4 ms·

Fun read and great debugging but I'm honestly really sick of this kind of attitude since it's essentially arguing for more churn and for more e-waste: > There'

by Lammy 2y ago

Fun read and great debugging but I'm honestly really sick of this kind of attitude since it's essentially arguing for more churn and for more e-waste: > There's a CUPS version that's 10+ years old, Linux kernel almost old enough to drink, all of that r̶u̶n̶n̶i̶n̶g̶ crawling on an ARMv5. > but it seems that they have one specific design and they're happy to milk it for as long and as cheap as possible Like who fucking cares how old the CPU in a label printer is?

josephcsible 2y ago
How is saying "stop manufacturing new stuff that's obsolete from day 1" advocating for e-waste?
- parl_match 2y ago
  If it's an appliance, I would hardly think it's obsolete hardware if it's performing the required task. There are other issues, of course.
- LeifCarrotson 2y ago
  "Obsolete" is a word with a cultural stigma attached, which is the belief that things which are older are worse. A label printer ought to be judged on its ability to print labels first and foremost. If it is designed such that it eventually must be discarded because it is no longer good at printing labels, that should reflect poorly on it. My label printer sits next to my stapler. The stapler is a Swingline from the 70s, I think my parents gave it to me when I was in college? Regardless, it cannot really be considered obsolete, because it staples just as well as it did when it was made. The latest advances in technology do not make new staplers function any better. Similarly, my label printer has a qwerty keyboard and does not need to keep pace with modern wifi standards, as long as 12mm ink/label cartridges are available (and they have been the same since the 90s) and the NiMH battery can be recharged, it will work just as well as when it was new. The smoothness of the gradient on the CUPS internal web server is so irrelevant to the merits of the label printer that it does not deserve to be mentioned. Some printers and chart plotters are very large, very expensive machines that can nonetheless function for decades, and fortunately, the CUPS project still supports them. It's unfortunate that one of the most desirable attributes of a printer is that it supports wireless networking, and that wireless networking security standards have as much churn as they do, which causes label printers like this one to become e-waste.
parl_match 2y ago
> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.
- brudgers 2y ago
  If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work. https://www.staples.com/dymo-organizer-express-pro-industrial-portable-handheld-label-maker-up-to-0-38-w-label-size/product_564523?cid=ps:gs:dot:nb:pmax:tech&gad_source=1&gclid=Cj0KCQjws560BhCuARIsAHMqE0H7ygeMuWNHem4FVh-8s1FVwDGnWkJg1nDG-oFlHNZcVEx4SU5iEwgaAmBIEALw_wcB https://www.staples.com/dymo-organizer-express-pro-industria...
  - throwup238 2y ago
    For bonus points, it looks like a legacy Star Trek phaser or something.
  - makmanalp 2y ago
    I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!
    - brudgers 2y ago
      I didn't mean to make you feel silly, sorry. Dymo was the logical extreme of my concern regarding security architecture. What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security. There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants. Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security. My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.
RobotToaster 2y ago
You have a point, but surely there would be no cost difference in using a newer processor that would be easier to issue firmware updates for in the future, and would be more energy efficient.
- hiatus 2y ago
  > surely there would be no cost difference in using a newer processor How did you come to this conclusion?
mananaysiempre 2y ago
The age of the CPU is of little consequence, except to the extent it reflects the underlying development practices. (Imagine joining a commercial project with a first release in 2020 and discovering it uses SourceSafe.) The age of software, though, is relevant, when that software is as sprawling as a Linux install. The thing about devices with a web interface is that they will end up Internet-exposed, and the thing about weak Internet-exposed hosts is that they will be assembled into a botnet. Mirai is probably a bit atypical because surveillance cameras are perhaps more likely than others to end up exposed, but I think it’s still worth applying its lessons to other appliances as well.

by Lammy 2y ago

josephcsible 2y ago

How is saying "stop manufacturing new stuff that's obsolete from day 1" advocating for e-waste?

parl_match 2y ago
If it's an appliance, I would hardly think it's obsolete hardware if it's performing the required task. There are other issues, of course.
LeifCarrotson 2y ago
"Obsolete" is a word with a cultural stigma attached, which is the belief that things which are older are worse. A label printer ought to be judged on its ability to print labels first and foremost. If it is designed such that it eventually must be discarded because it is no longer good at printing labels, that should reflect poorly on it. My label printer sits next to my stapler. The stapler is a Swingline from the 70s, I think my parents gave it to me when I was in college? Regardless, it cannot really be considered obsolete, because it staples just as well as it did when it was made. The latest advances in technology do not make new staplers function any better. Similarly, my label printer has a qwerty keyboard and does not need to keep pace with modern wifi standards, as long as 12mm ink/label cartridges are available (and they have been the same since the 90s) and the NiMH battery can be recharged, it will work just as well as when it was new. The smoothness of the gradient on the CUPS internal web server is so irrelevant to the merits of the label printer that it does not deserve to be mentioned. Some printers and chart plotters are very large, very expensive machines that can nonetheless function for decades, and fortunately, the CUPS project still supports them. It's unfortunate that one of the most desirable attributes of a printer is that it supports wireless networking, and that wireless networking security standards have as much churn as they do, which causes label printers like this one to become e-waste.

parl_match 2y ago

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.

brudgers 2y ago
If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work. https://www.staples.com/dymo-organizer-express-pro-industrial-portable-handheld-label-maker-up-to-0-38-w-label-size/product_564523?cid=ps:gs:dot:nb:pmax:tech&gad_source=1&gclid=Cj0KCQjws560BhCuARIsAHMqE0H7ygeMuWNHem4FVh-8s1FVwDGnWkJg1nDG-oFlHNZcVEx4SU5iEwgaAmBIEALw_wcB https://www.staples.com/dymo-organizer-express-pro-industria...
- throwup238 2y ago
  For bonus points, it looks like a legacy Star Trek phaser or something.
- makmanalp 2y ago
  I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!
  - brudgers 2y ago
    I didn't mean to make you feel silly, sorry. Dymo was the logical extreme of my concern regarding security architecture. What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security. There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants. Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security. My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.

RobotToaster 2y ago

You have a point, but surely there would be no cost difference in using a newer processor that would be easier to issue firmware updates for in the future, and would be more energy efficient.

hiatus 2y ago
> surely there would be no cost difference in using a newer processor How did you come to this conclusion?

mananaysiempre 2y ago

The age of the CPU is of little consequence, except to the extent it reflects the underlying development practices. (Imagine joining a commercial project with a first release in 2020 and discovering it uses SourceSafe.) The age of software, though, is relevant, when that software is as sprawling as a Linux install. The thing about devices with a web interface is that they will end up Internet-exposed, and the thing about weak Internet-exposed hosts is that they will be assembled into a botnet. Mirai is probably a bit atypical because surveillance cameras are perhaps more likely than others to end up exposed, but I think it’s still worth applying its lessons to other appliances as well.