9 ms·

HP rushes to fix bricked printers after faulty firmware update

96 points by miles 3y ago

hyperman1 3y ago
Not so long ago, we advised the end user to patch everything as soon as possible, and depend on auto-patching as much as possible. The risk of their devices becoming hacked was much higher than the damage of software breaking, and big vendors worked on dependable patching. Now the world evolved to the point that patches shamelessly remove features or install adware. Even the big names are incompetent enough to cause damage on a regular base. Meanwhile, the internet learned to deal with botnets as a fact of living. So, assuming you live in a country where identity theft isn't much of a problem, and assuming regular and working backups are implemented, I start to wonder if it isn't time to review our best practices: Don't allow anything on the internet unless it really should (get a good enough firewall), don't run as root or administrator unless you have to, but also disable automatic updates, and do manual updates when a patch is out for 2 weeks and has proven not to cause more trouble than good. So what's your opinion? How should a non-techy deal with today's landscape?
- prepend 3y ago
  My chrome instance complains about being not up to date because I rewrote the update daemon with a zero byte file that no one has write permissions to. I did this after chrome’s auto update checker (not the actual update) pegged my cpu to 100% enough times that I rage deleted the updater. Then chrome kept rewriting it and undoing my settings to not update. It’s a risk I run but chrome lost my trust. Safari auto updates without ever causing me to notice.
- tpxl 3y ago
  Why would you ever connect a printer to the internet? Best case it should be available on LAN, and you can use a VPN if you need a wider network (ie. an office building). You should more or less _never_ update your 'dumb' devices unless there is a specific feature/bugfix you need.
  - throwaway25232 3y ago
    A printer on a LAN will often find a way out to the internet. Sure, you can firewall it if you think to do that. Another way to auto-update firmware is that the printer driver on your computer fetches the upgrade (your PC can certainly get to the internet) and then installs it on the printer.
  - hyperman1 3y ago
    It's hard to stop sometimes. The printer driver might auto-update via windows, so a next print job auto-uploads new firmware.
  - macNchz 3y ago
    The latest HP models require always-on internet or they will refuse to print.
  - tenebrisalietum 3y ago
    For all in ones that have a scanner, it's used to support scan to email without involving a PC.
    - yjftsjthsd-h 3y ago
      I gotta tell you, I would be more worried about giving these things live email credentials than I would be about them spontaneously bricking.
      - tenebrisalietum 3y ago
        Well you would be dumb to give it anything but unique per-device credentials to a working SSL-enabled SMTP server. For non-techy home or SOHO users, they're likely using smtp.gmail.com with their gmail creds though. Would not be unresonable to dedicate a gmail account just for scan to email IMHO.
        yjftsjthsd-h 3y ago
        > For non-techy home or SOHO users, they're likely using smtp.gmail.com with their gmail creds though. That's exactly what I'm worried about. Obviously there are ways to do it safely (and gmail actually I think might even force them), but I have very low expectations of a lot of the userbase (not a dig at them: the tech isn't exactly set up to make the easy thing safe).
- pxmpxm 3y ago
  On every new windows 11 box of mine, I spend around 4-5 hours setting it up in a way to prevent any phone-home or auto-update. Group policies, deleting things, setting up fake domain controllers etc. Preposterous amount of time spent to make sure I don't end up with "bing discover" feature that some product manager rammed through into the Edge or reset my settings because microsoft reaaaaly wants my new tab page for ad revenue. Oh look latest windows release has "microsoft rewards" in every frequently-viewed UX component; wonderful. There's an army of CVE bros cargo-culting bullshit like "it doesn't work if it's not auto up to date", when the reality is the product doesn't work if the latest upgrade breaks my workflow or I have to stop what I'm doing and spend a bunch of time undoing whatever new "feature" got added for user-adverse but revenue positive purposes. I don't think I've seen an update in the last 5 or so years that didn't try to turn a thing that I own into a grocery checkout aisle for other stuff that I should own. My HP printer sits behind a NAT and a firewall and the firmware has been feature-complete since they built the stupid thing. The only thing you get with upgrades is operational risk; hedging imaginary "someone's gonna p0wn it" problems is the security equivalent of the $5 wrench XKCD.
