4 ms·

Just here to yet again say that updates are bad and you shouldn't update things that work because the only outcomes are that they either continue working or the

Just here to yet again say that updates are bad and you shouldn't update things that work because the only outcomes are that they either continue working or they stop working. Don't roll the dice.

jeremyjh 2y ago
What if there are security vulnerabilities that you don't know about? You think its working, but it isn't.
- adamtaylor_13 2y ago
  I’ll go ahead and roll the dice that my printer isn’t a gaping security hole in my home network.
  - CGamesPlay 2y ago
    What can a hacked printer do? https://techyoulike.com/what-can-a-hacked-printer-do/ https://techyoulike.com/what-can-a-hacked-printer-do/
    - gymbeaux 2y ago
      That’s a terrible article. It includes nothing to backup the claims it makes- that printers have a plethora of vulnerabilities. The reality is your printer probably isn’t a realistic attack vector. Your average network firewall will keep you safe, but certainly in theory physical access to the printer could serve as a gateway to the rest of the LAN, and certainly physical access in theory facilitates accessing recently-printed documents.
  - CamperBob2 2y ago
    Tsk, don't you know that on Hacker News everybody is assumed to have the same threat model as a 3-letter spy agency, and is required to behave accordingly?
- gruez 2y ago
  Something tells me that printer manufacturers aren't spending any man-hours to update whatever crusty version of openssl or libxml they're using.
- userbinator 2y ago
  Known unknowns vs. unknown unknowns. I'll take the former (along with careful network isolation.)
codetrotter 2y ago
It works to some extent, but it depends. For example, you probably want to keep updating the OS of your computer, if the computer is at all connected to the internet in any way. Which for most of us is the case because we want to browse the web etc. One day, after an OS update for your computer, the vendor software for using the scanner portion of your multifunction printer stops working because it’s not compatible with the latest version of the computer OS. So you are forced to update that too. And then when you try to use the new version of that software, it refuses to work unless you let it update the firmware of your multifunction printer. So you allow it to do that. And now they successfully locked you out from using 3rd party printer cartridges with your multifunction printer. If you are lucky / if you did research ahead of time before you bought the multifunction printer in the first place, maybe you bought one that doesn’t require any manually installed vendor provided software to work. And so at least you don’t have the exact situation above. But even then you’d have to do a lot of digging to know what happens in the background. If you are on macOS or Windows, does any of the parts of the OS that allows your multifunction printer to work without you manually installing anything extra do any kind of firmware updates for your printer automatically and silently in the background? I have no idea. Hell, even with Linux there are binary blob things involved in a lot of distros that I couldn’t know if they would eventually end up updating firmware for my printer. It seems to me that it is near impossible to truly be certain that any multifunction printer does not eventually somehow receive a firmware update even if you never manually install any vendor provided software related to the printer.
- chii 2y ago
  it is why i don't update my OS, and selectively only apply security patches (that should, in theory, not affect the compatibility of printer drivers). I do the same with my mobile phone. Only update when i know the need - aka, an app has a new feature that is worth the risk of an update. And only update that one app. The security threats from external sources are less than the "real" threat - the very companies trying to sell you the update.
  - dlenski 2y ago
    I follow the same policy as you do with all non-open-source software. (With open source software, it's generally straightforward or at least possible to downgrade if something breaks… and I'm usually very confident that the software isn't being intentionally degraded on purpose.) But folks like you and me are few and far between, and vendors and IT departments tend to be incredibly hostile to this approach.
thfuran 2y ago
Sure, in the sense that all events have 50% probability: either they happen or they don't.
- thot_experiment 2y ago
  No. Changing things increases the chance that working things will break when it comes to computers, the wear and tear on computers in general comes at a much slower rate than the rate of update induced failure.
gblargg 2y ago
I have a HIKMICRO mini USB-C thermal camera and out of the box it worked like a normal UVC camera so I could use other standard webcam-compatible apps to view it (thermal apps tend to have choppy video capture). I was reviewing it so I updated the firmware, and then UVC functionality was basically broken, so it only worked with their app afterwards. I contacted them but they didn't seem to grasp the significance or care.

