9 ms·

Interesting. May be i am old fashioned but shouldn't hardware appliances be designed as standalone devices that have minimal external dependencies. If there w

Interesting. May be i am old fashioned but shouldn't hardware appliances be designed as standalone devices that have minimal external dependencies. If there was no firmware update or patch applied -- the functionality of the device shouldn't change. Do all routers these days "phone home" anyway and modify settings on autopilot? Even if user has chosen to turn off updates?

vorpalhex 3y ago
Routers tend to be complex devices that have vulnerabilities. This has led to bot armies of routers. Users won't apply fixes. Therefore auto-updates became the norm.
- akira2501 3y ago
  This _was_ a bot army of routers. It just so happened that the army's orders were to do something uncoordinated and useless. You can trust the users implicitly, or you can trust ASUS implicitly. It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP.
  - derefr 3y ago
    > It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP. This would imply that the ISP has abilities to interpose between malicious traffic and the user that, with modern technologies like DNS-over-HTTP, they simply don’t have. To most ISPs (that don’t force you to install MITM CA certs), user traffic is increasingly a black box. Which means that attacker traffic can blend right in as part of said black box. The only thing that can see into the black box is the device on the end of the line.
    - akira2501 3y ago
      In most cases the device is getting it's IP information on boot by negotiation or request from the ISP. All the ISP needs is a database of blacklisted equipment and some middleware box to receive connections from insecure home devices when it detects them. It's not about catching related traffic when it occurs, more managing the immediate implications from insecure devices on the network. The ISP can see the device, it doesn't need to inspect the traffic.
jonathankoren 3y ago
I'm convinced there are now multiple generations of engineers that have no idea that it is possible to write software that doesn't require over the air updates nor telemetry. Have we all forgotten how Nest thermostats turned off the heat in the middle of January 2016 because of a botched software update? (Probably. It was hard to get Google to surface a link without a date due to so much SEO bullshit). https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-glitch-battery-dies-software-freeze.html https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-g...
- leipert 3y ago
  It’s not necessarily the engineers. Product and Leadership needs the telemetry in order to justify the expenses for their department or team or whatever and therefore justify the existence of those engineers.
- leoqa 3y ago
  If that happens just jump the low voltage to your wires. Most heat pump setups have two inputs: on/off and heat/cool via the reversing valve.
  - bombcar 3y ago
    You can even wire an old style thermostat in parallel if you want, or have it available to slot in.
    - riceart 3y ago
      Note that this doesn’t always work with smart thermostats. From first hand experience, there are some models out there that will generally work fine but will not complete booting up if one of the outputs is detected as closed.
      - bombcar 3y ago
        Yeah, in that case you can get an old thermostat that disconnects easily and wire it somewhere out of the way. (Though replacing a smart thermostat with a mercury switch one is a five minute job if you're comfortable with it.)
dahart 3y ago
That’s a totally reasonable point of view, would be nice. But, the days of fixed-function hardware are almost completely gone. These routers (and lots of electronics) are just Linux computers stuffed in small boxes, and come with a lot of the same kinds of dependencies as your desktop. As such, when a security vulnerability is discovered, for example, it’s kind-of a good idea to be able to accept a software update, and when people are discovering them in every corner of the OS and utilities and daemons they run, it suddenly makes sense from a completely practical perspective to update automatically on a regular basis, which is what most people need for their computers & phones. They all should accept and respect the ability to disable auto-updates though. Maybe this case is an exploit or something.
catminou 3y ago
Security updates is the important part. Particularly when dealing with vulnerable equipment which can be compromised and botnet malware dropped on it. A 0 day in a popular DVR/NVR or home router can lead to tens of thousands of devices that can throw a lot of heat. ISPs have been not great in this space so it's left to a small community to chase down the manufacturers to push updates out. The tragic part is for some devices - the company has gone out of business. The scary part of auto update is when a company does a bad job of it. For example: letting the auto update site domain expire or point to an IP at a hosting provider that someone might pick up and if the devices don't do proper endpoint validation folks can use it to force downloads of compromised images. All of these things have happened.
1vuio0pswjnm7 3y ago
"Do all routers these days "phone home" anyway and modify settings on autopilot?" Depends. "Homemade" routers running open source OS that computer owner can compile themselves need not "phone home" against owner intent. "Home" is the computer owner, not some company. Commercial routers running closed source OS that owner cannot edit and re-compile can be expected to try to phone home for something, IMHO. A disturbing trend certainly not started by ASUS but which seems to be infecting most hardware sold with pre-installed closed source OS.
- SixDouble5321 3y ago
  > A disturbing trend I think it's inevitable and probably not completely bad that hardware vendors are taking responsibility for vulnerabilities in their products. I know I would prefer something like that for my non-savvy people. Considering there are smart light bulbs with vulnerabilities which are years away from the landfill. The only question is which botnet will they join the next time they power cycle.

