Hopefully the SEC is looking for people that shorted WD before this stunt occurred. It would not surprise me if some group developed a worm to deleted all the data to cause a dip in market price.
WD My Book users wake up to find their data deleted
541–550 of 701 posts
Re: WD My Book users wake up to find their data deleted
#542Earlier quoted context omitted.
And Samsung. Using 500GB SSD for many years as an external backup.
Samsung only makes SSD's though, right? It's fine if you don't have that much data, but past a certain size you're paying a lot extra.
They used to make hard drives years ago, and I still have three old 1.5 TB units kicking around that I can't seem to throw out, because they won't die.
Re: WD My Book users wake up to find their data deleted
#543According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
The box should prominently display how many years of life you're buying, in the same giant font size that it shows how many terabytes of storage you're buying.
[deleted]
Re: WD My Book users wake up to find their data deleted
#544Earlier quoted context omitted.
Product recalls are for defects that can cause physical injury. If the MyBook had an electrical defect that could cause a shock hazard or start a fire, it would have been recalled. Many products have flaws, but if the worst that can happen is that the customer feels ripped off, they don't get recalled. There might be remedies under a express or implied warranty, but tech products typically disclaim all of that in the…
Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Just that attackers didn't choose to destroy a device in this instance, but just erased it, doesn't mean allowing control of all software on the device to randos on the internet, by not patching a root RCE vulnerability is not a physical safety issue.
> Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc.
Having total remote control of an IoT device doesn't mean any of these things. Thermal protection is hardware driven typically on die, on cheap devices fan control is implemented in hardware because it's cheaper and easier than software solutions. Voltage regulators are hardware devices that aren't adjustable, even adjustable ones have a working range that is set via resistor. Switching power supplies aren't software driven.
Re: WD My Book users wake up to find their data deleted
#545Earlier quoted context omitted.
> I know several people who use these devices because of their simplicity, and they’d be devastated. I can’t imagine a scenario where I’d rely on an 8-10 year old device that hadn’t received a security update in 6+ years…
I can't imagine a scenario where people assume an 8 y.o. device is automatically trash, only because it's old. I'm typing this on a 10 y.o. laptop. It still works. Sure, the manufacturer and browser vendor released updates, but it wouldn't be too out of the ordinary if it didn't. That being said, I think its predecessor would still work (for posting a comment to HN at least)
[deleted]
Re: WD My Book users wake up to find their data deleted
#546Earlier quoted context omitted.
Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…
IOT products are inherently unsustainable.
[deleted]
Re: WD My Book users wake up to find their data deleted
#547All this IOT business got off on the wrong foot.
We knew 20 years ago how vulnerabilities turn up.
So we've also known that designing something to withstand the hostile internet many years into the future would require an entirely different approach to software engineering than taking commodity software and flashing them in with some integration of custom bits. But nobody stopped the vendors and it was cheaper than the competent alternatives.
Re: WD My Book users wake up to find their data deleted
#548Earlier quoted context omitted.
In my opinion the difference should be whether something is the first generation of a product or an iteration. Basically somehow using the Lindy effect to determine how long it should be supported. E.g. if I had bought the very first generation of the iPhone it would have been much more out of couriosity, not long time usage expectation. But I think there now has been enough development on it, that I should be able t…
OK, well now come up with a formula that says (from a series of objective and not-readily-gameable characteristics) for a random electrical/electronic device (or, if you want to separate the two, provide a way to do so - is a 1980's microwave with an 8-bit controller for the timer 'electronics' or 'electrical'?) how long the warranty should be, how long it should be 'supported' (for a definition of 'supported') and h…
> concrete suggestions for better solutions.
Here's a concrete solution -- The US Consumer Product Safety Commission should be given regulatory power over all consumer products, such as to enforce a minimum five (5) year support for repairs and parts availability, and standardized safety + recall notices.
NHTSA already does all of this for cars and vehicles. (They require a minimum 10 year parts availability. They handle recalls via VIN for auto manufacturers, including notices and matching effected model lookups, etc) - https://www.nhtsa.gov/vehicle
US-CPSC should run a matching mirror'd program exactly like it, but for consumer goods sold in the US.
Re: WD My Book users wake up to find their data deleted
#549Earlier quoted context omitted.
> I get that it doesn't make sense to offer parts for 20yo cars Why not? Personally i believe a hardware manufacturer should be bound by law to sell parts for any vehicle it sold in the past, as long as it exists. Yes even if it was produced 40 years ago. There's no reason for it to be otherwise. If this was mandated by law all the tiny incompatibilities that they introduce with very varied models will suddenly go aw…
“a hardware manufacturer should be bound by law to sell parts for any vehicle it sold in the past, as long as it exists” Cars would get extremely expensive. Imagine Ford still having to supply model T wheels and engines. They either would have to have kept a production line and employees knowing to operate it around, or have stocked ‘enough’ parts, where ‘enough’ is very hard to estimate up front. Also, stocked parts…
It's extra silly since there's always a robust aftermarket for any reasonably popular car. You can buy new Model T parts in 2021. A lot of modern cars are built on shared platforms, too, so the odds of someone still making parts go up since the engine is probably the same as 20 other models.
Re: WD My Book users wake up to find their data deleted
#550Earlier quoted context omitted.
If anything, ecological collapse might hasten this future. Just last week, there was this news about the Texas power company that remotely raised temperatures on people's thermostats to save power and avoid brownouts/blackouts. This predictably caused public outrage as people discovered what was in the fine print that they signed without reading, but from the perspective of the power company, everything worked as int…
I was counting that as an example of a tech done well! CA does this too, but afaik, it is advertised as such when one signs up for a free Smart meter and there is even a slightly better rate offered. I just don’t see an alternate way to implement this. Prompting users via pricing is not something that will quick enough or intuitive enough. Also the sacrifice they are asked to make is at most a few degrees
>I just don’t see an alternate way to implement this.
Increase capacity.
By running the system ever closer to the bone you simply cause more disasters.