Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running late for college, and the scooter is stuck in an update

old.reddit.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Running late for college, and the scooter is stuck in an update

#51

Post by nonrandomstring »

ryandrake wrote: post #45
nonrandomstring wrote: post #44

Earlier quoted context omitted.

> I dont care if the software is vulnerable to CVE-1234567 But your neighbour plugged into a life-support machine at the local hospital does, because your machine could be used as a staging point for further attacks. When we built an "interconnected world" we created interconnected responsibility. That said, I agree with you that products that assume permission to connect to the internet and update when they feel lik…

Yea I should clarify. I do care about CVEs and actively seek out and patch security vulnerabilities in the software I run. What I don’t care about is the manufacturer’s panic over the CVE, and their insistence on usurping my power to control my device, using the CVE as an excuse. Is that more understandable?

Yes definitely. I feel it's an important distinction to make because otherwise the authoritarians and profiteers of "for your own good" will jump on that and say "See! These stupid users claim not to care about security. We must mandate manufacturers manage that after purchase".

Nobody wants that, least of all manufacturers, unless they can use backdoors to spy on and ransom customers like printer and car makers are starting to.

Re: Running late for college, and the scooter is stuck in an update

#52

Post by cesarb »

nonrandomstring wrote: post #44
ryandrake wrote: post #37

Automatic updates are terrible and the first thing I do when I get a new device or reinstall an OS is try to figure out how to disable them. Sadly, I am losing this battle and more and more stuff insists on updating behind my back, without me commanding them to update. This should be unacceptable. When I buy something I should be in full control of what it’s doing, not the manufacturer. I dont care if the software is…

> I dont care if the software is vulnerable to CVE-1234567 But your neighbour plugged into a life-support machine at the local hospital does, because your machine could be used as a staging point for further attacks. When we built an "interconnected world" we created interconnected responsibility. That said, I agree with you that products that assume permission to connect to the internet and update when they feel lik…

> But your neighbour plugged into a life-support machine at the local hospital does, because your machine could be used as a staging point for further attacks.

Unless your machine is in a particularly privileged position (for instance, it's plugged into the hospital non-public network), there's nothing special the attacker can do with your machine that they couldn't do with their own machines. So this is just fear-mongering.

Re: Running late for college, and the scooter is stuck in an update

#53

Post by peteradio »

nonrandomstring wrote: post #38

The fundamental mistake of software engineering here is not when the "scooter" updates, but that it updates at all. Not everything that uses electricity requires an embedded computer connected to the internet. We could ask the question as: Give me a list of good reasons why a scooter should be connected to the internet? We might get answers like: The built in map or GPS needs updating The pricing list for hire needs…

But its Agile! This way you can release a known broken product and "fix" it for the next decade under a maintenance contract.

Re: Running late for college, and the scooter is stuck in an update

#54

Post by cesarb »

Al-Khwarizmi wrote: post #14
wongarsu wrote: post #7

Earlier quoted context omitted.

Windows has gotten pretty good at staying out of your way with updates if you have typical usage patterns. That is: either you turn it on at the beginning of the business day, it downloads updates in the background and installs them when you shut the machine down at the end of the day; Or you leave the machine on 24/7, get a couple prompts over multiple days about a scheduled restart with the option to schedule it, a…

Updates on shutdown make sense in some of my machines but are awful in the laptop I use to teach classes. When I finish a class, what I want is to leave to do something else elsewhere (often another class in a different room). I know I could probably suspend or something, but I never do that because it used to be a lottery on Windows whether your machine would actually unsuspend or you would need to fight it pressing…

> Updates on shutdown make sense in some of my machines but are awful in the laptop I use to teach classes.

It's also a bad idea when the power has gone out and the UPS battery will last for only a few more minutes. Or when you have no UPS, a storm is coming which you know will cause the power to fail, and you want to orderly power everything off as quickly as possible (not to mention that losing power during a software update is not ideal).

Which is why I love the way recent Gnome does it: when powering off, the confirmation dialog has an unobtrusive checkbox (checked by default) which selects whether you want to run software updates before powering off. If you're not in a hurry, you can keep it checked and wait for the software updates to finish; if you're in a hurry, just uncheck it before confirming and it'll turn off immediately.

Re: Running late for college, and the scooter is stuck in an update

#55

Post by schmookeeg »

dylan604 wrote: post #46
rjsw wrote: post #28

Earlier quoted context omitted.

Zoom asks if you want to update after a call, which seems the best time for it to me.

I just use the browser version, so I assume it is always the latest version. This is one of the compelling arguments for everything is a web page/app. A single centralized place version millions of separately controlled copies.

And the equally compelling anti-argument against everything-is-a-web-page is every time I go to a website I haven't been to in awhile (and some I use on the daily), I need to swat away a cacophony of "What's New! Let's Take a Tour!" popups, like so many cobwebs. :)

Re: Running late for college, and the scooter is stuck in an update

#56

Post by dylan604 »

schmookeeg wrote: post #55
dylan604 wrote: post #46

Earlier quoted context omitted.