  - nobodyandproud 3y ago
    All that work to keep your own property from being weaponized against you. Richard Stallman’s positions on software seem less extreme every year. Ask 1990s or 2000s me, and I’d say he was interesting but “out there”. Now, I’m thinking he was just 30-40 years ahead of his time.
    - hosh 3y ago
      Same. r/StallmanWasRight I see the big fight now is over AI. The talk is over AI ethics and safety … but can we honestly entrust that to Big Tech?
      - tourmalinetaco 3y ago
        Of course not. The unfortunate reality is on average the larger something is the less it sees you as a person. Any large organization sees us all as walking billfolds. If they don’t see us as human, how can they keep AI ethical or safe? The reality is they simply cannot, and won’t. While safety will (probably) be assured, because unsafe products bring lawsuits, unethical products that extort customers for money are apparently perfectly legal. We see this in pharmaceuticals, processed foods, and of course Big Tech.
- gambiting 3y ago
  I disable all auto updates on my mum's phones and my own as well - the pain of dealing with features being removed/moved/renamed, interfaces being redesigned and unexpected changes is far greater than the absolutely miniscule risk of being hacked. I hate with absolute passion how an "update" to my phone can change its entire interface to the point where I have to re-learn common usage patterns. Google apps especially are the worst at this. It should be exactly like the day I bought it, I used to think that OTA updates are the best thing ever - now I've grown to loathe them.
  - smabie 3y ago
    You think apps should never change their interface.. ever?
    - gambiting 3y ago
      I think Google especially does it way too often. But I think to maybe make my argument more precise - I think it's fine if apps do iterative improvement of the interface. But what I see way too much of is "we've rolled out the new version of our interface, enjoy!" and they completely changed the theme, button positioning, names of functions, half of the old stuff is missing.....and that's just it, you have no recourse, no way to roll back other than installing dodgy APKs from somewhere. To give a simple example - TP-Link had a very well designed Kasa app for their smart devices, one day a new interface rolled out, breaking my presets, the interface is dog poop, some functionalty is actually missing - I sent them a long email explaining all of this, they just said "thanks, we'll think about it" and nothing happened. So yes, in that case I'd rather that this app literally never ever changed - there was nothing wrong with it, but of course some designer somewhere has to justify their continious employment so they roll out these interface changes to basically have a job. I'm sick of it.
- lisper 3y ago
  I never enable auto-update. It's just obviously a gaping vulnerability. It effectively delegates your security to a third party, so any vulnerability or incompetence in the third party becomes your vulnerability. You are effectively signing up to be a beta tester. No. Just, no.
- reaperman 3y ago
  [dead]
- waboremo 3y ago
  >assuming you live in a country where identity theft isn't much of a problem, and assuming regular and working backups are implemented These are gigantic assumptions. I am not exaggerating when I say gigantic. Identity theft alone is hitting record highs in the EU in both percentage affected and money exploited. The other problem is we tend to offer advice that is so vague it might as well be harmful. What does it mean for a patch to be proven to not cause more trouble? How does one prove a working backup? List goes on. We wind up giving so much of this nice sounding but useless advice that we confuse people. Even techies! You see it on HN all the time, bad/mediocre advice passed around and internalized, things regurgitated because it sounds good not because it's what will keep your data safe. When advice is so horrible even techies wind up reverting to the most simplistic solution possible, that's a very clear sign we are doing a horrific job!
  - hyperman1 3y ago
    I'd like to hear more about what you know of EU identity theft. Specifically as I am from Belgium, my bank is protected with 2FA and my eID identity card should protect me from criminals creating contracts on my name. While probably not bulletproof, I can't really name recent common identity theft troubles. Most damage seems to happen by providing the android/apple/steam/... stores direct access to your bank account or identity, so AFAIK the main advice here is: don't. Also: What is your alternative? I hate my own post above, but can't really think of anything better.
    - waboremo 3y ago
