40 ms·

Having the firmware image just be a boring old tarball + hash sounds super nice. I wish more devices were this open, and I hope Rode won't see this and decide t

Having the firmware image just be a boring old tarball + hash sounds super nice. I wish more devices were this open, and I hope Rode won't see this and decide to lock the firmware upgrades down.

EvanAnderson 6mo ago
In the off chance anybody from Rode sees this: This makes me want to purchase your gear. Don't change it. It's funny this comes up now. Tomorrow I'm dragging my Zoom R20 recorder on-site to use as an overly-featured USB audio interface for a single-mic live stream. If I'd know this about Rode a week ago I'd have purchased one of these and could have left my R20 hooked-up in the home studio!
- QuantumNomad_ 6mo ago
  I’m guilty of using my Zoom R16 in a similar fashion; as USB audio interface most of the time for a couple of inputs. The only thing that is a little sad about it is that for example the faders do nothing when the R16 is in USB audio interface mode. It does however like to randomly turn on reverb and one other effect after power cycling. Which I sometimes forget and then wonder for half a second why the audio is sounding weird :P So there is some extra functionality that is available even in USB audio interface mode, although in this case not desirable for me to have enabled within it. If I want to add reverb or other effects when using the R16 as USB audio interface, I prefer to do so in the DAW. I would have liked to be able to use the faders though.
  - EvanAnderson 6mo ago
    Interesting. I'm running my R20 in USB interface / stereo mix mode and the faders do work. I didn't think about trying to apply any effects. I'll play with that, for fun, but I'd definitely add them in the DAW as well. (I really only use my R20 for multitrack recording and do all my effects in the DAW. I like it, and it can do a ton standalone, but my workflow really just needed a multitrack recorder and I could have probably spent a lot less. It just looked like fun...)
- deleted 6mo ago
  [deleted]
- jasomill 6mo ago
  Funny you mention that, because my first thought when reading that he submitted a report to the vendor was that they'd "fix" the problem by requiring firmware uploads to be signed (in which case it's "secure" because only their service techs have access to the private key, IOW, security by sternly worded written policy).
tombert 6mo ago
I had to upgrade the firmware in my HP printer a couple years ago. It’s a printer that I think was released in ~2009 (I am not able to check right now), and in order to upgrade the RAM to 256MB I needed to do a firmware update. I dreaded this, but then I found out that all you do to update the firmware was FTP a tarball to the printer over the network. I dropped it in with FileZilla, it spent a few minutes whirring, and my firmware was updated. Then I got mad that firmware updates are ever more complicated than that. Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons, and then do nothing else.
- thwarted 6mo ago
  I think my favorite is wifi access points that support tftp to load a firmware image (with some kind of hardware switch to enable this state). These can be made effective unbrickable and it's really nice for experimenting.
- ssl-3 6mo ago
  > Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons Whose security are we talking about here? Mine, or the manufacturer's?
  - jkrejcha 6mo ago
    I'm not sure if it was what OP meant, but it's arguably a good availability technique (as long as you can generate the checksum, that is). Like, if I want to run custom firmware and flash it, having a checksum which verifies that the firmware isn't corrupted may help prevent bricking.
    - ssl-3 6mo ago
      Right, I'm not sure either. Hence the question. :) Checksums are great for helping to validate data integrity. And data integrity can be related to security. But over the last 25 years or so, I've grown to become pretty averse to phrasing that parse like "for security purposes".
- 6mo ago
Gigachad 6mo ago
I think it should be locked down to require some kind of physical button input to enable the commands, putting it in some kind of "DFU" mode. Otherwise anything with USB access could brick your device by flashing a bad firmware.
gamerslexus 6mo ago
I don't want my audio interface to run SSH (and have some random authorized key added), personally.
- yonatan8070 6mo ago
  I agree that it shouldn't have SSH enabled, but I do like that the firmware isn't encrypted or signed, so it's not hard to mod it, at no cost to thr manufacturer
  - gamerslexus 6mo ago
    Fact.
- Geezus_42 6mo ago
  Just don't expose it on a public network?

