3 ms·

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shippin

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.

brudgers 2y ago
If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work. https://www.staples.com/dymo-organizer-express-pro-industrial-portable-handheld-label-maker-up-to-0-38-w-label-size/product_564523?cid=ps:gs:dot:nb:pmax:tech&gad_source=1&gclid=Cj0KCQjws560BhCuARIsAHMqE0H7ygeMuWNHem4FVh-8s1FVwDGnWkJg1nDG-oFlHNZcVEx4SU5iEwgaAmBIEALw_wcB https://www.staples.com/dymo-organizer-express-pro-industria...
- throwup238 2y ago
  For bonus points, it looks like a legacy Star Trek phaser or something.
- makmanalp 2y ago
  I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!
  - brudgers 2y ago
    I didn't mean to make you feel silly, sorry. Dymo was the logical extreme of my concern regarding security architecture. What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security. There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants. Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security. My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.
    - makmanalp 2y ago
      Oh I'm sorry, I didn't mean it like that - I just meant as in feeling so excited like a child over what amounts to a manual labelmaker :-) No bad vibes at all on my end though. Very interesting about the rest though, thanks for the comment.
      - brudgers 2y ago
        They are cool and I almost bought one, that's why Dymo's were mentally at hand. Instead I bought the cheapest Brother on Amazon...it doesn't connect to the internet, just sits in a drawer. Maybe if I come across a Dymo in a thrift store, I'll have one too because they are kind of cool. Which reminds me, about 25 years ago I had a Kroy 80 in my studio. The Kroy 80 is a Dymo on steriods. https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-brochure-with-fonts/ https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-broch...
- Lammy 2y ago
  I especially love the aesthetic of the industrial ones that emboss steel or aluminum tape: https://makezine.com/article/science/tool-review-dymo-metal-embossing-tapewriter/ https://makezine.com/article/science/tool-review-dymo-metal-... “If you’ve ever used one of Dymo’s small 1/4″ or 3/8″ plastic-embossing labelmakers (and who hasn’t?) you already understand how this tool works, and how to operate it. But in terms of construction quality and durability, the Tapewriter is as far removed from those cheap plastic embossers as a Mercedes is from a Kia. It’s 10″ long, weighs almost two pounds, and is made almost entirely from cast aluminum, with steel fittings here and there, and all held together with machine screws. The only polymer in the thing, as far as I can tell, is a rubber friction coating on the internal tape drive wheels.”
ryandrake 2y ago
Not only this, but just how, during the hacking, the author noted how slipshod everything is: > Perhaps the most eyebrow-raising part of this whole adventure was seeing how messy and cluttered the base image was. Constructs like /etc/www, messy symlinks interconnecting different directories for seemingly no reason, things thrown around with zero understanding of how everything works, etc. Ancient kernel, ancient busybox, ancient vulnerable CUPS build, an authentication system that didn't really authenticate anything, vulnerabilities everywhere, and the base system just thrown together like amateur hour. I've always wanted to sit down with a Tech Lead of a product like this over coffee, and just pick his brain to understand how he considered any of this to be acceptable. I mean, do you just barely get it working one day with everything just hanging together in whatever way the last engineer left it? Then the next day the product ships, and you go home satisfied with how you did your job?
- gumby 2y ago
  > Then the next day the product ships, and you go home satisfied with how you did your job? Yes. Programming is typically a blue collar job in Japan. Making a device means design it, build it, validate it, and ship it. The factory doesn’t change anything. You don’t revisit it; if the company wants a new version you design the new device and yes, in the process grab some stuff from prior versions if you want. Obviously not every company works this way (e.g. programmers have more status at places like SCEI or Nintendo; some car companies do step parts of their designs) but if you look at most industry you’ll find it’s pretty much as I describe.

brudgers 2y ago

If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work. https://www.staples.com/dymo-organizer-express-pro-industrial-portable-handheld-label-maker-up-to-0-38-w-label-size/product_564523?cid=ps:gs:dot:nb:pmax:tech&gad_source=1&gclid=Cj0KCQjws560BhCuARIsAHMqE0H7ygeMuWNHem4FVh-8s1FVwDGnWkJg1nDG-oFlHNZcVEx4SU5iEwgaAmBIEALw_wcB https://www.staples.com/dymo-organizer-express-pro-industria...

throwup238 2y ago
For bonus points, it looks like a legacy Star Trek phaser or something.
makmanalp 2y ago
I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!
- brudgers 2y ago
  I didn't mean to make you feel silly, sorry. Dymo was the logical extreme of my concern regarding security architecture. What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security. There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants. Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security. My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.
  - makmanalp 2y ago
    Oh I'm sorry, I didn't mean it like that - I just meant as in feeling so excited like a child over what amounts to a manual labelmaker :-) No bad vibes at all on my end though. Very interesting about the rest though, thanks for the comment.
    - brudgers 2y ago
      They are cool and I almost bought one, that's why Dymo's were mentally at hand. Instead I bought the cheapest Brother on Amazon...it doesn't connect to the internet, just sits in a drawer. Maybe if I come across a Dymo in a thrift store, I'll have one too because they are kind of cool. Which reminds me, about 25 years ago I had a Kroy 80 in my studio. The Kroy 80 is a Dymo on steriods. https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-brochure-with-fonts/ https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-broch...
Lammy 2y ago
I especially love the aesthetic of the industrial ones that emboss steel or aluminum tape: https://makezine.com/article/science/tool-review-dymo-metal-embossing-tapewriter/ https://makezine.com/article/science/tool-review-dymo-metal-... “If you’ve ever used one of Dymo’s small 1/4″ or 3/8″ plastic-embossing labelmakers (and who hasn’t?) you already understand how this tool works, and how to operate it. But in terms of construction quality and durability, the Tapewriter is as far removed from those cheap plastic embossers as a Mercedes is from a Kia. It’s 10″ long, weighs almost two pounds, and is made almost entirely from cast aluminum, with steel fittings here and there, and all held together with machine screws. The only polymer in the thing, as far as I can tell, is a rubber friction coating on the internal tape drive wheels.”

ryandrake 2y ago

Not only this, but just how, during the hacking, the author noted how slipshod everything is: > Perhaps the most eyebrow-raising part of this whole adventure was seeing how messy and cluttered the base image was. Constructs like /etc/www, messy symlinks interconnecting different directories for seemingly no reason, things thrown around with zero understanding of how everything works, etc. Ancient kernel, ancient busybox, ancient vulnerable CUPS build, an authentication system that didn't really authenticate anything, vulnerabilities everywhere, and the base system just thrown together like amateur hour. I've always wanted to sit down with a Tech Lead of a product like this over coffee, and just pick his brain to understand how he considered any of this to be acceptable. I mean, do you just barely get it working one day with everything just hanging together in whatever way the last engineer left it? Then the next day the product ships, and you go home satisfied with how you did your job?

gumby 2y ago
> Then the next day the product ships, and you go home satisfied with how you did your job? Yes. Programming is typically a blue collar job in Japan. Making a device means design it, build it, validate it, and ship it. The factory doesn’t change anything. You don’t revisit it; if the company wants a new version you design the new device and yes, in the process grab some stuff from prior versions if you want. Obviously not every company works this way (e.g. programmers have more status at places like SCEI or Nintendo; some car companies do step parts of their designs) but if you look at most industry you’ll find it’s pretty much as I describe.