimum router price may become $70 instead of $50 - but everyone would be reasonably protected for the large majority a device's lifecycle (only a small portion of the customers should be affected by leftover bugs when support ends, like say <5%, as others will have moved on to new products by then).
- msla 7y ago
  > You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Let's unpack this: You get what you pay for... yet you also say that OpenWRT solves this problem and is available free of charge. If you pay for a support contract, you get support right up to the point where the company decides to stop that support. If you have a contract worded the right way, you might be able to take the company to court over it, but if the company's willing to settle, you end up with some go-away money and an insecure router nobody's supporting. Does the money pay for next week's massive outage due to someone taking over your routers? Finally, the product as it was at time of purchase was a product fit to be sold, without major defects. In other industries, that's a standard companies are held to: If a ball joint goes out completely after 10,000 miles, Ford's kinda on the hook for that, neh? They can't say that you have the car you purchased because the car you purchased was driveable and not sitting on the side of the road.
  - GTP 7y ago
    >Finally, the product as it was at time of purchase was a >product fit to be sold, without major defects If somebody later discovers a bug in the firmware that bug was present from the beginning, so this is false.
    - crankylinuxuser 7y ago
      I could consider things like catching on fire or assisting a crime (DDoS, botnet, etc) to be such cases where they absolutely should be on the hook to be required to fix. And we already have a system put in place to assess. It's called CVEs. If you exist, you should be on the hook to fix. It's called 'Being Responsible'. And corporations have a strong tendency to not want to be. That's why we need the 'stick'.
- Groxx 7y ago
  I expect them to not sell devices at unmaintainable price-points. You know, like tons of other safety-relevant products. Anything you plug into the wall, or put gas in, or has enough torque to hurt someone ends up going through safety checks.... except software.
- djsumdog 7y ago
  Kits are different. Every router kit I've seen doesn't come with any software. Some come with a blank SD card and you can load what you want on it. Here's a tutorial I wrote for one kit I got: https://battlepenguin.com/tech/using-the-banana-pi-bpi-r1-as-a-router-with-bananian/ https://battlepenguin.com/tech/using-the-banana-pi-bpi-r1-as... but then I learned the hardware itself could fail into an insecure state, and there was no way to deal with it in software: https://battlepenguin.com/tech/banana-pi-bpi-r1-fails-into-an-insecure-state/ https://battlepenguin.com/tech/banana-pi-bpi-r1-fails-into-a...
  - abawany 7y ago
    I wonder if the GP meant 'kit' as in the UK-English sense, i.e. equipment and not the literal kit with no software.
- nominated1 7y ago
  Xiaomi sells routers in this price range that ship with OpenWrt. The buildroot even has config options for branding! It costs them nothing for the OS. It costs D-Link more to produce their mess.
  - NullPrefix 7y ago
    "But how will we differentiate from the market without our \"value added\" non-standard software?"
    - nominated1 7y ago
      The same way Dell and HP do with a Windows PC. The OpenWrt buildroot can help them do that too! ;-)
  - noonespecial 7y ago
    GL.iNet does the same. I use many of their offerings at home and for various projects. https://www.gl-inet.com/ https://www.gl-inet.com/
- mfer 7y ago
  What do I expect or what does a typical consumer expect? The folks on HN are not typical consumers of these products. Often times when defective products are sold there is some responsibility for some time to correct or notify people. Cars, child seats, and many other things fall into that. The defective devices that get updates or notifications are often safety related. Yet, safety and security are not talked about much with regard to technology. Maybe it's time to start doing that.
giancarlostoro 7y ago
There's also just you know, installing Custom Firmware if you're determined enough.
- msla 7y ago
  I'll never use vendor firmware again. If the router doesn't support OpenWRT, it's a time bomb waiting to go off, as this article shows; plus, of course, OpenWRT has sufficient additional functionality that that alone makes it worthwhile. And once again, we're all reminded of the divide between people who know how to do things like this and people who don't, and how the people who do know have an advantage in life.
  - giancarlostoro 7y ago
    I don't usually install CFW on mine, but it's something I look for the possibility of doing in case something like this D-Link issue occurs.
  - abawany 7y ago
    I bought a couple of Netgear AC1600 routers and installed DD-WRT/Kong firmware on them right away (clicked the PayPal contribution link and paid up - it is worth it). They work well and update quite frequently.
    - uptown 7y ago
      Can this model be used as a VPN server routing through your home ISP connection?
      - abawany 7y ago
        I think this router+dd-wrt supports it though I haven't personally used vpn on it. Here is the link that implies it supports it: https://www.myopenrouter.com/articles/r6300r6300v2-guides-how https://www.myopenrouter.com/articles/r6300r6300v2-guides-ho... . Some general information about the router is at: https://wiki.dd-wrt.com/wiki/index.php/Netgear_R6300v2 https://wiki.dd-wrt.com/wiki/index.php/Netgear_R6300v2 . Edit: another link: https://nordvpn.com/tutorials/dd-wrt/flashrouters-privacy-app/ https://nordvpn.com/tutorials/dd-wrt/flashrouters-privacy-ap... .
bluGill 7y ago
At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update those machines, but we are not entirely sure and there is always the possibility that the legal framework could change. We have an official policy that once a recall is made, the replacement parts for a safety issue will be available forever, or until we can prove all existing machines have either been updated or scrapped. (The latter is considered impossible to prove and so there are kits available for machines that last shipped in the 1980s.) This policy has in fact protected us in lawsuits: we take safety seriously so mistakes are taken as unintentional and punitive damages don't apply. I would expect a consumer router to run without problem for not less than 10 years: they should update it to work. Now they shouldn't have to add support for the next protocol or feature, but if it isn't secure that is different and should be fixed. All it takes is a lawyer. Note that you don't have to have the affected router, just prove that an affected router is attacking you. I think there are people in IT who are able to prove this latter one so all that is left is bring it to your lawyers to get dlink to pay your costs from the attack.
- tbyehl 7y ago
  > I would expect a consumer router to run without problem for not less than 10 years That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.
  - incompatible 7y ago
    How long do vehicle recalls last for, if something like an airbag turns out to be defective and dangerous?
    - tbyehl 7y ago
      You want to equate a consumer electronics device with an incendiary device legally mandated to be installed in every vehicle that may explode and kill people? Well, the legal answer is 10-years for a no-charge repair [0]. If D-Link routers start burning down homes I'm sure the Consumer Product Safety Commission will take an interest, but if it's more than a few years old the recommendation will likely be to throw it out and buy a replacement. [0] https://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm https://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm

hackbinary 7y ago

What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...

asdf21 7y ago
$50 honestly seems expensive considering how long home routers have been around. It's not as if it's novel technology. I'd expect cheap mass-produced routers to be around $15 - $25, like an immersion blender.. I don't quite understand why cheap ones are still $40-$60.
- core-questions 7y ago
  People pay hundreds for these things on the high end; the market seems to have settled on the price. There may be room to under-cut, but you risk looking like a cheapo option when all the established manufacturers charge more.
- kazen44 7y ago
  $50 is incredibly cheap for a home-router (which also is a wireless access point, a switch and a firewall). Prosumer or enterprise grade hardware is usually magnitudes more expensive. An edgerouter X is $50 for instance, but doesn't have wifi and lacks serious routing features. It is considered a very low end router compared to more expensive stuff from Juniper or Cisco. (even an entry grade router/firewall like an SRX300 will run you back atleast 4x the price of the edgerouter.) One thing these $50 routers lack besides proper software is stability. Most consumer networking equipment has an abysmal track record in terms of reliability.
- quicklyfrozen 7y ago
  They are that cheap... e.g. Microcenter has models in the $15-$25 range. They're pretty much at the too cheap to not work level as they can't afford to develop complex, bloated features at that price point.
rohan1024 7y ago
Maybe this should be the way forward. We all should buy hardware that can run Software like OpenWRT
dclusin 7y ago
If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.
- core-questions 7y ago
  > If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.
  - aduitsis 7y ago
    Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable?
    - gaius_baltar 7y ago
      > Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable? Not just financial damage, the owners of defective routers can be targets of criminal lawsuits if their connections are used as proxies for attacks, death threats, bank fraud, etc.
  - mtgx 7y ago
    It's not just "one unpatched router". It could be millions. Or millions or billions or IOT devices in the future that are unpatched. That does have the potential to create some damage if anyone takes control of them. Maybe even kill some people, if say they DDoS the V2I network for self-driving cars in the future, or a hospital network over which remote surgeries are performed, etc. I feel like this argument that "you get what you pay for" is pretty lazy. Usually, or ideally, consumer regulations are about setting standards and raising the bar. So that means that if there were strong laws for stuff like this, then the minimum router price may become $70 instead of $50 - but everyone would be reasonably protected for the large majority a device's lifecycle (only a small portion of the customers should be affected by leftover bugs when support ends, like say <5%, as others will have moved on to new products by then).
msla 7y ago
> You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Let's unpack this: You get what you pay for... yet you also say that OpenWRT solves this problem and is available free of charge. If you pay for a support contract, you get support right up to the point where the company decides to stop that support. If you have a contract worded the right way, you might be able to take the company to court over it, but if the company's willing to settle, you end up with some go-away money and an insecure router nobody's supporting. Does the money pay for next week's massive outage due to someone taking over your routers? Finally, the product as it was at time of purchase was a product fit to be sold, without major defects. In other industries, that's a standard companies are held to: If a ball joint goes out completely after 10,000 miles, Ford's kinda on the hook for that, neh? They can't say that you have the car you purchased because the car you purchased was driveable and not sitting on the side of the road.
- GTP 7y ago
  >Finally, the product as it was at time of purchase was a >product fit to be sold, without major defects If somebody later discovers a bug in the firmware that bug was present from the beginning, so this is false.
  - crankylinuxuser 7y ago
    I could consider things like catching on fire or assisting a crime (DDoS, botnet, etc) to be such cases where they absolutely should be on the hook to be required to fix. And we already have a system put in place to assess. It's called CVEs. If you exist, you should be on the hook to fix. It's called 'Being Responsible'. And corporations have a strong tendency to not want to be. That's why we need the 'stick'.
Groxx 7y ago
I expect them to not sell devices at unmaintainable price-points. You know, like tons of other safety-relevant products. Anything you plug into the wall, or put gas in, or has enough torque to hurt someone ends up going through safety checks.... except software.
djsumdog 7y ago
Kits are different. Every router kit I've seen doesn't come with any software. Some come with a blank SD card and you can load what you want on it. Here's a tutorial I wrote for one kit I got: https://battlepenguin.com/tech/using-the-banana-pi-bpi-r1-as-a-router-with-bananian/ https://battlepenguin.com/tech/using-the-banana-pi-bpi-r1-as... but then I learned the hardware itself could fail into an insecure state, and there was no way to deal with it in software: https://battlepenguin.com/tech/banana-pi-bpi-r1-fails-into-an-insecure-state/ https://battlepenguin.com/tech/banana-pi-bpi-r1-fails-into-a...
- abawany 7y ago
  I wonder if the GP meant 'kit' as in the UK-English sense, i.e. equipment and not the literal kit with no software.
nominated1 7y ago
Xiaomi sells routers in this price range that ship with OpenWrt. The buildroot even has config options for branding! It costs them nothing for the OS. It costs D-Link more to produce their mess.
- NullPrefix 7y ago
  "But how will we differentiate from the market without our \"value added\" non-standard software?"
  - nominated1 7y ago
    The same way Dell and HP do with a Windows PC. The OpenWrt buildroot can help them do that too! ;-)
- noonespecial 7y ago
  GL.iNet does the same. I use many of their offerings at home and for various projects. https://www.gl-inet.com/ https://www.gl-inet.com/
mfer 7y ago
What do I expect or what does a typical consumer expect? The folks on HN are not typical consumers of these products. Often times when defective products are sold there is some responsibility for some time to correct or notify people. Cars, child seats, and many other things fall into that. The defective devices that get updates or notifications are often safety related. Yet, safety and security are not talked about much with regard to technology. Maybe it's time to start doing that.