      Without severe expansion of data privacy laws universally, most of my alternatives fall short. I can tell somebody to use 2FA and to be selective about their data, but what good does that do when companies are barely complying with GDPR as is? Our solutions are mostly to know bad things will happen and to have it affect as little as possible so you only have to change one password/account. Bleak. It's disappointing in a way, we could do so much better; substantially improved data privacy laws and mandatory e2e encryption would be great first steps, but they would enrage the very same corporations (like HP) that pull off this nonsensical garbage that puts us all at jeopardy. They keep pushing all these tracking services updates to those to restrict use and enforce sales, we can't handle this by just telling people to update less because eventually other companies will start adopting those policies if it results in increased ad revenue. I also don't think your post is to be hated, it is not bad and is actually important in getting people on board with the idea of mass reinvention of digital services. We can't get there until we all accept that digital life currently is just far too invasive and we need better regulation before we can even start to work on personal advice. Such personal advice from Telekom[1] as an example, most of it sounds good but doesn't actually work in reality due to how weak our data privacy laws are. [1] https://www.telekom.com/en/company/data-privacy-and-security/digitally-secure/details/protect-yourself-from-identity-theft-543564 https://www.telekom.com/en/company/data-privacy-and-security...
- mschuster91 3y ago
  > Don't allow anything on the internet unless it really should (get a good enough firewall) Even that isn't enough, many a botnet has employed lateral movement inside a network.
- TheRealWatson 3y ago
  >do manual updates when a patch is out for two weeks. Manufacturers will simply ship dormant changes that wake up a month after deployed.
  - CamperBob2 3y ago
    In some cases that'd be fine -- namely, if they used the extra time to extend the QA process. Of course we all know it wouldn't work that way.
- Prickle 3y ago
  I've always waited at least two weeks to a month before installing any windows update. I've had two laptops bricked by faulty windows 10 updates in the past. I've gone through the whole gauntlet of people trying to gaslight me with statements such as "It is impossible for a windows update to brick your computer, or get stuck in an infinite updating loop." I advise pretty much everyone I know to avoid updating important software automatically. Updates for critical software or hardware should only be done to a specific version that has been out for at least a month. Even then, always check multiple sources to ensure it won't introduce something unwieldy. But of course, that gets a bit tedious for some people. So generally I only apply it to non-security updates, hoping and praying Microsoft hasn't screwed the pooch again with one of those. (Which has happened in the past.)
- Am4TIfIsER0ppos 3y ago
  > How should a non-techy deal with today's landscape? Throw away any tool you do not know how to use. Get off the internet. Get off the computer. Revert 30 years (or more) of progress because we clearly went wrong somewhere.
ProjectArcturis 3y ago
I have no idea why anyone would buy an HP printer in the first place. The company is pretty much built entirely out of dark patterns ("You want to print a black and white document? Not while your magenta ink is low! Better buy a new ink pack. Or a new printer, they cost about the same.") I've had much better experience with Brother.
- nobodyandproud 3y ago
  I heard Brother is following the same dark pattern. Is the company aware of why they’re so loved/respected these days?
  - woliveirajr 3y ago
    Canon printers are the only ones that gave me peace of mind. I avoid everything from HP and everything from the top 3 brands as default.
  - deaddabe 3y ago
    Do you have a source or a link? From my experience Brother is the best brand of printers that I have worked with (monochrome, laser).
    - josephcsible 3y ago
      https://news.ycombinator.com/item?id=31860131 https://news.ycombinator.com/item?id=31860131
  - plussed_reader 3y ago
    I would love to know the source of this uttering.
- duxup 3y ago
  I've had "better" experiences with Brother, but it still seems to suffer from being a printer in the ecosystem of "printer hell". My Brother printer no matter what I do likes to go into this deep sleep mode that may as well be powered off, nothing wakes it up, power cycle and it drops right back into deep sleep immediately.... The software for it is bulky, wants to run on my PC all the time (why?). Is it better than an HP printer, yeah probably in some sense, but the landscape of printers all being a pain is still true. I don't have a functional printer right now. I need one ... but I keep procrastinating buying one. I just don't want to deal with it.
voakbasda 3y ago
First they brick machines on purpose by requiring on-brand ink. Now this? I hope they are sued. Repeatedly.
