4 ms·

Products that rely on third party servers to function should be required to carry an expiration date that guarantees service and security patches up to that dat

Products that rely on third party servers to function should be required to carry an expiration date that guarantees service and security patches up to that date.

deleted 5y ago
[deleted]
sp332 5y ago
They still support this device and there is an OS update that closes the vulnerability. They are providing data recovery services to customers of the older devices. Would have been nice if they warned those customers about the vulnerability when they found out about it, even if the fix was to buy another $X00 product.
- ineedasername 5y ago
  there is an OS update that closes the vulnerability Not for all devices: The article indicates that some may not be compatible with OS 5 and that WD says those customers should buy a new one.
  - MrStonedOne 5y ago
    and its a full rewrite of the OS that is missing some functionality used by users.
    - naikrovek 5y ago
      who cares about missing functionality when compared with deletion of your data? surely deletion of data is worse alternative to losing the ability to theme the web UI, or whatever. this is why Microsoft has so many updates so often for Windows 10. security issues which require no intervention from the victim are VERY REAL, and when left alone, users will not update. this has been proven time and time again. A user can take no action and still be vulnerable today when they were not vulnerable yesterday. this WD instance is yet another example of users not knowing what is best for themselves; not knowing to update their devices, or to take their devices off of the internet. there are secure, free, easy-to-setup ways to access files over the internet on a NAS which does not have internet access... WD will hopefully force users to update in the future for internet connected devices, and for devices that go out of support, and can no longer receive updates, WD should take them off the internet as a final action, to protect the consumer. THIS EXACT SITUATION is why updates should be forced on users. nothing shoots itself in the foot as often or as thoroughly as a user that doesn't know what they're doing, believing they know what they're doing.
      - MrStonedOne 5y ago
        This exact situation is why users don't update.
        naikrovek 5y ago
        > This exact situation is why users don't update. users not updating CAUSED this situation. the actual blame lies on the attackers, of course, and users who do not take security updates make this type of attack possible.
        sp332 5y ago
        Vendors who make customers choose between features and security aren't helping. Removing stuff from the product and saying it's still "supported" is a little sketchy.
      - ineedasername 5y ago
        WD shouldn't be removing features that users rely on. Bundling feature loss with security updates is just bad practice. If faced with losing functionality critical to the reason someone purchased a device vs. vague release notes that mention security updates, the average consumer in many cases is going to weigh the intangible risk of security problems pretty small against the guaranteed loss of required features.
        naikrovek 5y ago
        > the average consumer in many cases is going to weigh the intangible risk of security problems pretty small against the guaranteed loss of required features. what are those lost features? do any of those lost features include the unintentional loss of data or the inability to access said data? if not, if the user can maintain access to the stuff on the NAS after a security update, they should update, because there is no NAS security update that takes away your ability to access your data. I really do wonder what these missing features are because there is zero likelihood that the ability to access the storage device itself is one of the lost features.
userbinator 5y ago
No, that's even worse. It's called planned obsolescence. Instead, along the same lines as right to repair, such products should be required to release the firmware source code.
- Frost1x 5y ago
  Planned obsolescence seems better than unplanned obsolescence? If your uniformed consumer were informed of the lifetime of the product they buy, they might not be conned into buying things your informed consumer is aware of and avoids. That's good because, as of current, when the population of uninformed consumers drive market forces, they often push out the options informed consumers would choose or at the very least, create trends towards the uninformed bias purchases that force informed consumers to start choosing the same options as well or drive up prices for the products informed consumers often buy due to lessened demand. You know, when a bunch of people decide we'll let businesses stop producing devices we can repair or put out rent-seeking price structures and the rest of people are forced to use those options, all because of large scale manipulation of consumer perception. Then we end up with markets filled with garbage with fluffy profit margins for their owners... Then again, cigarettes still have a large market somehow, so maybe we're out of luck either way.
- spideymans 5y ago
  >Instead, along the same lines as right to repair, such products should be required to release the firmware source code. Releasing the source code doesn't necessarily mean that people would be legally permitted to modify or even utilize that source code.
  - foobar33333 5y ago
    It also doesn't mean anyone will actually support it. I have plenty of devices which you can flash your own OS on but eventually the hobby community gets bored and no one is left supporting it. You also have the problem of getting every user of the product to flash some custom OS on their hard drive when they likely don't know how or don't know why they should care.
conductr 5y ago
I feel like this is implied or should be. Even if not explicit, you should know you can't get unlimited software updated into eternity which is what I believe you're saying omission of an expiration date means.
- causality0 5y ago
  Sure, I know that, but the average consumer doesn't. When an average consumer buys a thermostat for ten times what she paid for her last one she expects it to last twenty years like her last one did. When a ten year old buys a videogame he expects it to be playable until he throws it away or sells it. "People shouldn't be so naive" is not the correct response to the precipitous decline in the quality of consumer goods.
  - conductr 5y ago
    While I don't disagree with your example I would point out that caveat emptor is a core principle of commerce for quite some time. In times of rapid change/technology, the consumer doesn't know what they're buying. Before long, it will be common knowledge that "smart" everything has a cost that was not obvious to average Joe at purchase. But, Joe was also so impressed with the shiny object he didn't think about the consequences of things. Another point, in Texas, energy companies have been adjusting people's thermostats remotely when the grid is struggling. While I never thought of that specific thing, I have been anti-connecting-things-to-wifi because I know once you open it up, it's just a matter of time before someone else is mucking around with your devices. I'd totally expect it to be some script kiddies doing it for lolz instead of the electric company, but at that point, it doesn't really matter - you're not solely in control of your device.