I just use the browser version, so I assume it is always the latest version. This is one of the compelling arguments for everything is a web page/app. A single centralized place version millions of separately controlled copies.

And the equally compelling anti-argument against everything-is-a-web-page is every time I go to a website I haven't been to in awhile (and some I use on the daily), I need to swat away a cacophony of "What's New! Let's Take a Tour!" popups, like so many cobwebs. :)

of course there are people that want to be examples of "you're why we can't have nice things" or "ruining for the rest of us"

Re: Running late for college, and the scooter is stuck in an update

#57

Post by nonrandomstring »

cesarb wrote: post #52
nonrandomstring wrote: post #44

Earlier quoted context omitted.

> I dont care if the software is vulnerable to CVE-1234567 But your neighbour plugged into a life-support machine at the local hospital does, because your machine could be used as a staging point for further attacks. When we built an "interconnected world" we created interconnected responsibility. That said, I agree with you that products that assume permission to connect to the internet and update when they feel lik…

> But your neighbour plugged into a life-support machine at the local hospital does, because your machine could be used as a staging point for further attacks. Unless your machine is in a particularly privileged position (for instance, it's plugged into the hospital non-public network), there's nothing special the attacker can do with your machine that they couldn't do with their own machines. So this is just fear-mo…

> there's nothing special the attacker can do with your machine that they couldn't do with their own machines.

Any obtainable CPU power, memory, IP address or storage is an asset, so they could:

  Run processes such as password cracking on your machine while still
  having their own to use.

  Store sensitive or illegal data encrypted on your disks as a dropbox
  for themselves or others.

  Launch recon scans or attacks from your device, using your IP address
  while staying hidden and leading the authorities back to you.

  Set up your machine as a proxy for routing other traffic, leveraging
  your geographical location.

  Set up your machine as a node in a distributed compute farm for
  mining, cracking or other tasks.

  Sell access to your assets to other bad hackers.

  ... we could literally go on for hours with ideas about how using
  *your computer instead of their own* gives an advantage and thus
  presents a motive.
> So this is just fear-mongering.

Two points I'll make:

  Maybe you *should* be afraid of all the ways contemporary
  cybersecurity is an absolute shitshow. Fear is not the best motive,
  but *is* a motive for making changes. There's a reason we have that
  part of our brains and the emotion it provides.

  I'm sorry you feel worried about what I said. Even though the
  threats are real I don't believe in scaring people. I think a better
  way is through education and empowerment.  That's why I produce work
  like the Cybershow [0], where we try to make cybersecurity a little
  bit fun and irreverent. Come and listen to some shows if you care
  about computer security for yourself and people you love.
[0] https://cybershow.uk

Re: Running late for college, and the scooter is stuck in an update

#58

Post by nonrandomstring »

peteradio wrote: post #53
nonrandomstring wrote: post #38

The fundamental mistake of software engineering here is not when the "scooter" updates, but that it updates at all. Not everything that uses electricity requires an embedded computer connected to the internet. We could ask the question as: Give me a list of good reasons why a scooter should be connected to the internet? We might get answers like: The built in map or GPS needs updating The pricing list for hire needs…

But its Agile! This way you can release a known broken product and "fix" it for the next decade under a maintenance contract.

I hear you, but let's not "blame Agile"

Also the key problem is not iterated development but remote access (AKA backdoors) baked into designs as a way to hedge bets.

There's some cases where remote field maintenance is absolutely the right thing to do.

You would not send a space probe to Mars without the ability to radically change its software while in service.

When facing unknown future conditions the concept of deferred functionality is essential.

In situations of consumer electronics, which are designed, purchased and deployed within a rigid set of operational expectations, deferred functionality is a MASSIVE security risk and a subversion of expected trust models.

Convergence means that these days I can literally turn any of your devices into anything else... your wall clock into a radio, your fridge into a web-server, your television into spy camera.

It's not Agile as a development philosophy that is somehow "to blame" but its corruption by the devious into an excuse for reserving the ability to change functionality while hiding behind the plausible deniability of "necessary maintenance".

Re: Running late for college, and the scooter is stuck in an update

#59

Post by leros »

thebruce87m wrote: post #41
smallmancontrov wrote: post #23

Earlier quoted context omitted.

Holy shit, that's a real thing and not just a meme? They don't let you cancel the update because you need your car to get you from point A to point B? That's, uhhh, really bad.

You can schedule it for the middle of the night. You can manually do it whenever, but it takes 30+ minutes.

He did his manually for some reason and I know it took a few hours.

Re: Running late for college, and the scooter is stuck in an update

#60

Post by leros »

D13Fd wrote: post #47
rjsw wrote: post #28

Earlier quoted context omitted.

Zoom asks if you want to update after a call, which seems the best time for it to me.

Is that true? Maybe it's different on Mac OS, but for me (on a Mac), Zoom wants to update every time I open it, and often fails. It's very annoying.

I am a few minutes late to meetings probably once a month because Zoom forces as an update right as I'm logging into a meeting.
Post reply on HN