- nikanj 3y ago
  No point in suing them unless you have more cash for lawyers than HP does. And you probably don’t.
  - yjftsjthsd-h 3y ago
    Surely that's what small claims is for?
- crazygringo 3y ago
  No they didn't. I'm not defending HP at all, but let's stick to facts. HP didn't brick any machines because of ink choice. They prevented them from working with off-brand ink, but the printers worked properly again once HP ink was inserted. "Bricking" is permanent, but the ink thing wasn't. "Bricking" was a disappointingly widespread misconception in the thread from 7 days ago: https://news.ycombinator.com/item?id=35931468 https://news.ycombinator.com/item?id=35931468 Again, I'm not condoning the ink thing at all, but "bricking" is not what was happening. HP is already bad enough, we don't need to spread false information on top of it.
  - yjftsjthsd-h 3y ago
    I dunno, I think preventing it from functioning - even "temporarily" until the ransom is paid - qualifies as a soft brick.
    - crazygringo 3y ago
      There's no such thing as a "soft brick". To paraphrase one of the replies to the comment I linked to stated, calling something a "soft brick" makes as much sense as calling something a "soft pregnancy". It either is or it isn't.
jonathantf2 3y ago
I'm dealing with quite a few of these at work, HP claim they're going to fix it remotely but whenever I've seen this error before the printer is toast. (usually only about a month outside of the warranty period, make of that what you will) They're not going to replace it because there's a fix coming "soon"
- swarnie 3y ago
  I've seen the same alert for a trio of HP printers on my network go up-down-up-down all week, really does flood your inbox after a while. This might explain it.
indigodaddy 3y ago
A couple of months ago I changed the default gateway on my older HP Laserjet to some nonsense IP. Is that enough to prevent FW updates or can an update be “sent” thru Windows software/drivers or just over the network (eg without the printer itself having to do the downloading directly)
- junon 3y ago
  If it's connected to a windows machine there's a chance that they push out a firmware update through windows update, yes. It's happened before.
NoZebra120vClip 3y ago
I disabled auto-updates for my router. I also didn't bother setting a calendar reminder to check manually for updates and apply them. My router was compromised last week, 2 months after the latest firmware update was released.
- themodelplumber 3y ago
  Bummer. What did the compromise look like from your end?
  - NoZebra120vClip 3y ago
    Spewing weird and disturbing DNS queries. I only noticed because it was configured for NextDNS. Shodan tells me it was 53/udp dnsmasq, recursive.
- deleted 3y ago
  [deleted]
zvmaz 3y ago
Framework hinted several times that they could be doing printers [1]. That would be nice. [1] https://twitter.com/search?q=printer+from%3AFrameworkPuter&f=top https://twitter.com/search?q=printer+from%3AFrameworkPuter&f...
- eastbound 3y ago
  That looks like a potential overnight success. Everyone including my grandparents understand the problem with printers, inks and strange software they require to install, so the problem-space is well publicized.
  - Gigachad 3y ago
    The market for printers is dying though. These days I don’t know anyone who actually owns a printer. It just makes way more sense to use shared/commercial printing services.
crazygringo 3y ago
Regardless of HP's actions to fix this, I'm curious what the law in the US and/or EU says about this. If you have any kind of electronic device that gets bricked by the manufacturer via firmware update after warranty. If the manufacturer decides to just do nothing (unlike HP which is trying to fix things here), what happens? Do customers have no recourse? Or do they sue the company individually? Or does it become a class-action suit? Or does it not go through the courts at all, but is there a regulatory body that fines the company for the value of the devices plus a punitive fine, and then distributes money or replacement devices to affected consumers? Not asking what should be done morally, but what the law actually says?
- asvitkine 3y ago
  I mean, presumably if the actions of a company resulted in material damage (e.g. in this case losing a printer), you can sue them and the court then issue a judgement against them to compensate the losses. And if it happens to a lot of people at the same time, it can be a class action.
- jacquesm 3y ago
  I can see a bit of a problem with the whole idea of interfering with a good after it has been sold. It negates the original sale to some extent because the person that bough the goods did what they could to make an informed choice at the time and the manufacturer retro-actively changes the deal. That negates basic contract law to a degree that I think that it already is illegal.