Products that rely on third party servers to function should be required to carry an expiration date that guarantees service and security patches up to that date.

deleted 5y ago

[deleted]

sp332 5y ago

They still support this device and there is an OS update that closes the vulnerability. They are providing data recovery services to customers of the older devices. Would have been nice if they warned those customers about the vulnerability when they found out about it, even if the fix was to buy another $X00 product.

ineedasername 5y ago
there is an OS update that closes the vulnerability Not for all devices: The article indicates that some may not be compatible with OS 5 and that WD says those customers should buy a new one.
- MrStonedOne 5y ago
  and its a full rewrite of the OS that is missing some functionality used by users.
  - naikrovek 5y ago
    who cares about missing functionality when compared with deletion of your data? surely deletion of data is worse alternative to losing the ability to theme the web UI, or whatever. this is why Microsoft has so many updates so often for Windows 10. security issues which require no intervention from the victim are VERY REAL, and when left alone, users will not update. this has been proven time and time again. A user can take no action and still be vulnerable today when they were not vulnerable yesterday. this WD instance is yet another example of users not knowing what is best for themselves; not knowing to update their devices, or to take their devices off of the internet. there are secure, free, easy-to-setup ways to access files over the internet on a NAS which does not have internet access... WD will hopefully force users to update in the future for internet connected devices, and for devices that go out of support, and can no longer receive updates, WD should take them off the internet as a final action, to protect the consumer. THIS EXACT SITUATION is why updates should be forced on users. nothing shoots itself in the foot as often or as thoroughly as a user that doesn't know what they're doing, believing they know what they're doing.
    - MrStonedOne 5y ago
      This exact situation is why users don't update.
      - naikrovek 5y ago
        > This exact situation is why users don't update. users not updating CAUSED this situation. the actual blame lies on the attackers, of course, and users who do not take security updates make this type of attack possible.
        sp332 5y ago
        Vendors who make customers choose between features and security aren't helping. Removing stuff from the product and saying it's still "supported" is a little sketchy.
    - ineedasername 5y ago
      WD shouldn't be removing features that users rely on. Bundling feature loss with security updates is just bad practice. If faced with losing functionality critical to the reason someone purchased a device vs. vague release notes that mention security updates, the average consumer in many cases is going to weigh the intangible risk of security problems pretty small against the guaranteed loss of required features.
      - naikrovek 5y ago
        > the average consumer in many cases is going to weigh the intangible risk of security problems pretty small against the guaranteed loss of required features. what are those lost features? do any of those lost features include the unintentional loss of data or the inability to access said data? if not, if the user can maintain access to the stuff on the NAS after a security update, they should update, because there is no NAS security update that takes away your ability to access your data. I really do wonder what these missing features are because there is zero likelihood that the ability to access the storage device itself is one of the lost features.

userbinator 5y ago

No, that's even worse. It's called planned obsolescence. Instead, along the same lines as right to repair, such products should be required to release the firmware source code.

Frost1x 5y ago
Planned obsolescence seems better than unplanned obsolescence? If your uniformed consumer were informed of the lifetime of the product they buy, they might not be conned into buying things your informed consumer is aware of and avoids. That's good because, as of current, when the population of uninformed consumers drive market forces, they often push out the options informed consumers would choose or at the very least, create trends towards the uninformed bias purchases that force informed consumers to start choosing the same options as well or drive up prices for the products informed consumers often buy due to lessened demand. You know, when a bunch of people decide we'll let businesses stop producing devices we can repair or put out rent-seeking price structures and the rest of people are forced to use those options, all because of large scale manipulation of consumer perception. Then we end up with markets filled with garbage with fluffy profit margins for their owners... Then again, cigarettes still have a large market somehow, so maybe we're out of luck either way.
spideymans 5y ago
>Instead, along the same lines as right to repair, such products should be required to release the firmware source code. Releasing the source code doesn't necessarily mean that people would be legally permitted to modify or even utilize that source code.
- foobar33333 5y ago
  It also doesn't mean anyone will actually support it. I have plenty of devices which you can flash your own OS on but eventually the hobby community gets bored and no one is left supporting it. You also have the problem of getting every user of the product to flash some custom OS on their hard drive when they likely don't know how or don't know why they should care.

conductr 5y ago

I feel like this is implied or should be. Even if not explicit, you should know you can't get unlimited software updated into eternity which is what I believe you're saying omission of an expiration date means.

causality0 5y ago
Sure, I know that, but the average consumer doesn't. When an average consumer buys a thermostat for ten times what she paid for her last one she expects it to last twenty years like her last one did. When a ten year old buys a videogame he expects it to be playable until he throws it away or sells it. "People shouldn't be so naive" is not the correct response to the precipitous decline in the quality of consumer goods.
- conductr 5y ago
  While I don't disagree with your example I would point out that caveat emptor is a core principle of commerce for quite some time. In times of rapid change/technology, the consumer doesn't know what they're buying. Before long, it will be common knowledge that "smart" everything has a cost that was not obvious to average Joe at purchase. But, Joe was also so impressed with the shiny object he didn't think about the consequences of things. Another point, in Texas, energy companies have been adjusting people's thermostats remotely when the grid is struggling. While I never thought of that specific thing, I have been anti-connecting-things-to-wifi because I know once you open it up, it's just a matter of time before someone else is mucking around with your devices. I'd totally expect it to be some script kiddies doing it for lolz instead of the electric company, but at that point, it doesn't really matter - you're not solely in control of your device.