Having the firmware image just be a boring old tarball + hash sounds super nice. I wish more devices were this open, and I hope Rode won't see this and decide to lock the firmware upgrades down.

EvanAnderson 6mo ago

In the off chance anybody from Rode sees this: This makes me want to purchase your gear. Don't change it. It's funny this comes up now. Tomorrow I'm dragging my Zoom R20 recorder on-site to use as an overly-featured USB audio interface for a single-mic live stream. If I'd know this about Rode a week ago I'd have purchased one of these and could have left my R20 hooked-up in the home studio!

QuantumNomad_ 6mo ago
I’m guilty of using my Zoom R16 in a similar fashion; as USB audio interface most of the time for a couple of inputs. The only thing that is a little sad about it is that for example the faders do nothing when the R16 is in USB audio interface mode. It does however like to randomly turn on reverb and one other effect after power cycling. Which I sometimes forget and then wonder for half a second why the audio is sounding weird :P So there is some extra functionality that is available even in USB audio interface mode, although in this case not desirable for me to have enabled within it. If I want to add reverb or other effects when using the R16 as USB audio interface, I prefer to do so in the DAW. I would have liked to be able to use the faders though.
- EvanAnderson 6mo ago
  Interesting. I'm running my R20 in USB interface / stereo mix mode and the faders do work. I didn't think about trying to apply any effects. I'll play with that, for fun, but I'd definitely add them in the DAW as well. (I really only use my R20 for multitrack recording and do all my effects in the DAW. I like it, and it can do a ton standalone, but my workflow really just needed a multitrack recorder and I could have probably spent a lot less. It just looked like fun...)
deleted 6mo ago
[deleted]
jasomill 6mo ago
Funny you mention that, because my first thought when reading that he submitted a report to the vendor was that they'd "fix" the problem by requiring firmware uploads to be signed (in which case it's "secure" because only their service techs have access to the private key, IOW, security by sternly worded written policy).

tombert 6mo ago

I had to upgrade the firmware in my HP printer a couple years ago. It’s a printer that I think was released in ~2009 (I am not able to check right now), and in order to upgrade the RAM to 256MB I needed to do a firmware update. I dreaded this, but then I found out that all you do to update the firmware was FTP a tarball to the printer over the network. I dropped it in with FileZilla, it spent a few minutes whirring, and my firmware was updated. Then I got mad that firmware updates are ever more complicated than that. Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons, and then do nothing else.

thwarted 6mo ago
I think my favorite is wifi access points that support tftp to load a firmware image (with some kind of hardware switch to enable this state). These can be made effective unbrickable and it's really nice for experimenting.
ssl-3 6mo ago
> Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons Whose security are we talking about here? Mine, or the manufacturer's?
- jkrejcha 6mo ago
  I'm not sure if it was what OP meant, but it's arguably a good availability technique (as long as you can generate the checksum, that is). Like, if I want to run custom firmware and flash it, having a checksum which verifies that the firmware isn't corrupted may help prevent bricking.
  - ssl-3 6mo ago
    Right, I'm not sure either. Hence the question. :) Checksums are great for helping to validate data integrity. And data integrity can be related to security. But over the last 25 years or so, I've grown to become pretty averse to phrasing that parse like "for security purposes".
6mo ago

Gigachad 6mo ago

I think it should be locked down to require some kind of physical button input to enable the commands, putting it in some kind of "DFU" mode. Otherwise anything with USB access could brick your device by flashing a bad firmware.

gamerslexus 6mo ago

I don't want my audio interface to run SSH (and have some random authorized key added), personally.

yonatan8070 6mo ago
I agree that it shouldn't have SSH enabled, but I do like that the firmware isn't encrypted or signed, so it's not hard to mod it, at no cost to thr manufacturer
- gamerslexus 6mo ago
  Fact.
Geezus_42 6mo ago
Just don't expose it on a public network?