96 points by miles 3y ago

Not so long ago, we advised the end user to patch everything as soon as possible, and depend on auto-patching as much as possible. The risk of their devices becoming hacked was much higher than the damage of software breaking, and big vendors worked on dependable patching. Now the world evolved to the point that patches shamelessly remove features or install adware. Even the big names are incompetent enough to cause damage on a regular base. Meanwhile, the internet learned to deal with botnets as a fact of living. So, assuming you live in a country where identity theft isn't much of a problem, and assuming regular and working backups are implemented, I start to wonder if it isn't time to review our best practices: Don't allow anything on the internet unless it really should (get a good enough firewall), don't run as root or administrator unless you have to, but also disable automatic updates, and do manual updates when a patch is out for 2 weeks and has proven not to cause more trouble than good. So what's your opinion? How should a non-techy deal with today's landscape?

prepend 3y ago
My chrome instance complains about being not up to date because I rewrote the update daemon with a zero byte file that no one has write permissions to. I did this after chrome’s auto update checker (not the actual update) pegged my cpu to 100% enough times that I rage deleted the updater. Then chrome kept rewriting it and undoing my settings to not update. It’s a risk I run but chrome lost my trust. Safari auto updates without ever causing me to notice.
tpxl 3y ago
Why would you ever connect a printer to the internet? Best case it should be available on LAN, and you can use a VPN if you need a wider network (ie. an office building). You should more or less _never_ update your 'dumb' devices unless there is a specific feature/bugfix you need.
- throwaway25232 3y ago
  A printer on a LAN will often find a way out to the internet. Sure, you can firewall it if you think to do that. Another way to auto-update firmware is that the printer driver on your computer fetches the upgrade (your PC can certainly get to the internet) and then installs it on the printer.
- hyperman1 3y ago
  It's hard to stop sometimes. The printer driver might auto-update via windows, so a next print job auto-uploads new firmware.
- macNchz 3y ago
  The latest HP models require always-on internet or they will refuse to print.
- tenebrisalietum 3y ago
  For all in ones that have a scanner, it's used to support scan to email without involving a PC.
  - yjftsjthsd-h 3y ago
    I gotta tell you, I would be more worried about giving these things live email credentials than I would be about them spontaneously bricking.
    - tenebrisalietum 3y ago
      Well you would be dumb to give it anything but unique per-device credentials to a working SSL-enabled SMTP server. For non-techy home or SOHO users, they're likely using smtp.gmail.com with their gmail creds though. Would not be unresonable to dedicate a gmail account just for scan to email IMHO.
      - yjftsjthsd-h 3y ago
        > For non-techy home or SOHO users, they're likely using smtp.gmail.com with their gmail creds though. That's exactly what I'm worried about. Obviously there are ways to do it safely (and gmail actually I think might even force them), but I have very low expectations of a lot of the userbase (not a dig at them: the tech isn't exactly set up to make the easy thing safe).
pxmpxm 3y ago
On every new windows 11 box of mine, I spend around 4-5 hours setting it up in a way to prevent any phone-home or auto-update. Group policies, deleting things, setting up fake domain controllers etc. Preposterous amount of time spent to make sure I don't end up with "bing discover" feature that some product manager rammed through into the Edge or reset my settings because microsoft reaaaaly wants my new tab page for ad revenue. Oh look latest windows release has "microsoft rewards" in every frequently-viewed UX component; wonderful. There's an army of CVE bros cargo-culting bullshit like "it doesn't work if it's not auto up to date", when the reality is the product doesn't work if the latest upgrade breaks my workflow or I have to stop what I'm doing and spend a bunch of time undoing whatever new "feature" got added for user-adverse but revenue positive purposes. I don't think I've seen an update in the last 5 or so years that didn't try to turn a thing that I own into a grocery checkout aisle for other stuff that I should own. My HP printer sits behind a NAT and a firewall and the firmware has been feature-complete since they built the stupid thing. The only thing you get with upgrades is operational risk; hedging imaginary "someone's gonna p0wn it" problems is the security equivalent of the $5 wrench XKCD.
- nobodyandproud 3y ago
  All that work to keep your own property from being weaponized against you. Richard Stallman’s positions on software seem less extreme every year. Ask 1990s or 2000s me, and I’d say he was interesting but “out there”. Now, I’m thinking he was just 30-40 years ahead of his time.
  - hosh 3y ago
    Same. r/StallmanWasRight I see the big fight now is over AI. The talk is over AI ethics and safety … but can we honestly entrust that to Big Tech?
    - tourmalinetaco 3y ago
      Of course not. The unfortunate reality is on average the larger something is the less it sees you as a person. Any large organization sees us all as walking billfolds. If they don’t see us as human, how can they keep AI ethical or safe? The reality is they simply cannot, and won’t. While safety will (probably) be assured, because unsafe products bring lawsuits, unethical products that extort customers for money are apparently perfectly legal. We see this in pharmaceuticals, processed foods, and of course Big Tech.
gambiting 3y ago
I disable all auto updates on my mum's phones and my own as well - the pain of dealing with features being removed/moved/renamed, interfaces being redesigned and unexpected changes is far greater than the absolutely miniscule risk of being hacked. I hate with absolute passion how an "update" to my phone can change its entire interface to the point where I have to re-learn common usage patterns. Google apps especially are the worst at this. It should be exactly like the day I bought it, I used to think that OTA updates are the best thing ever - now I've grown to loathe them.