vorpalhex 3y ago

Routers tend to be complex devices that have vulnerabilities. This has led to bot armies of routers. Users won't apply fixes. Therefore auto-updates became the norm.

akira2501 3y ago
This _was_ a bot army of routers. It just so happened that the army's orders were to do something uncoordinated and useless. You can trust the users implicitly, or you can trust ASUS implicitly. It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP.
- derefr 3y ago
  > It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP. This would imply that the ISP has abilities to interpose between malicious traffic and the user that, with modern technologies like DNS-over-HTTP, they simply don’t have. To most ISPs (that don’t force you to install MITM CA certs), user traffic is increasingly a black box. Which means that attacker traffic can blend right in as part of said black box. The only thing that can see into the black box is the device on the end of the line.
  - akira2501 3y ago
    In most cases the device is getting it's IP information on boot by negotiation or request from the ISP. All the ISP needs is a database of blacklisted equipment and some middleware box to receive connections from insecure home devices when it detects them. It's not about catching related traffic when it occurs, more managing the immediate implications from insecure devices on the network. The ISP can see the device, it doesn't need to inspect the traffic.

jonathankoren 3y ago

I'm convinced there are now multiple generations of engineers that have no idea that it is possible to write software that doesn't require over the air updates nor telemetry. Have we all forgotten how Nest thermostats turned off the heat in the middle of January 2016 because of a botched software update? (Probably. It was hard to get Google to surface a link without a date due to so much SEO bullshit). https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-glitch-battery-dies-software-freeze.html https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-g...

leipert 3y ago
It’s not necessarily the engineers. Product and Leadership needs the telemetry in order to justify the expenses for their department or team or whatever and therefore justify the existence of those engineers.
leoqa 3y ago
If that happens just jump the low voltage to your wires. Most heat pump setups have two inputs: on/off and heat/cool via the reversing valve.
- bombcar 3y ago
  You can even wire an old style thermostat in parallel if you want, or have it available to slot in.
  - riceart 3y ago
    Note that this doesn’t always work with smart thermostats. From first hand experience, there are some models out there that will generally work fine but will not complete booting up if one of the outputs is detected as closed.
    - bombcar 3y ago
      Yeah, in that case you can get an old thermostat that disconnects easily and wire it somewhere out of the way. (Though replacing a smart thermostat with a mercury switch one is a five minute job if you're comfortable with it.)

dahart 3y ago

That’s a totally reasonable point of view, would be nice. But, the days of fixed-function hardware are almost completely gone. These routers (and lots of electronics) are just Linux computers stuffed in small boxes, and come with a lot of the same kinds of dependencies as your desktop. As such, when a security vulnerability is discovered, for example, it’s kind-of a good idea to be able to accept a software update, and when people are discovering them in every corner of the OS and utilities and daemons they run, it suddenly makes sense from a completely practical perspective to update automatically on a regular basis, which is what most people need for their computers & phones. They all should accept and respect the ability to disable auto-updates though. Maybe this case is an exploit or something.

catminou 3y ago

Security updates is the important part. Particularly when dealing with vulnerable equipment which can be compromised and botnet malware dropped on it. A 0 day in a popular DVR/NVR or home router can lead to tens of thousands of devices that can throw a lot of heat. ISPs have been not great in this space so it's left to a small community to chase down the manufacturers to push updates out. The tragic part is for some devices - the company has gone out of business. The scary part of auto update is when a company does a bad job of it. For example: letting the auto update site domain expire or point to an IP at a hosting provider that someone might pick up and if the devices don't do proper endpoint validation folks can use it to force downloads of compromised images. All of these things have happened.

1vuio0pswjnm7 3y ago

"Do all routers these days "phone home" anyway and modify settings on autopilot?" Depends. "Homemade" routers running open source OS that computer owner can compile themselves need not "phone home" against owner intent. "Home" is the computer owner, not some company. Commercial routers running closed source OS that owner cannot edit and re-compile can be expected to try to phone home for something, IMHO. A disturbing trend certainly not started by ASUS but which seems to be infecting most hardware sold with pre-installed closed source OS.

SixDouble5321 3y ago
> A disturbing trend I think it's inevitable and probably not completely bad that hardware vendors are taking responsibility for vulnerabilities in their products. I know I would prefer something like that for my non-savvy people. Considering there are smart light bulbs with vulnerabilities which are years away from the landfill. The only question is which botnet will they join the next time they power cycle.