3 ms·

I also get the impression that the definition has shifted, though I don't recall malicious intent from the vendor/author being a part of it. Classical backdoors

by II2II 3y ago

I also get the impression that the definition has shifted, though I don't recall malicious intent from the vendor/author being a part of it. Classical backdoors include things like service accounts that were intended for the vendor, which were genuinely intended for service. Granted, those passwords were intended to be changed. (Also, that's not really appropriate for consumer grade gear though, since consumers have not received that level of support in decades and were not connected to networks when that level of service actually existed.) Either way though, I do seem to recall intention being part of the definition. Ah well. It's just a new meaning to get used to!

BobbyTables2 3y ago
They knowingly created a password less account because of their authentication system! If it isn’t a true backdoor, then it is utter stupidity and negligence! When it comes to security, why is EOL allowed by society? We don’t give 5 or 10 yr old cars a free pass to blow up or stop working without a manufacturer recall. Software is even easier to fix!
- II2II 3y ago
  The tricky part is determining how long software should be supported for, at least with respect to security updates. I'm sure that most people would agree that 5 years is insufficient. Twenty five years, many would say is too long. As for the car analogy, it is a weak comparison. First of all, the owner is expected to do some upkeep. A car is more likely to be deemed unroadworth from a lack of upkeep as it is from a design flaw or manufacturer defect. The other consideration is that the notion of secure software is a shifting target. In the case of cars, physics is a passive adversary. In the case of computer security, the adversary is active. Is software security to be judged by the security standards of when it is developed, or of when it is used? The former will catch cases like this, but will prove ineffective in the long term. The latter will bankrupt the industry.

by II2II 3y ago

BobbyTables2 3y ago

They knowingly created a password less account because of their authentication system! If it isn’t a true backdoor, then it is utter stupidity and negligence! When it comes to security, why is EOL allowed by society? We don’t give 5 or 10 yr old cars a free pass to blow up or stop working without a manufacturer recall. Software is even easier to fix!

II2II 3y ago
The tricky part is determining how long software should be supported for, at least with respect to security updates. I'm sure that most people would agree that 5 years is insufficient. Twenty five years, many would say is too long. As for the car analogy, it is a weak comparison. First of all, the owner is expected to do some upkeep. A car is more likely to be deemed unroadworth from a lack of upkeep as it is from a design flaw or manufacturer defect. The other consideration is that the notion of secure software is a shifting target. In the case of cars, physics is a passive adversary. In the case of computer security, the adversary is active. Is software security to be judged by the security standards of when it is developed, or of when it is used? The former will catch cases like this, but will prove ineffective in the long term. The latter will bankrupt the industry.