- smabie 3y ago
  You think apps should never change their interface.. ever?
  - gambiting 3y ago
    I think Google especially does it way too often. But I think to maybe make my argument more precise - I think it's fine if apps do iterative improvement of the interface. But what I see way too much of is "we've rolled out the new version of our interface, enjoy!" and they completely changed the theme, button positioning, names of functions, half of the old stuff is missing.....and that's just it, you have no recourse, no way to roll back other than installing dodgy APKs from somewhere. To give a simple example - TP-Link had a very well designed Kasa app for their smart devices, one day a new interface rolled out, breaking my presets, the interface is dog poop, some functionalty is actually missing - I sent them a long email explaining all of this, they just said "thanks, we'll think about it" and nothing happened. So yes, in that case I'd rather that this app literally never ever changed - there was nothing wrong with it, but of course some designer somewhere has to justify their continious employment so they roll out these interface changes to basically have a job. I'm sick of it.
lisper 3y ago
I never enable auto-update. It's just obviously a gaping vulnerability. It effectively delegates your security to a third party, so any vulnerability or incompetence in the third party becomes your vulnerability. You are effectively signing up to be a beta tester. No. Just, no.
reaperman 3y ago
[dead]
waboremo 3y ago
>assuming you live in a country where identity theft isn't much of a problem, and assuming regular and working backups are implemented These are gigantic assumptions. I am not exaggerating when I say gigantic. Identity theft alone is hitting record highs in the EU in both percentage affected and money exploited. The other problem is we tend to offer advice that is so vague it might as well be harmful. What does it mean for a patch to be proven to not cause more trouble? How does one prove a working backup? List goes on. We wind up giving so much of this nice sounding but useless advice that we confuse people. Even techies! You see it on HN all the time, bad/mediocre advice passed around and internalized, things regurgitated because it sounds good not because it's what will keep your data safe. When advice is so horrible even techies wind up reverting to the most simplistic solution possible, that's a very clear sign we are doing a horrific job!
- hyperman1 3y ago
  I'd like to hear more about what you know of EU identity theft. Specifically as I am from Belgium, my bank is protected with 2FA and my eID identity card should protect me from criminals creating contracts on my name. While probably not bulletproof, I can't really name recent common identity theft troubles. Most damage seems to happen by providing the android/apple/steam/... stores direct access to your bank account or identity, so AFAIK the main advice here is: don't. Also: What is your alternative? I hate my own post above, but can't really think of anything better.
  - waboremo 3y ago
    Without severe expansion of data privacy laws universally, most of my alternatives fall short. I can tell somebody to use 2FA and to be selective about their data, but what good does that do when companies are barely complying with GDPR as is? Our solutions are mostly to know bad things will happen and to have it affect as little as possible so you only have to change one password/account. Bleak. It's disappointing in a way, we could do so much better; substantially improved data privacy laws and mandatory e2e encryption would be great first steps, but they would enrage the very same corporations (like HP) that pull off this nonsensical garbage that puts us all at jeopardy. They keep pushing all these tracking services updates to those to restrict use and enforce sales, we can't handle this by just telling people to update less because eventually other companies will start adopting those policies if it results in increased ad revenue. I also don't think your post is to be hated, it is not bad and is actually important in getting people on board with the idea of mass reinvention of digital services. We can't get there until we all accept that digital life currently is just far too invasive and we need better regulation before we can even start to work on personal advice. Such personal advice from Telekom[1] as an example, most of it sounds good but doesn't actually work in reality due to how weak our data privacy laws are. [1] https://www.telekom.com/en/company/data-privacy-and-security/digitally-secure/details/protect-yourself-from-identity-theft-543564 https://www.telekom.com/en/company/data-privacy-and-security...
mschuster91 3y ago
> Don't allow anything on the internet unless it really should (get a good enough firewall) Even that isn't enough, many a botnet has employed lateral movement inside a network.
TheRealWatson 3y ago
>do manual updates when a patch is out for two weeks. Manufacturers will simply ship dormant changes that wake up a month after deployed.
- CamperBob2 3y ago
  In some cases that'd be fine -- namely, if they used the extra time to extend the QA process. Of course we all know it wouldn't work that way.
Prickle 3y ago
I've always waited at least two weeks to a month before installing any windows update. I've had two laptops bricked by faulty windows 10 updates in the past. I've gone through the whole gauntlet of people trying to gaslight me with statements such as "It is impossible for a windows update to brick your computer, or get stuck in an infinite updating loop." I advise pretty much everyone I know to avoid updating important software automatically. Updates for critical software or hardware should only be done to a specific version that has been out for at least a month. Even then, always check multiple sources to ensure it won't introduce something unwieldy. But of course, that gets a bit tedious for some people. So generally I only apply it to non-security updates, hoping and praying Microsoft hasn't screwed the pooch again with one of those. (Which has happened in the past.)
Am4TIfIsER0ppos 3y ago
> How should a non-techy deal with today's landscape? Throw away any tool you do not know how to use. Get off the internet. Get off the computer. Revert 30 years (or more) of progress because we clearly went wrong somewhere.

