Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

531–540 of 701 posts

Re: WD My Book users wake up to find their data deleted

#531

Post by deadbunny »

freeone3000 wrote: post #282
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

There is also EOL for the HDDs and EOL for the NAS itself. HDDs are easily replaceable and the NAS hardware itself should last for a long time. It's a linux box that shares a filesystem via CIFS/NFS no need to throw that out when a HDD dies, that'll last for a decade, if not more.

Re: WD My Book users wake up to find their data deleted

#532

Post by fooblat »

brobdingnagians wrote: post #405
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecti…

I'm with you on this one.

I refuse to buy any appliance that requires a connection to the internet. I look for things that are straightforward to repair and maintain.

Re: WD My Book users wake up to find their data deleted

#534

Post by zamadatix »

ec109685 wrote: post #374
zamadatix wrote: post #255

Earlier quoted context omitted.

There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a prece…

Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this. This is so disingenuous (from the first report of this flaw): “Western Digital takes the security of our customers’ data seriously, and we provide security updates for our products to address issues from both external reports and regular security audits.”

> Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this.

"Winning" isn't "gee if we could just say we'll patch every discontinued product forever and imagine it had no downsides wouldn't that be great" - that's known as "dreaming".

Re: WD My Book users wake up to find their data deleted

#535

Post by cesarb »

Someone wrote: post #510
southerntofu wrote: post #496

Earlier quoted context omitted.

> I get that it doesn't make sense to offer parts for 20yo cars Why not? Personally i believe a hardware manufacturer should be bound by law to sell parts for any vehicle it sold in the past, as long as it exists. Yes even if it was produced 40 years ago. There's no reason for it to be otherwise. If this was mandated by law all the tiny incompatibilities that they introduce with very varied models will suddenly go aw…

“a hardware manufacturer should be bound by law to sell parts for any vehicle it sold in the past, as long as it exists” Cars would get extremely expensive. Imagine Ford still having to supply model T wheels and engines. They either would have to have kept a production line and employees knowing to operate it around, or have stocked ‘enough’ parts, where ‘enough’ is very hard to estimate up front. Also, stocked parts…

> or have stocked ‘enough’ parts, where ‘enough’ is very hard to estimate up front.

On the building where I live, the company which does the elevator maintenance offered a significant discount on the replacement of the control system in the machine room with a more modern model (which uses less energy). Their reason: including us, they had only two clients left which used that older system, so once both upgraded to a newer (and more common) model, they would no longer need to stock replacement parts for that older model.

Re: WD My Book users wake up to find their data deleted

#536

Post by sokoloff »

rswail wrote: post #470
sokoloff wrote: post #439

Earlier quoted context omitted.

Average age of a car in the US hit 12.1 years last year: https://www.reuters.com/business/autos-transportation/averag... In the case of car service parts, there’s a burgeoning after-market network of suppliers. I can probably find 5+ parts from different suppliers for brake wear parts for even 25 year old cars sold in significant volume. As someone wrenching on very much not-new cars for the family (and occasional fr…

Except that there already is a legislated solution requiring manufacturers to supply parts for (depending on where) ~10 years, irrespective of warranty. The fact that there is after-market suppliers is more that manufacturers haven't worked out how to stop that on purely mechanical parts. They would much prefer to tie you to their own maintenance network and parts if they could.

I don’t think it’s a law in the US, though that’s the common knowledge/frequently repeated claim.

https://www.hemmings.com/stories/2020/08/03/ask-a-hemmings-e...

Re: WD My Book users wake up to find their data deleted

#537

Post by cesarb »

joering2 wrote: post #393
oblio wrote: post #312

Earlier quoted context omitted.

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

Moreover, I think WD defense here will be that while you could, you did not have to plug your WD device to internet, in order for it to serve its purpose. They will try to argue that the majority of their offer is hard discs, and if your drive has extra ability to connect to internet, that's extra feature.

Yes, but that "extra feature" is most probably the main reason that model was bought instead of a cheaper model without a network connection. That is, that "extra ability" would be in fact the main differentiator of that model.

Re: WD My Book users wake up to find their data deleted

#538

Post by deadbunny »

karlkloss wrote: post #356

I never trusted commercial NAS, I don't even trust OS NAS distributions, they all have their own problems. Just use standard hardware, a standard Linux distribution, and learn how to configure it. Convenience is always bought with security.

Yup.

1. Install ubuntu

2. sudo apt install nfs-kernel-server

3. zpool create foo /dev/disk1 ... /dev/diskX

4. vi /etc/exports

Re: WD My Book users wake up to find their data deleted

#539

Post by hawski »

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

I also hate how when your phone or other device (i.e. I have an old Chromebook) is no longer supported there is no indication whatsoever that it is the case. You have to surf around the web to find EOL dates and every producer has it different. It should be visible and more in your face or at the very least it should be in "About" or Update settings.

Re: WD My Book users wake up to find their data deleted

#540

Post by 8fingerlouie »

brobdingnagians wrote: post #405
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecti…

I never jumped on the “everything IoT” bandwagon, but recently I’ve relented a bit.

I own/use exactly 4 “IoT technologies”.

I have smart radiator thermostats that turn on/off the heat based on family presence, as well as “predict” the heating needs based on weather forecast, sunshine hours, etc.

I have a heat pump in my vacation house that is remote controlled by the internet. Not strictly needed, but very convenient in the winter.

To keep an eye on my vacation house I also have a camera that uses HomeKit Secure Video. Requires no infrastructure on my end except network.

And finally, like a lot of people I have Hue.

I control it all through HomeKit. I also keep everything on a couple of IoT VLANs, one for “trusted” devices (AirPlay, media, PlayStation, etc), and one for “everything else” with client isolation, filtered dns, IDS/IPS. No upnp/nat-pmp, no tunneling (if detectable), and no other dns servers but mine (until dns over https becomes a thing with IoT)

In the future however it might become more or less impossible to avoid. Our neighbors recently purchased a new oven, which of course comes with internet connectivity. Their new washing machine also has internet connectivity.

In the very near future everything will be connected under the pretense of providing useful feature, when in reality it’s all about pushing adds and gathering telemetry data.

Post reply on HN