Just here to yet again say that updates are bad and you shouldn't update things that work because the only outcomes are that they either continue working or they stop working. Don't roll the dice.

jeremyjh 2y ago

What if there are security vulnerabilities that you don't know about? You think its working, but it isn't.

adamtaylor_13 2y ago
I’ll go ahead and roll the dice that my printer isn’t a gaping security hole in my home network.
- CGamesPlay 2y ago
  What can a hacked printer do? https://techyoulike.com/what-can-a-hacked-printer-do/ https://techyoulike.com/what-can-a-hacked-printer-do/
  - gymbeaux 2y ago
    That’s a terrible article. It includes nothing to backup the claims it makes- that printers have a plethora of vulnerabilities. The reality is your printer probably isn’t a realistic attack vector. Your average network firewall will keep you safe, but certainly in theory physical access to the printer could serve as a gateway to the rest of the LAN, and certainly physical access in theory facilitates accessing recently-printed documents.
- CamperBob2 2y ago
  Tsk, don't you know that on Hacker News everybody is assumed to have the same threat model as a 3-letter spy agency, and is required to behave accordingly?
gruez 2y ago
Something tells me that printer manufacturers aren't spending any man-hours to update whatever crusty version of openssl or libxml they're using.
userbinator 2y ago
Known unknowns vs. unknown unknowns. I'll take the former (along with careful network isolation.)

codetrotter 2y ago

It works to some extent, but it depends. For example, you probably want to keep updating the OS of your computer, if the computer is at all connected to the internet in any way. Which for most of us is the case because we want to browse the web etc. One day, after an OS update for your computer, the vendor software for using the scanner portion of your multifunction printer stops working because it’s not compatible with the latest version of the computer OS. So you are forced to update that too. And then when you try to use the new version of that software, it refuses to work unless you let it update the firmware of your multifunction printer. So you allow it to do that. And now they successfully locked you out from using 3rd party printer cartridges with your multifunction printer. If you are lucky / if you did research ahead of time before you bought the multifunction printer in the first place, maybe you bought one that doesn’t require any manually installed vendor provided software to work. And so at least you don’t have the exact situation above. But even then you’d have to do a lot of digging to know what happens in the background. If you are on macOS or Windows, does any of the parts of the OS that allows your multifunction printer to work without you manually installing anything extra do any kind of firmware updates for your printer automatically and silently in the background? I have no idea. Hell, even with Linux there are binary blob things involved in a lot of distros that I couldn’t know if they would eventually end up updating firmware for my printer. It seems to me that it is near impossible to truly be certain that any multifunction printer does not eventually somehow receive a firmware update even if you never manually install any vendor provided software related to the printer.

chii 2y ago
it is why i don't update my OS, and selectively only apply security patches (that should, in theory, not affect the compatibility of printer drivers). I do the same with my mobile phone. Only update when i know the need - aka, an app has a new feature that is worth the risk of an update. And only update that one app. The security threats from external sources are less than the "real" threat - the very companies trying to sell you the update.
- dlenski 2y ago
  I follow the same policy as you do with all non-open-source software. (With open source software, it's generally straightforward or at least possible to downgrade if something breaks… and I'm usually very confident that the software isn't being intentionally degraded on purpose.) But folks like you and me are few and far between, and vendors and IT departments tend to be incredibly hostile to this approach.

thfuran 2y ago

Sure, in the sense that all events have 50% probability: either they happen or they don't.

thot_experiment 2y ago
No. Changing things increases the chance that working things will break when it comes to computers, the wear and tear on computers in general comes at a much slower rate than the rate of update induced failure.

gblargg 2y ago

I have a HIKMICRO mini USB-C thermal camera and out of the box it worked like a normal UVC camera so I could use other standard webcam-compatible apps to view it (thermal apps tend to have choppy video capture). I was reviewing it so I updated the firmware, and then UVC functionality was basically broken, so it only worked with their app afterwards. I contacted them but they didn't seem to grasp the significance or care.