5 ms·

If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors

If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.

core-questions 7y ago
> If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.
- aduitsis 7y ago
  Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable?
  - gaius_baltar 7y ago
    > Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable? Not just financial damage, the owners of defective routers can be targets of criminal lawsuits if their connections are used as proxies for attacks, death threats, bank fraud, etc.
- mtgx 7y ago
  It's not just "one unpatched router". It could be millions. Or millions or billions or IOT devices in the future that are unpatched. That does have the potential to create some damage if anyone takes control of them. Maybe even kill some people, if say they DDoS the V2I network for self-driving cars in the future, or a hospital network over which remote surgeries are performed, etc. I feel like this argument that "you get what you pay for" is pretty lazy. Usually, or ideally, consumer regulations are about setting standards and raising the bar. So that means that if there were strong laws for stuff like this, then the minimum router price may become $70 instead of $50 - but everyone would be reasonably protected for the large majority a device's lifecycle (only a small portion of the customers should be affected by leftover bugs when support ends, like say <5%, as others will have moved on to new products by then).
  - harry8 7y ago
    Without agreeing with this point it's a perfectly reasonable one to make. Why is it dead? Seems to be quite a bit of this sort of thing of late, new ML tools?
  - ClumsyPilot 7y ago
    It's not "you get what you pay for", even the most expensive consumer routers are out of support 2 years later.
- goblin89 7y ago
  The damage from an unpatched router can be pretty far-reaching, especially in cases where it can be exploited over Internet (not sure about this one, but some other D-Link vulnerabilities reportedly could). I find it regrettable that the architecture commonly in use does not make a clear distinction between devices for convenience and for security. It’d be crazy if in our homes the main entrance lock always came as an afterthought in the package of all the inside doors, and we didn’t have an obvious way to replace it separately on our own.
  - dsr_ 7y ago
    The front door lock is actually a bad example: in single-family houses, the front door is a social and legal signifier more than it is a security device. Smash a window; go around back; use a crowbar: the lock isn't what's keeping you out, it's designating the social expectation that you don't have a right to be there without an invitation and the legal assertion that crossing the threshold violently is a bigger crime than wandering in absently. This case is more like a golf cart being sold as a car: it's technically usable for that, but lacking any sort of safety or weather protection.
    - goblin89 7y ago
      I’m sure it depends on location, but there is the opportunistic crime—if home owners are away, probe the door to see whether it’s locked, get in and grab something if not. Routers and mass scans are somewhat similar.
- webreac 7y ago
  In an hospital, someone could die from a hacked device.
  - untog 7y ago
    I should really, really hope hospitals are not using routers like these.
    - roywiggins 7y ago
      Medical equipment more and more often has networked embedded software that can't be updated. They won't throw away a multimillion-dollar device just because it can't be upgraded from Windows XP.
      - untog 7y ago
        I'll bet they still have service agreements for those devices though, even if the software is old. Consumer routers do not have support like that.
        roywiggins 7y ago
        Oh, yes, they're usually still serviced- the systems are babied and locked down and generally taken care of, and if Microsoft releases an emergency XP patch I expect it would be applied. Still, there's a lot of old stuff floating around since medical hardware can last a lot longer than an OS support lifetime.
    - Jwarder 7y ago
      I'd expect a hospital has to have a pro-ish router due to the size of the network. However, I can easily see someone setting up some of these as a "temporary" fix just to get things working for some subnet. I totally expect some small clinics, independent doctors' offices, or EMS stations use devices like these.
    - noonespecial 7y ago
      I've worked in quite a few hospitals. I've got some really, really bad news for you.
- throwaway989898 7y ago
  You don't watch Mr. Robot do you?
aflag 7y ago
You have warranties for those, though. Also, no lives are in risk in dlink's case. It's more comparable with a shirt that falls apart after washing a few times.
- ClumsyPilot 7y ago
  If vulnerable D-link router becomes part of botnet, and attacks devices on my network?
rolltiide 7y ago
Think about why and how governments have that kind of leverage over the auto industry. There are arbitrary and discretionary licenses that have been created in response so prior issues. Licensing/certification regimes allow for almost any expansion of the role of government to those licensed, including capital requirements to resolve an issue. So first you would need a license, determine the scope of the license, who needs it, and the consequences of operating without one. Good luck
hackbinary 7y ago
>> If a car spontaneously This is false equivalence. A car is not $/£/E/50 piece of hardware.

core-questions 7y ago

> If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.

aduitsis 7y ago
Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable?
- gaius_baltar 7y ago
  > Somebody can conceivably receive significant financial damage though. Why they shouldn't be liable? Not just financial damage, the owners of defective routers can be targets of criminal lawsuits if their connections are used as proxies for attacks, death threats, bank fraud, etc.
mtgx 7y ago
It's not just "one unpatched router". It could be millions. Or millions or billions or IOT devices in the future that are unpatched. That does have the potential to create some damage if anyone takes control of them. Maybe even kill some people, if say they DDoS the V2I network for self-driving cars in the future, or a hospital network over which remote surgeries are performed, etc. I feel like this argument that "you get what you pay for" is pretty lazy. Usually, or ideally, consumer regulations are about setting standards and raising the bar. So that means that if there were strong laws for stuff like this, then the minimum router price may become $70 instead of $50 - but everyone would be reasonably protected for the large majority a device's lifecycle (only a small portion of the customers should be affected by leftover bugs when support ends, like say <5%, as others will have moved on to new products by then).
- harry8 7y ago
  Without agreeing with this point it's a perfectly reasonable one to make. Why is it dead? Seems to be quite a bit of this sort of thing of late, new ML tools?
- ClumsyPilot 7y ago
  It's not "you get what you pay for", even the most expensive consumer routers are out of support 2 years later.
goblin89 7y ago
The damage from an unpatched router can be pretty far-reaching, especially in cases where it can be exploited over Internet (not sure about this one, but some other D-Link vulnerabilities reportedly could). I find it regrettable that the architecture commonly in use does not make a clear distinction between devices for convenience and for security. It’d be crazy if in our homes the main entrance lock always came as an afterthought in the package of all the inside doors, and we didn’t have an obvious way to replace it separately on our own.
- dsr_ 7y ago
  The front door lock is actually a bad example: in single-family houses, the front door is a social and legal signifier more than it is a security device. Smash a window; go around back; use a crowbar: the lock isn't what's keeping you out, it's designating the social expectation that you don't have a right to be there without an invitation and the legal assertion that crossing the threshold violently is a bigger crime than wandering in absently. This case is more like a golf cart being sold as a car: it's technically usable for that, but lacking any sort of safety or weather protection.
  - goblin89 7y ago
    I’m sure it depends on location, but there is the opportunistic crime—if home owners are away, probe the door to see whether it’s locked, get in and grab something if not. Routers and mass scans are somewhat similar.
webreac 7y ago
In an hospital, someone could die from a hacked device.
- untog 7y ago
  I should really, really hope hospitals are not using routers like these.
  - roywiggins 7y ago
    Medical equipment more and more often has networked embedded software that can't be updated. They won't throw away a multimillion-dollar device just because it can't be upgraded from Windows XP.
    - untog 7y ago
      I'll bet they still have service agreements for those devices though, even if the software is old. Consumer routers do not have support like that.
      - roywiggins 7y ago
        Oh, yes, they're usually still serviced- the systems are babied and locked down and generally taken care of, and if Microsoft releases an emergency XP patch I expect it would be applied. Still, there's a lot of old stuff floating around since medical hardware can last a lot longer than an OS support lifetime.
  - Jwarder 7y ago
    I'd expect a hospital has to have a pro-ish router due to the size of the network. However, I can easily see someone setting up some of these as a "temporary" fix just to get things working for some subnet. I totally expect some small clinics, independent doctors' offices, or EMS stations use devices like these.
  - noonespecial 7y ago
    I've worked in quite a few hospitals. I've got some really, really bad news for you.
throwaway989898 7y ago
You don't watch Mr. Robot do you?

aflag 7y ago

You have warranties for those, though. Also, no lives are in risk in dlink's case. It's more comparable with a shirt that falls apart after washing a few times.

ClumsyPilot 7y ago
If vulnerable D-link router becomes part of botnet, and attacks devices on my network?

rolltiide 7y ago

Think about why and how governments have that kind of leverage over the auto industry. There are arbitrary and discretionary licenses that have been created in response so prior issues. Licensing/certification regimes allow for almost any expansion of the role of government to those licensed, including capital requirements to resolve an issue. So first you would need a license, determine the scope of the license, who needs it, and the consequences of operating without one. Good luck

hackbinary 7y ago

>> If a car spontaneously This is false equivalence. A car is not $/£/E/50 piece of hardware.