Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

581–590 of 701 posts

Re: WD My Book users wake up to find their data deleted

#581

Post by CJefferson »

romwell wrote: post #72
pram wrote: post #51

Earlier quoted context omitted.

I think this backup maximalism can be taken further. Say if it’s not one of many tapes stored offsite at an Iron Mountain repository, it’s not a backup. Or multiple locations at that, can’t discount redundancy (what if one location gets nuked)

OK, looks like many responses have the same misunderstanding here. To find out if something is a backup or not, ask a simple question: does the availability of the data on it correlate with what's happening to the system it's backing up ? If the answer is no , then it's not a backup. Whether your tape storage gets nuked or not does not, in any way, correlate with whether your system gets hacked into, or whether someo…

This sounds like "no true scotsman".

I back up to Dropbox and an external hard drive next to my machine. I've used both to restore my data on hard drive death.

I can't imagine the amount of time and/or money it would take to do what you want. It certainly doesn't seem like it is something most computer users would do.

I can set anyone up with a (for example) iCloud + time machine backup with very little work, and it will keep ticking over, backing up. What's your suggestion exactly?

Re: WD My Book users wake up to find their data deleted

#583

Post by CoolGuySteve »

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

A lawsuit is one thing but I’m hoping for a congressional inquiry and better consumer protection laws.

Imagine how many people are walking around right now with Android phones that are more than 2 years old and no longer receiving updates.

It’s such a sizable portion of the population that at some point an attack like this on Android will become a national security and economic issue.

Re: WD My Book users wake up to find their data deleted

#584

Post by zelon88 »

I can't believe we're just glossing over the fact that everyone who has been compromised probably has an intruder still sitting on their LAN, or at least a big hole in their network somewhere. The request came from somewhere, and most people don't willingly forward ports to these devices.

You're all worried that the data is gone, maybe you should be worried that someone might have taken it.

Re: WD My Book users wake up to find their data deleted

#585

Post by alisonkisk »

Nursie wrote: post #499
dtech wrote: post #428

Earlier quoted context omitted.

I'd argue that this is serious enough that EOL doesn't apply. Yeah sure EOL for updates, features, minor issues etc. But this is literally "Anyone in the world can remotely make your product unusable and destroy everything on it while you use it as intended" I don't care if a car manifacturer EOL'ed a car model, if an issue gets discovered that will make the engine explode at random they better do recall.

For reference - my 13 yr old BMW just got a recall repair due to a potential problem with the air conditioning system.

That's an interesting case. BMW knew about that back in 2012 but covered it up for 5+ years before finally agreeing to a recall. They perhaps are covering their butts against lawsuits due to thirty negligence. And they wouldn't want a new fire triggering extra attention to an old fire, and also they want to burnish (ha!) their brand image, unlike WD who has practically no competition.

https://www.forensicdjs.com/blog/bmw-hvac-blower-wiring-reca....

Re: WD My Book users wake up to find their data deleted

#586

Post by thomascgalvin »

vertis wrote: post #508
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This whole, "ah sorry we decided to end-of-life that because we couldn't make any more money off it" is so many levels of bullshit. It's also part of a broader attitude on not repairing anything. Battery dead in your activity tracker? throw it out and buy a new one. Worse still, the band has degraded b…

> If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back.

This is my takeaway from the whole Peloton fiasco. If you spend thousands of dollars on a product, and after the purchase the company bricks the product, the company should legally owe you a full refund.

Re: WD My Book users wake up to find their data deleted

#588

Post by myself248 »

cactus2093 wrote: post #569
Popegaf wrote: post #433

Earlier quoted context omitted.

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it'…

I find the environmental impact argument here to be very dubious. Even if a Linux-like alternative were available for this hard drive, the vast majority of people would be unaware of that or not willing/capable of figuring out how to work it and would throw the device away and replace it anyway. And even if they did save the hard drive, they might just use the money they saved by not replacing it to upgrade their com…

Hard drives are a mediocre example, but I have exactly such an enclosure sitting around that I use as cold-storage because I know better than to connect it to a network. If I want to get data off it, I set up an isolated segment in RFC3927 space.

As a result, I've bought a new NAS-type device which does have supported software and which I can put on a live network with only minimal worry. (I still take backups of course, but not as thoroughly as I should.)

That's a direct waste impact of the device being out of support. I like the form factor. I like the capacity. I wish I could just run Openwrt or something on it. (It's a Marvell SOC inside, so that's the likely target if I had porting skills.)

Re: WD My Book users wake up to find their data deleted

#589

Post by oldgradstudent »

WD My book Live updates were always problematic.

There was one update where log files filled the root partition preventing the device from booting.

I had to remove the drive from the enclosure, and connect to a computer to recover the device.

They did refund it and not asked me to return it, but it wasn't encouraging.

Re: WD My Book users wake up to find their data deleted

#590

Post by myself248 »

fooblat wrote: post #532
brobdingnagians wrote: post #405

Earlier quoted context omitted.

I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecti…

I'm with you on this one. I refuse to buy any appliance that requires a connection to the internet. I look for things that are straightforward to repair and maintain.

Agreed, but the My Book doesn't require a connection. It can use it, optionally, but I don't think it would run afoul of this prepurchase test.

Now, as for how they ended up configured to be accessible from the internet, I'm not sure. Is that a user-facing option? Is it on by default? Did WD have a responsibility to disable the feature when they stopped maintaining it?

Post reply on HN