411–420 of 701 posts
According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
Earlier quoted context omitted.
I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecti…
as most products become connected you will have to pay a premium for products that are not - especially as companies try to make profits from tracking (as in SmartTvs). People who are not rich enough to buy everything single purpose will have to pick and choose.
Things feel bleak.
According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…
Earlier quoted context omitted.
I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.
I agree with your conclusion of increasing the length of support. But your half-life analysis isn't really the right choice. Hard drives tend to have a bath-tub failure rate: https://en.wikipedia.org/wiki/Bathtub_curve
(Also, my hard drives always fail after I put them in the bathtub. Lol.)
Earlier quoted context omitted.
The company is among the most responsive to security issues because security is directly tied to their core value around data privacy.
From conversations on this website about Apple's responsiveness/attitude to security researchers hunting bounties, I have gotten a contrary impression about Apple.
They issue security updates for their current OS and 2 versions before, AFAIK.
Earlier quoted context omitted.
In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall. For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”
How good do you reckon a 6 years past EOL consumer linux device's defences against a browser running 3rd (or 1st) party javascript making http requests to http://192.168.0.1..254]/cgi-bin/factoryRestore.sh ? How much would you bet against that being an unauthenticated call or one with leaked hard coded reds?
Or are you assuming the user's browser itself is compromised and is running random javascript hitting the NAS address? That would be unfortunate, but I'm not sure I'd blame it on the "6 years past EOL consumer linux device"
Almost bought one of these, but opted for a raspi and usb3 external drive instead. Works great with Time Machine. https://saschaeggi.medium.com/use-a-raspberry-pi-4-for-time-... was my guide, though I deviated by using ext4 instead of hfs, and didn't need avahi.
This is what I did, too. But use ext4 instead of HFS+, and use Samba instead of Netatalk. With HFS+, the bundle would get corrupt after a few days. With Netatalk, a sudden power outage would corrupt the whole thing. Don't listen to 99% of blog posts on this. They all tell you to use HFS+/Netatalk. None of those authors have actually used that backup solution for any extended period of time, because if they did, they'…
Earlier quoted context omitted.
The iPhone I’m writing this on is several years old and fully patched. I don’t pay a subscription to Apple for the phone.
iPhones are subsidized by the App Store revenue.
Earlier quoted context omitted.
as most products become connected you will have to pay a premium for products that are not - especially as companies try to make profits from tracking (as in SmartTvs). People who are not rich enough to buy everything single purpose will have to pick and choose.
Personally I hope ecological collapse nips this black mirror future were tumbling in to. Things feel bleak.