WD My Book users wake up to find their data deleted • Hacker News Board

Re: WD My Book users wake up to find their data deleted

#561

Post by kingsuper20 » Fri, Jun 25, 2021, 12:55 PM UTC

rswail wrote: post #471

freeone3000 wrote: post #282

Earlier quoted context omitted.

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

I think that we need to separate the life of the hardware (WD My Book) and the life of the cloud service (the "Live" bit). The drives themselves and their function as a NAS on a LAN is still fine. When "Live" EOLed, they should have turned off the servers and disabled the function. If they weren't going to service/support it anymore, then they should have been honest about it. Of course, their consumers would have sc…

> I think that we need to separate the life of the hardware (WD My Book) and the life of the cloud service (the "Live" bit).

That makes me think of the internet radio owners (Grace Digital, Yamaha, etc.) that all had their products brick because the underlying look-up service just up and went away. No problem. You just have to buy another hunk of plastic and microprocessor.

Re: WD My Book users wake up to find their data deleted

#562

Post by minikites » Fri, Jun 25, 2021, 12:57 PM UTC

alisonkisk wrote: post #557

Popegaf wrote: post #433

Earlier quoted context omitted.

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it'…

The free market soluton: Market experimentation is necessary for innovation. Now we've learned never to buy a product from WD (in case you forgot that last year they intentionally sold unfit SMR hard drives and lied about it). Also, always have backups (not just syncs!).

Every brand proves themselves untrustworthy at some point, look at Seagate or every airline. The free market breaks down all the time and that's why government regulation is so necessary.

Re: WD My Book users wake up to find their data deleted

#563

Post by tzfld » Fri, Jun 25, 2021, 12:58 PM UTC

More and more convinced that the best data backup is a read-only one, and not connected to the internet. Optical disks will have their use, even if they will not be mainstream anymore.

Re: WD My Book users wake up to find their data deleted

#564

Post by pmlnr » Fri, Jun 25, 2021, 12:59 PM UTC

One lesson I see here is that software-only triggered factory resets shouldn't be a thing.

Routers used to have reset pins/buttons which had to be held down for a while to make them factory reset. That should be the _only_ option to factory reset a device that wipes user data along with it.

Re: WD My Book users wake up to find their data deleted

#565

Post by tiagod » Fri, Jun 25, 2021, 1:00 PM UTC

alisonkisk wrote: post #557

Popegaf wrote: post #433

Earlier quoted context omitted.

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it'…

The free market soluton: Market experimentation is necessary for innovation. Now we've learned never to buy a product from WD (in case you forgot that last year they intentionally sold unfit SMR hard drives and lied about it). Also, always have backups (not just syncs!).

We learned that. But does my grandpa even know what WD is when he goes to the shop buy a disk and is sold this thing?

Re: WD My Book users wake up to find their data deleted

#566

Post by hfkwnfb » Fri, Jun 25, 2021, 1:01 PM UTC

emodendroket wrote: post #185

MattGaiser wrote: post #184

Earlier quoted context omitted.

That just effectively means a subscription. So your hard drive will be $100 + $10 a month.

If I'm going to pay a subscription fee, why am I even bothering with an on-premise solution really.

This was an issue caused by a negligent company failing to keep their devices secure. For me the solution to this is not just to rely on another potentially-also-negligent company. In my opinion on-prem+off-prem, or multiple off-prem solutions are necessary for anything of actual value.

Re: WD My Book users wake up to find their data deleted

#567

Post by tiagod » Fri, Jun 25, 2021, 1:02 PM UTC

mrspuratic wrote: post #474

oblio wrote: post #448

Earlier quoted context omitted.

My point wasn't clear. 7 years is quite a long time. And as far as I know in general they can't prevent after market parts being produced. So car manufacturers are forced to allow their cars to be repaired, not necessarily with their parts, a long time after they've stopped selling them. IT stuff should start following the same lifecycle.

7 years is a relatively long time for a product, but not necessarily for a car. The average car age at scrap time is 13.9 years (UK stats). [Wildly off topic ranting about the balance of embodied versus emitted CO2 for the typical ICE vehicle omitted. Clue: 10 years is about the break-even point.]

FYI in Portugal it was at 21.6 years in 2019.

Re: WD My Book users wake up to find their data deleted

#568

Post by bryanrasmussen » Fri, Jun 25, 2021, 1:03 PM UTC

quietbritishjim wrote: post #519

bryanrasmussen wrote: post #502

Earlier quoted context omitted.

>remotely raised temperatures on people's thermostats to save power why would raising temperatures save power? probably a silly question but I'm confused.

It was presumably the upper threshold before air conditioning came on. Explanation for those wondering why this needed explanation: Most thermostats set the lower threshold before heating comes on, so turning it up would use more energy.

thanks to you and everyone for the explanation - I haven't lived in the U.S for 20+ years now so I forgot all about air conditioning.

Re: WD My Book users wake up to find their data deleted

#569

Post by cactus2093 » Fri, Jun 25, 2021, 1:07 PM UTC

Popegaf wrote: post #433

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it'…

I find the environmental impact argument here to be very dubious. Even if a Linux-like alternative were available for this hard drive, the vast majority of people would be unaware of that or not willing/capable of figuring out how to work it and would throw the device away and replace it anyway. And even if they did save the hard drive, they might just use the money they saved by not replacing it to upgrade their computer or phone a little sooner instead.

Hard drives are a particularly bad example too because the risk of failure goes up as the device ages, so people probably should replace them after a few years of heavy use regardless of software support.

We live in a rich society, electronics are relatively cheap, and people like having shiny new things. We will inevitably continue having more and more electronic waste. Right to repair type laws are great for consumers for many other reasons, but I don’t think they’ll make any kind of meaningful dent in the reduction of electronic waste.

Re: WD My Book users wake up to find their data deleted

#570

Post by yashap » Fri, Jun 25, 2021, 1:09 PM UTC

msravi wrote: post #307

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration How does one get to resolve /panel/rest/configuration?

Wow, so completely trivial to get root RCE on any of these devices, brutal, all you need is an IP address. That’s as bad as vulnerabilities get.

Insane that this has been known since 2018, and not patched - these devices are from ~2011-2015, far from ancient. I’ll personally never, ever buy anything from Western Digital again.