3 ms·

Or the upload to their CDN was truncated or corrupted, and the signature check worked as designed. But let's not let an opportunity to paint Dell as some evil

Or the upload to their CDN was truncated or corrupted, and the signature check worked as designed. But let's not let an opportunity to paint Dell as some evil yet incompetent corporation slip through our fingers.

zdragnar 2y ago
Surely for something so important, they'd verify it rather than let it sit around for the public to point out. At a minimum this is definitely a process failure due to incompetence.
- likeabatterycar 2y ago
  Maybe it was file system corruption, who knows? "Dell is posting unsigned update executables" is a loaded statement that implies this was intentional. Dell has been signing updates since before most infosec engineers were in middle school ogling cheerleaders. It's alarmist and highly unlikely this was intentional.
  - dumpsterdiver 2y ago
    That still wouldn’t excuse that someone clearly didn’t verify their work. No matter what the reason, ownership of this task was released before it should have been.
    - likeabatterycar 2y ago
      You have no evidence of that not happening. It could be corruption after the fact or failure during replication. The armchair wolves already smell blood and are assigning blame before a postmortem has even begun.
      - muppetman 2y ago
        You're right. A headline of "Dell's website is serving up unsigned updates" would be correct. But to garner more clicks and hype that's not how they've worded their tweet, instead it's worded to make it sound like Dell are doing this on purpose.
        preciousoo 2y ago
        The original “tweet” didn’t attempt to infer reason or assign blame though. All it did is state two facts, according to their system
  - ddtaylor 2y ago
    Dell is a large player in storage integrity for servers for exactly this purpose.
bhaney 2y ago
> This firmware update has been periodically failing since I got this laptop from work several weeks ago, and only today did I put in the effort to track down where it was hiding the logs with the real reason If they haven't pulled the "corrupt" firmware after it's been up and broken for weeks, I don't think anyone needs to rescind the "incompetent" label.
- likeabatterycar 2y ago
  The only evidence we have is a single anecdote on Mastodon sparse on details and nothing you said can be validated. For all we know, the failure was in his employer's proxy server and the corrupt file was cached. Let's not wait for facts though, proceed immediately to the crucifixion of Dell. With everyone quick on the trigger to throw someone under the bus, imagine being a coworker in such a toxic environment.
  - harry8 2y ago
    Crucifixion? Really? Come on now... I paid Dell a bunch of money for a laptop. They pushed a bios update, that ubuntu kindly relayed to me that meant when I closed the lid and put the laptop in my bag as I sat beside my daughter's ICU bed, it fried the motherboard. No really. That was the /purpose/ of the bios "upgrade." Warranty after they remotely fried my machine? No, because it worked as designed. So yeah going bayesian given none of us can be 100% sure about anything, my prior on Dell is they suck donkeys' gonads on all levels. Competence, honesty, service, everything - until evidence shows otherwise and I've just told you why. Why is your prior that Dell are competent even when evidence suggests otherwise?
    - kaashif 2y ago
      Can you give more information about what the stated purpose of the upgrade was? Surely they didn't actually tell you they wanted to brick your laptop remotely?
      - thaumasiotes 2y ago

zdragnar 2y ago

Surely for something so important, they'd verify it rather than let it sit around for the public to point out. At a minimum this is definitely a process failure due to incompetence.

likeabatterycar 2y ago
Maybe it was file system corruption, who knows? "Dell is posting unsigned update executables" is a loaded statement that implies this was intentional. Dell has been signing updates since before most infosec engineers were in middle school ogling cheerleaders. It's alarmist and highly unlikely this was intentional.
- dumpsterdiver 2y ago
  That still wouldn’t excuse that someone clearly didn’t verify their work. No matter what the reason, ownership of this task was released before it should have been.
  - likeabatterycar 2y ago
    You have no evidence of that not happening. It could be corruption after the fact or failure during replication. The armchair wolves already smell blood and are assigning blame before a postmortem has even begun.
    - muppetman 2y ago
      You're right. A headline of "Dell's website is serving up unsigned updates" would be correct. But to garner more clicks and hype that's not how they've worded their tweet, instead it's worded to make it sound like Dell are doing this on purpose.
      - preciousoo 2y ago
        The original “tweet” didn’t attempt to infer reason or assign blame though. All it did is state two facts, according to their system
- ddtaylor 2y ago
  Dell is a large player in storage integrity for servers for exactly this purpose.

bhaney 2y ago

> This firmware update has been periodically failing since I got this laptop from work several weeks ago, and only today did I put in the effort to track down where it was hiding the logs with the real reason If they haven't pulled the "corrupt" firmware after it's been up and broken for weeks, I don't think anyone needs to rescind the "incompetent" label.

likeabatterycar 2y ago
The only evidence we have is a single anecdote on Mastodon sparse on details and nothing you said can be validated. For all we know, the failure was in his employer's proxy server and the corrupt file was cached. Let's not wait for facts though, proceed immediately to the crucifixion of Dell. With everyone quick on the trigger to throw someone under the bus, imagine being a coworker in such a toxic environment.
- harry8 2y ago
  Crucifixion? Really? Come on now... I paid Dell a bunch of money for a laptop. They pushed a bios update, that ubuntu kindly relayed to me that meant when I closed the lid and put the laptop in my bag as I sat beside my daughter's ICU bed, it fried the motherboard. No really. That was the /purpose/ of the bios "upgrade." Warranty after they remotely fried my machine? No, because it worked as designed. So yeah going bayesian given none of us can be 100% sure about anything, my prior on Dell is they suck donkeys' gonads on all levels. Competence, honesty, service, everything - until evidence shows otherwise and I've just told you why. Why is your prior that Dell are competent even when evidence suggests otherwise?
  - kaashif 2y ago
    Can you give more information about what the stated purpose of the upgrade was? Surely they didn't actually tell you they wanted to brick your laptop remotely?
    - thaumasiotes 2y ago