ProjectArcturis 3y ago

I have no idea why anyone would buy an HP printer in the first place. The company is pretty much built entirely out of dark patterns ("You want to print a black and white document? Not while your magenta ink is low! Better buy a new ink pack. Or a new printer, they cost about the same.") I've had much better experience with Brother.

nobodyandproud 3y ago
I heard Brother is following the same dark pattern. Is the company aware of why they’re so loved/respected these days?
- woliveirajr 3y ago
  Canon printers are the only ones that gave me peace of mind. I avoid everything from HP and everything from the top 3 brands as default.
- deaddabe 3y ago
  Do you have a source or a link? From my experience Brother is the best brand of printers that I have worked with (monochrome, laser).
  - josephcsible 3y ago
    https://news.ycombinator.com/item?id=31860131 https://news.ycombinator.com/item?id=31860131
- plussed_reader 3y ago
  I would love to know the source of this uttering.
duxup 3y ago
I've had "better" experiences with Brother, but it still seems to suffer from being a printer in the ecosystem of "printer hell". My Brother printer no matter what I do likes to go into this deep sleep mode that may as well be powered off, nothing wakes it up, power cycle and it drops right back into deep sleep immediately.... The software for it is bulky, wants to run on my PC all the time (why?). Is it better than an HP printer, yeah probably in some sense, but the landscape of printers all being a pain is still true. I don't have a functional printer right now. I need one ... but I keep procrastinating buying one. I just don't want to deal with it.

voakbasda 3y ago

First they brick machines on purpose by requiring on-brand ink. Now this? I hope they are sued. Repeatedly.

