D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

Post by lotsofpulp » Wed, Oct 09, 2019, 2:01 AM UTC

TheSpiceIsLife wrote: post #234

dangus wrote: post #89

Earlier quoted context omitted.

Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work. Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send t…

> Until consumers are willing to spend on subscription services... Ok, I’m willing. Where do I sign up? Which manufactures are offering this service for residential grade equipment?

Post by wmf » Wed, Oct 09, 2019, 2:13 AM UTC

lstamour wrote: post #241

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> Can you provide an “enterprise class embedded OS” to device manufacturers and address post-deployment updates? How about Microsoft’s Azure Sphere Linux/cloud product with “10-year lifetime” support? > Azure Sphere will feature a turnkey cloud security service that guards every Azure Sphere device, including the ability to update and upgrade this security protection for a 10-year lifetime of the device. https://blog…

Post by tonyarkles » Wed, Oct 09, 2019, 2:32 AM UTC

wmf wrote: post #245

tonyarkles wrote: post #161

Earlier quoted context omitted.

I agree wholeheartedly, and outright reject the premise of the original statement. This is a choice that they make. Yes, having a legacy support team is going to cost a bit of money, but not a ridiculous amount. Maybe instead of having a ridiculous number of barely-differentiated SKUs, they could lighten the support burden a bit by making a smaller number of solid well-supported models. Edit: also, basing the models…

basing the models on a common platform would help too. I assume they generally do this already, but if not... They don't, because they save a few dollars by re-bidding each product. So each company is shipping a random assortment of Broadcom, Marvell, and Qualcomm reference designs, all running incompatible software stacks.

Post by autoexec » Wed, Oct 09, 2019, 2:38 AM UTC

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

Post by tbyehl » Wed, Oct 09, 2019, 2:42 AM UTC

incompatible wrote: post #211

tbyehl wrote: post #191

Earlier quoted context omitted.

> I would expect a consumer router to run without problem for not less than 10 years That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.

How long do vehicle recalls last for, if something like an airbag turns out to be defective and dangerous?