Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

251–260 of 701 posts

Re: WD My Book users wake up to find their data deleted

#251

Post by objectivetruth »

goatinaboat wrote: post #240
thrdbndndn wrote: post #222

Earlier quoted context omitted.

>should end with the culprit being out of business I would agree if it's non-EoL products. This, not so much. Don't get me wrong, I'm not trying to say since it's EoL WD don't need to do anything. Just that the degree of seriousness of this incident changes with that.

I would agree if't s a non-EoL products. This, not so much. A company should not be permitted to just declare something “EoL” if it is still in widespread usage. They made it, they support it as long as any customer still has it.

Products are sold with a warranty. If you want guaranteed support for X years beyond the warranty, pay for an extended warranty.

If the product in question doesn't have an available extended warranty, then pick another product.

Telling every hardware maker "you have to support every device you make forever" is ludicrous.

I have some 15-year-old netbooks in storage that still power on, should eeePC have to "support" them now? Should they have to maintain a repair depot with replacement parts forever? Should they have to just release their own version of Linux forever to support each model of hardware?

Re: WD My Book users wake up to find their data deleted

#252

Post by hunter2_ »

goatinaboat wrote: post #240
thrdbndndn wrote: post #222

Earlier quoted context omitted.

>should end with the culprit being out of business I would agree if it's non-EoL products. This, not so much. Don't get me wrong, I'm not trying to say since it's EoL WD don't need to do anything. Just that the degree of seriousness of this incident changes with that.

I would agree if't s a non-EoL products. This, not so much. A company should not be permitted to just declare something “EoL” if it is still in widespread usage. They made it, they support it as long as any customer still has it.

At the very least, the EOL date should be prominently displayed on the package (and product page, in the case of online shopping). Just like how I was able to see CentOS 8's EOL date when deciding what OS to install on my servers, except guaranteed.

Re: WD My Book users wake up to find their data deleted

#254

Post by Spivak »

monsieurbanana wrote: post #230
bigiain wrote: post #144

Earlier quoted context omitted.

"Redundant Array of Inexpensive Cloud Storage Providers is not a backup!!!" (Can we make RAICSP a thing? Or do multi-cloud solution vendors already has a snappy marketing term for storing everything on all of S3, Azure Blob, and Google Storage at once?)

It's not? Why?

Yeah, I’m falling on this too. A client with write-only privs to a buckets on multiple cloud storage providers is literally the most durable backup in human existence right now. Like nothing else will get you worldwide DR and 30+ 9’s of durability.

Re: WD My Book users wake up to find their data deleted

#255

Post by zamadatix »

busymom0 wrote: post #220
gertrunde wrote: post #213

Earlier quoted context omitted.

From what I can find, this particular device was launched around 2011, and went end of support pre-2016. (Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things). And maybe highlights that support lifecycles for IoT devices should be longer. Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.

I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.

There's really no winning with this.

You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse.

You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early.

You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn't actually going to solve anything as it's not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all).

You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways.

.

Retrospective in this particular case it would have been really great for them to fix this particular issue but that's an extremely hard thing to accurately judge unless you're from the future. I mean what percentage of devices that are many years EoL you've heard get this bad of a publicity hit? I'm sure there are many individual cases to point to but it's nothing against the absolute deluge of devices that have been discontinued over the years quietly without issue.

Re: WD My Book users wake up to find their data deleted

#256

Post by riffraff »

ghostly_s wrote: post #196
adolph wrote: post #162

Earlier quoted context omitted.

The affected model here, known as My Book Live, uses an ethernet cable to connect to a local network. From there, users can remotely access their files and make configuration changes through Western Digital cloud infrastructure. Western Digital discontinued the My Book Live in 2015. The support forum thread was first reported by Bleeping Computer. The affected product is not a drive but a NAS solution. In terms of be…

Non-technical users don't care about this distinction. The name Western Digital is on both, and that name's brand value is destroyed forever if this indeed turns out to be irreversible. Though they could probably pivot to selling their drives in other's NAS devices without much difficulty if they want to remain in this market.

Non-technical users don't really buy hard drives individually, they would at most ask their computer-savvy friend or go to a shop who will replace it for them.

I highly doubt the average non-technical user even knows who produced the hard drive they own.

Re: WD My Book users wake up to find their data deleted

#257

Post by fulafel »

saltedonion wrote: post #245

How is this even possible. Shouldn’t these devices be behind a NAT? How did the hacker even reach these devices.

NAPT is for facilitating internet traffic despite shortage of ip addresses, the opposite of a firewall in a way. So it's a success, not a bug, if it manages to enable some incoming traffic.

Re: WD My Book users wake up to find their data deleted

#258

Post by JamesBrooks »

Was very worried when I checked through the 5x 3TB My Books I have to find that all the data was ok - which I thought was odd as they're very old models.

Turns out at the start of COVID I re-did my home networking and the gateway addresses on all the My Books were incorrect, so they haven't had internet connectivity for over a year... (quickly adds extra firewall rules to prevent them for bonus safety).

Re: WD My Book users wake up to find their data deleted

#259

Post by akg_67 »

goatinaboat wrote: post #240
thrdbndndn wrote: post #222

Earlier quoted context omitted.

>should end with the culprit being out of business I would agree if it's non-EoL products. This, not so much. Don't get me wrong, I'm not trying to say since it's EoL WD don't need to do anything. Just that the degree of seriousness of this incident changes with that.

I would agree if't s a non-EoL products. This, not so much. A company should not be permitted to just declare something “EoL” if it is still in widespread usage. They made it, they support it as long as any customer still has it.

Hardware products used to be supported for 15 years, then 10 years, then 7 years, then 5 years… … Now nobody knows. I guess h/w mfr. saw what s/w vendors do wrt their products, and figured they can you do the same. SaaS is worse, you are only supported until you pay.

Accumulation of benefits, shifting of responsibilities, the American way.

Re: WD My Book users wake up to find their data deleted

#260

Post by WalterBright »

gruez wrote: post #102
WalterBright wrote: post #80

Earlier quoted context omitted.

They hooked the backup to the internet. Not a good idea. Nothing connected to the internet is secure, especially since nothing comes with physical write-enable switches.

So all your data is stored offline and (presumably) on-prem? What if there's a fire?

> (presumably)

Consider that I worked on the 757 stabilizer trim gearbox. The idea is no matter what fails, the airplane lands safely. I've been trained to think that way.

Consider also that I've worked with computers for 45 years. I've seen about every failure you can think of, including fires and floods, explosions and earthquakes, viruses and phishing.

The most unreliable, by far, part of computing is the internet.

Post reply on HN