nikanj 3y ago
No point in suing them unless you have more cash for lawyers than HP does. And you probably don’t.
- yjftsjthsd-h 3y ago
  Surely that's what small claims is for?
crazygringo 3y ago
No they didn't. I'm not defending HP at all, but let's stick to facts. HP didn't brick any machines because of ink choice. They prevented them from working with off-brand ink, but the printers worked properly again once HP ink was inserted. "Bricking" is permanent, but the ink thing wasn't. "Bricking" was a disappointingly widespread misconception in the thread from 7 days ago: https://news.ycombinator.com/item?id=35931468 https://news.ycombinator.com/item?id=35931468 Again, I'm not condoning the ink thing at all, but "bricking" is not what was happening. HP is already bad enough, we don't need to spread false information on top of it.
- yjftsjthsd-h 3y ago
  I dunno, I think preventing it from functioning - even "temporarily" until the ransom is paid - qualifies as a soft brick.
  - crazygringo 3y ago
    There's no such thing as a "soft brick". To paraphrase one of the replies to the comment I linked to stated, calling something a "soft brick" makes as much sense as calling something a "soft pregnancy". It either is or it isn't.

jonathantf2 3y ago

I'm dealing with quite a few of these at work, HP claim they're going to fix it remotely but whenever I've seen this error before the printer is toast. (usually only about a month outside of the warranty period, make of that what you will) They're not going to replace it because there's a fix coming "soon"

swarnie 3y ago
I've seen the same alert for a trio of HP printers on my network go up-down-up-down all week, really does flood your inbox after a while. This might explain it.

indigodaddy 3y ago

A couple of months ago I changed the default gateway on my older HP Laserjet to some nonsense IP. Is that enough to prevent FW updates or can an update be “sent” thru Windows software/drivers or just over the network (eg without the printer itself having to do the downloading directly)

junon 3y ago
If it's connected to a windows machine there's a chance that they push out a firmware update through windows update, yes. It's happened before.

NoZebra120vClip 3y ago

I disabled auto-updates for my router. I also didn't bother setting a calendar reminder to check manually for updates and apply them. My router was compromised last week, 2 months after the latest firmware update was released.

themodelplumber 3y ago
Bummer. What did the compromise look like from your end?
- NoZebra120vClip 3y ago
  Spewing weird and disturbing DNS queries. I only noticed because it was configured for NextDNS. Shodan tells me it was 53/udp dnsmasq, recursive.
deleted 3y ago
[deleted]

zvmaz 3y ago

Framework hinted several times that they could be doing printers [1]. That would be nice. [1] https://twitter.com/search?q=printer+from%3AFrameworkPuter&f=top https://twitter.com/search?q=printer+from%3AFrameworkPuter&f...

eastbound 3y ago
That looks like a potential overnight success. Everyone including my grandparents understand the problem with printers, inks and strange software they require to install, so the problem-space is well publicized.
- Gigachad 3y ago
  The market for printers is dying though. These days I don’t know anyone who actually owns a printer. It just makes way more sense to use shared/commercial printing services.

crazygringo 3y ago

Regardless of HP's actions to fix this, I'm curious what the law in the US and/or EU says about this. If you have any kind of electronic device that gets bricked by the manufacturer via firmware update after warranty. If the manufacturer decides to just do nothing (unlike HP which is trying to fix things here), what happens? Do customers have no recourse? Or do they sue the company individually? Or does it become a class-action suit? Or does it not go through the courts at all, but is there a regulatory body that fines the company for the value of the devices plus a punitive fine, and then distributes money or replacement devices to affected consumers? Not asking what should be done morally, but what the law actually says?

asvitkine 3y ago
I mean, presumably if the actions of a company resulted in material damage (e.g. in this case losing a printer), you can sue them and the court then issue a judgement against them to compensate the losses. And if it happens to a lot of people at the same time, it can be a class action.
jacquesm 3y ago
I can see a bit of a problem with the whole idea of interfering with a good after it has been sold. It negates the original sale to some extent because the person that bough the goods did what they could to make an informed choice at the time and the manufacturer retro-actively changes the deal. That negates basic contract law to a degree that I think that it already is illegal.