5 ms·

Even if it turns out (once this event has been fully understood) that the vendor-installed firmware "phoned home" to collect an update of sorts that led to this

Even if it turns out (once this event has been fully understood) that the vendor-installed firmware "phoned home" to collect an update of sorts that led to this?

rajamaka 3y ago
I have like 50 other pieces of software on my systems calling home whenever they want. One more for the pile I guess.
- daneel_w 3y ago
  Looking at it in a shallow way I suppose one could say that. But to me there's a great distinction between a switch/router and e.g. a smartphone or desktop browser.
  - wernercd 3y ago
    Switch/Router, IMO, is a bigger reason to have automatic pull/updates. You're looking at your phone on a day to day basis. Using your desktop. The router/switch/lightbulb/etc? All stuff that sits in the background and gets forgotten. Those things should do self maintenance - especially with zero days and issues that require updates to not be pwned the instant you connect to the www.
    - daneel_w 3y ago
      I think it's an entirely acceptable solution for non-technical users who don't know how or cannot be bothered to improve the scenario. Personally I would never run Asus/Netgear/Zyxel/etc's all-in-one router firmware on the network's edge. Probably not even on the inside of the network.
      - wernercd 3y ago
        Well depending on how you roll, I've had 2 routers - inside/outside. Guest network, IoTs, etc on the outside. Computers, Phones, Printers on the inside. Don't currently - but I also don't have many IoTs currently. Will probably return to this at some point but moved and haven't went out of my way to set it up "fancy" like. But realistically, it's definitely better for the "masses" to have stuff that just takes care of itself. Grandma don't know how to update router firmware and people like that are why stuff like Apple's "appliance" model is better than Androids more hands on approach.
        BuckRogers 3y ago
        Even some of us software developers get tired of managing all of these devices. I am not opposed to “appliances“, nor do I view it in someway diminishes my or anyone else’s elite status because we don’t want to manage and optimize eight computers for life. I do prefer Android for streaming devices, there’s just too much value added from using Android there. But I use an iPhone because I just want my phone to work. And I limit my desktop computer count to exactly one. For networking, I use Asus Merlin. I don’t use it for its flexibility or features, just for the stability which this recent news confirmed was a good idea. The only special features I even use are an OpenVPN server, and secure DNS over TLS to cover my devices that don’t support DNS over HTTPS.
jameshart 3y ago
The convenience of having a device that can phone home and update itself is far more valuable than the risk that occasionally one of those updates might cause a problem.
- daneel_w 3y ago
  We're definitely two different kinds of people. When it comes to network equipment I value control and security over that sort of convenience any day. (add.: and I don't mean "different kinds of people" in a condescending way, but that we value different aspects and have different methods for going about these things)
  - jameshart 3y ago
    So, you want to manually download an update, install it and brick your device on your own schedule?
    - daneel_w 3y ago
      Now you're just taking a silly defensive position by trivializing what I said using stupid rhetoric... I prefer to be in control over updates for network equipment, even the router in my home, reviewing changes and feedback, and to be "on the ready" in case the update does not work. I leave automatic updates for things like browsers.
      - jameshart 3y ago
        Sounds like a lot of work for something that should happen frequently and normally not cause any problems.
        daneel_w 3y ago
        It's actually not too bad in my case. All in all not that many minutes of pre-emptive effort even across a whole year. The hassle of a surprise Internet outage and having to find what/where the problem is would cost me more.
throw0101c 3y ago
> Even if it turns out (once this event has been fully understood) that the vendor-installed firmware "phoned home" to collect an update of sorts that led to this? I have auto-updates disabled.
- jojobas 3y ago
  The author claims to have had auto-updates disabled as well, surprise surprise.

Even if it turns out (once this event has been fully understood) that the vendor-installed firmware "phoned home" to collect an update of sorts that led to this?

rajamaka 3y ago

I have like 50 other pieces of software on my systems calling home whenever they want. One more for the pile I guess.

daneel_w 3y ago
Looking at it in a shallow way I suppose one could say that. But to me there's a great distinction between a switch/router and e.g. a smartphone or desktop browser.
- wernercd 3y ago
  Switch/Router, IMO, is a bigger reason to have automatic pull/updates. You're looking at your phone on a day to day basis. Using your desktop. The router/switch/lightbulb/etc? All stuff that sits in the background and gets forgotten. Those things should do self maintenance - especially with zero days and issues that require updates to not be pwned the instant you connect to the www.
  - daneel_w 3y ago
    I think it's an entirely acceptable solution for non-technical users who don't know how or cannot be bothered to improve the scenario. Personally I would never run Asus/Netgear/Zyxel/etc's all-in-one router firmware on the network's edge. Probably not even on the inside of the network.
    - wernercd 3y ago
      Well depending on how you roll, I've had 2 routers - inside/outside. Guest network, IoTs, etc on the outside. Computers, Phones, Printers on the inside. Don't currently - but I also don't have many IoTs currently. Will probably return to this at some point but moved and haven't went out of my way to set it up "fancy" like. But realistically, it's definitely better for the "masses" to have stuff that just takes care of itself. Grandma don't know how to update router firmware and people like that are why stuff like Apple's "appliance" model is better than Androids more hands on approach.
      - BuckRogers 3y ago
        Even some of us software developers get tired of managing all of these devices. I am not opposed to “appliances“, nor do I view it in someway diminishes my or anyone else’s elite status because we don’t want to manage and optimize eight computers for life. I do prefer Android for streaming devices, there’s just too much value added from using Android there. But I use an iPhone because I just want my phone to work. And I limit my desktop computer count to exactly one. For networking, I use Asus Merlin. I don’t use it for its flexibility or features, just for the stability which this recent news confirmed was a good idea. The only special features I even use are an OpenVPN server, and secure DNS over TLS to cover my devices that don’t support DNS over HTTPS.

jameshart 3y ago

The convenience of having a device that can phone home and update itself is far more valuable than the risk that occasionally one of those updates might cause a problem.

daneel_w 3y ago
We're definitely two different kinds of people. When it comes to network equipment I value control and security over that sort of convenience any day. (add.: and I don't mean "different kinds of people" in a condescending way, but that we value different aspects and have different methods for going about these things)
- jameshart 3y ago
  So, you want to manually download an update, install it and brick your device on your own schedule?
  - daneel_w 3y ago
    Now you're just taking a silly defensive position by trivializing what I said using stupid rhetoric... I prefer to be in control over updates for network equipment, even the router in my home, reviewing changes and feedback, and to be "on the ready" in case the update does not work. I leave automatic updates for things like browsers.
    - jameshart 3y ago
      Sounds like a lot of work for something that should happen frequently and normally not cause any problems.
      - daneel_w 3y ago
        It's actually not too bad in my case. All in all not that many minutes of pre-emptive effort even across a whole year. The hassle of a surprise Internet outage and having to find what/where the problem is would cost me more.

throw0101c 3y ago

> Even if it turns out (once this event has been fully understood) that the vendor-installed firmware "phoned home" to collect an update of sorts that led to this? I have auto-updates disabled.

jojobas 3y ago
The author claims to have had auto-updates disabled as well, surprise surprise.