giancarlostoro 7y ago

There's also just you know, installing Custom Firmware if you're determined enough.

msla 7y ago
I'll never use vendor firmware again. If the router doesn't support OpenWRT, it's a time bomb waiting to go off, as this article shows; plus, of course, OpenWRT has sufficient additional functionality that that alone makes it worthwhile. And once again, we're all reminded of the divide between people who know how to do things like this and people who don't, and how the people who do know have an advantage in life.
- giancarlostoro 7y ago
  I don't usually install CFW on mine, but it's something I look for the possibility of doing in case something like this D-Link issue occurs.
- abawany 7y ago
  I bought a couple of Netgear AC1600 routers and installed DD-WRT/Kong firmware on them right away (clicked the PayPal contribution link and paid up - it is worth it). They work well and update quite frequently.
  - uptown 7y ago
    Can this model be used as a VPN server routing through your home ISP connection?
    - abawany 7y ago
      I think this router+dd-wrt supports it though I haven't personally used vpn on it. Here is the link that implies it supports it: https://www.myopenrouter.com/articles/r6300r6300v2-guides-how https://www.myopenrouter.com/articles/r6300r6300v2-guides-ho... . Some general information about the router is at: https://wiki.dd-wrt.com/wiki/index.php/Netgear_R6300v2 https://wiki.dd-wrt.com/wiki/index.php/Netgear_R6300v2 . Edit: another link: https://nordvpn.com/tutorials/dd-wrt/flashrouters-privacy-app/ https://nordvpn.com/tutorials/dd-wrt/flashrouters-privacy-ap... .

bluGill 7y ago

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update those machines, but we are not entirely sure and there is always the possibility that the legal framework could change. We have an official policy that once a recall is made, the replacement parts for a safety issue will be available forever, or until we can prove all existing machines have either been updated or scrapped. (The latter is considered impossible to prove and so there are kits available for machines that last shipped in the 1980s.) This policy has in fact protected us in lawsuits: we take safety seriously so mistakes are taken as unintentional and punitive damages don't apply. I would expect a consumer router to run without problem for not less than 10 years: they should update it to work. Now they shouldn't have to add support for the next protocol or feature, but if it isn't secure that is different and should be fixed. All it takes is a lawyer. Note that you don't have to have the affected router, just prove that an affected router is attacking you. I think there are people in IT who are able to prove this latter one so all that is left is bring it to your lawyers to get dlink to pay your costs from the attack.

tbyehl 7y ago
> I would expect a consumer router to run without problem for not less than 10 years That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.
- incompatible 7y ago
  How long do vehicle recalls last for, if something like an airbag turns out to be defective and dangerous?
  - tbyehl 7y ago
    You want to equate a consumer electronics device with an incendiary device legally mandated to be installed in every vehicle that may explode and kill people? Well, the legal answer is 10-years for a no-charge repair [0]. If D-Link routers start burning down homes I'm sure the Consumer Product Safety Commission will take an interest, but if it's more than a few years old the recommendation will likely be to throw it out and buy a replacement. [0] https://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm https://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm