6 ms·

I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.

zamadatix 5y ago
There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse. You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early. You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn't actually going to solve anything as it's not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all). You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways. . Retrospective in this particular case it would have been really great for them to fix this particular issue but that's an extremely hard thing to accurately judge unless you're from the future. I mean what percentage of devices that are many years EoL you've heard get this bad of a publicity hit? I'm sure there are many individual cases to point to but it's nothing against the absolute deluge of devices that have been discontinued over the years quietly without issue.
- andi999 5y ago
  EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.
  - Algent 5y ago
    With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.
    - andi999 5y ago
      You have a Citation? I read 5-7 years.
      - bellyfullofbac 5y ago
        Pixel XL released October 2016 (from [1]), no guaranteed updates after October 2018 [2]. I looked at the Pixel 4, released October 2019, discontinued October 2020, no guaranteed updates after October 2022... [1] https://www.gsmarena.com/google_pixel_xl-8345.php https://www.gsmarena.com/google_pixel_xl-8345.php [2] https://support.google.com/nexus/answer/4457705?hl=en#zippy=,pixel-phones https://support.google.com/nexus/answer/4457705?hl=en#zippy=...
        andi999 5y ago
        That is not at best, probably this is at worst. But thanks for the info.
        LeonidasXIV 5y ago
        In Android-land this is currently about the best actually. There is a chance of it improving over time as the updates will be decoupled from hardware support but the situation is markedly worse than on iOS.
        csnweb 5y ago
        Unfortunately the 3 guaranteed years of updates for pixels is pretty much the best in the Android world. There are very few exceptions like FairPhone reliably providing long term updates
    - 5y ago
- petertodd 5y ago
  > There's really no winning with this. There is: don't release devices with security flaws in the first place. The fact is, they released a fatally flawed device. That the flaw was discovered later doesn't change that fact. I think the way we talk about security patches and updates obscures the fact that they're correcting fundamentally flawed software. In other circumstances, this would result in product recalls. Those financial incentives are a big reason why product recalls for serious faults are fairly rare in other types of products.
  - throwawayboise 5y ago
    Product recalls are for defects that can cause physical injury. If the MyBook had an electrical defect that could cause a shock hazard or start a fire, it would have been recalled. Many products have flaws, but if the worst that can happen is that the customer feels ripped off, they don't get recalled. There might be remedies under a express or implied warranty, but tech products typically disclaim all of that in their terms of service.
    - megous 5y ago
      Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Just that attackers didn't choose to destroy a device in this instance, but just erased it, doesn't mean allowing control of all software on the device to randos on the internet, by not patching a root RCE vulnerability is not a physical safety issue.
      - OldTimeCoffee 5y ago
        > Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Having total remote control of an IoT device doesn't mean any of these things. Thermal protection is hardware driven typically on die, on cheap devices fan control is implemented in hardware because it's cheaper and easier than software solutions. Voltage regulators are hardware devices that aren't adjustable, even adjustable ones have a working range that is set via resistor. Switching power supplies aren't software driven.
- SilverRed 5y ago
  Which is why I think if we are going to do IoT, it needs to all be behind some gateway designed by a company that will maintain security for decades. Make a NAS drive which exposes everything to the gateway without bothering for authentication and then let Apple/Google/Amazon work out how to defend access to the resource. Random OEMs are unable to pull off IoT safely.
  - ale42 5y ago
    The IoT device will still be connected to a LAN/WiFi network to access that gateway. Local attacks will still be possible (imagine a flaw in the TCP/IP stack, local firewall, or anything on that direction). And if that big company gets hacked (never say never), hackers would get access to a huge amount of devices ready-to-pwn. Not even thinking then about what this would mean from a privacy/mass surveillance point of view (by those companies or by agencies infiltrating them).
    - gambiting 5y ago
      I can kind of see a device that has no ports open on the local network, and just uses an always-on ssh tunnel to HQ to receive commands. That way it's not exposed to anything on the local network, and it's the company resources that would have to be hacked first.
- ec109685 5y ago
  Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this. This is so disingenuous (from the first report of this flaw): “Western Digital takes the security of our customers’ data seriously, and we provide security updates for our products to address issues from both external reports and regular security audits.”
  - zamadatix 5y ago
    > Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this. "Winning" isn't "gee if we could just say we'll patch every discontinued product forever and imagine it had no downsides wouldn't that be great" - that's known as "dreaming".
    - ec109685 5y ago
      If a company releases an internet connected appliance, they need to support the software for at least the half-life of the underlying hardware. Having a vendor support patch releases indefinitely would not be a huge burden for Western Digital. In this case, it was obvious errors in their PHP application.

zamadatix 5y ago

There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse. You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early. You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn't actually going to solve anything as it's not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all). You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways. . Retrospective in this particular case it would have been really great for them to fix this particular issue but that's an extremely hard thing to accurately judge unless you're from the future. I mean what percentage of devices that are many years EoL you've heard get this bad of a publicity hit? I'm sure there are many individual cases to point to but it's nothing against the absolute deluge of devices that have been discontinued over the years quietly without issue.

andi999 5y ago
EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.
- Algent 5y ago
  With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.
  - andi999 5y ago
    You have a Citation? I read 5-7 years.
    - bellyfullofbac 5y ago
      Pixel XL released October 2016 (from [1]), no guaranteed updates after October 2018 [2]. I looked at the Pixel 4, released October 2019, discontinued October 2020, no guaranteed updates after October 2022... [1] https://www.gsmarena.com/google_pixel_xl-8345.php https://www.gsmarena.com/google_pixel_xl-8345.php [2] https://support.google.com/nexus/answer/4457705?hl=en#zippy=,pixel-phones https://support.google.com/nexus/answer/4457705?hl=en#zippy=...
      - andi999 5y ago
        That is not at best, probably this is at worst. But thanks for the info.
        LeonidasXIV 5y ago
        In Android-land this is currently about the best actually. There is a chance of it improving over time as the updates will be decoupled from hardware support but the situation is markedly worse than on iOS.
        csnweb 5y ago
        Unfortunately the 3 guaranteed years of updates for pixels is pretty much the best in the Android world. There are very few exceptions like FairPhone reliably providing long term updates
  - 5y ago
petertodd 5y ago
> There's really no winning with this. There is: don't release devices with security flaws in the first place. The fact is, they released a fatally flawed device. That the flaw was discovered later doesn't change that fact. I think the way we talk about security patches and updates obscures the fact that they're correcting fundamentally flawed software. In other circumstances, this would result in product recalls. Those financial incentives are a big reason why product recalls for serious faults are fairly rare in other types of products.
- throwawayboise 5y ago
  Product recalls are for defects that can cause physical injury. If the MyBook had an electrical defect that could cause a shock hazard or start a fire, it would have been recalled. Many products have flaws, but if the worst that can happen is that the customer feels ripped off, they don't get recalled. There might be remedies under a express or implied warranty, but tech products typically disclaim all of that in their terms of service.
  - megous 5y ago
    Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Just that attackers didn't choose to destroy a device in this instance, but just erased it, doesn't mean allowing control of all software on the device to randos on the internet, by not patching a root RCE vulnerability is not a physical safety issue.
    - OldTimeCoffee 5y ago
      > Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Having total remote control of an IoT device doesn't mean any of these things. Thermal protection is hardware driven typically on die, on cheap devices fan control is implemented in hardware because it's cheaper and easier than software solutions. Voltage regulators are hardware devices that aren't adjustable, even adjustable ones have a working range that is set via resistor. Switching power supplies aren't software driven.
SilverRed 5y ago
Which is why I think if we are going to do IoT, it needs to all be behind some gateway designed by a company that will maintain security for decades. Make a NAS drive which exposes everything to the gateway without bothering for authentication and then let Apple/Google/Amazon work out how to defend access to the resource. Random OEMs are unable to pull off IoT safely.
- ale42 5y ago
  The IoT device will still be connected to a LAN/WiFi network to access that gateway. Local attacks will still be possible (imagine a flaw in the TCP/IP stack, local firewall, or anything on that direction). And if that big company gets hacked (never say never), hackers would get access to a huge amount of devices ready-to-pwn. Not even thinking then about what this would mean from a privacy/mass surveillance point of view (by those companies or by agencies infiltrating them).
  - gambiting 5y ago
    I can kind of see a device that has no ports open on the local network, and just uses an always-on ssh tunnel to HQ to receive commands. That way it's not exposed to anything on the local network, and it's the company resources that would have to be hacked first.
ec109685 5y ago
Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this. This is so disingenuous (from the first report of this flaw): “Western Digital takes the security of our customers’ data seriously, and we provide security updates for our products to address issues from both external reports and regular security audits.”
- zamadatix 5y ago
  > Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this. "Winning" isn't "gee if we could just say we'll patch every discontinued product forever and imagine it had no downsides wouldn't that be great" - that's known as "dreaming".
  - ec109685 5y ago
    If a company releases an internet connected appliance, they need to support the software for at least the half-life of the underlying hardware. Having a vendor support patch releases indefinitely would not be a huge burden for Western Digital. In this case, it was obvious errors in their PHP application.