Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

391–400 of 701 posts

Re: WD My Book users wake up to find their data deleted

#391

Post by slavik81 »

haswell wrote: post #182
bigiain wrote: post #126

Earlier quoted context omitted.

Also - age is of zero relevance to internet connected linux devices? I rely on many "8-10 year old device that hadn’t received a security update in 6+ years". My coffee machine. My fridge. My hifi. All my motorcycles. None of them run linux and are directly connected to the internet.

But think about this from the perspective of the average buyer/user. Hard drives are traditionally "local". Local = safe. Now, a new generation of drives are introduced with this awesome capability to get access to data remotely. "Cool", they think. They don't understand how the Internet works, and so they don't really see the issue, or if they have a basic understanding of networks they might understandably believe…

The remote access feature was disabled by default. For many people, the only reason it was accessing the internet was so it could get security updates.

Re: WD My Book users wake up to find their data deleted

#392

Post by andi999 »

bellyfullofbac wrote: post #390
andi999 wrote: post #376

Earlier quoted context omitted.

You have a Citation? I read 5-7 years.

Pixel XL released October 2016 (from [1]), no guaranteed updates after October 2018 [2]. I looked at the Pixel 4, released October 2019, discontinued October 2020, no guaranteed updates after October 2022... [1] https://www.gsmarena.com/google_pixel_xl-8345.php [2] https://support.google.com/nexus/answer/4457705?hl=en#zippy=...

That is not at best, probably this is at worst. But thanks for the info.

Re: WD My Book users wake up to find their data deleted

#393

Post by joering2 »

oblio wrote: post #312
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

Moreover, I think WD defense here will be that while you could, you did not have to plug your WD device to internet, in order for it to serve its purpose. They will try to argue that the majority of their offer is hard discs, and if your drive has extra ability to connect to internet, that's extra feature.

Re: WD My Book users wake up to find their data deleted

#394

Post by johannes1234321 »

tamlin wrote: post #298
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

Typically when building a device like this you get a version of Linux / embedded-OS from the SoC vendor and you are stuck with it because SoC vendor doesn't provide docs that would allow drivers to be maintained. This makes ongoing support harder than it might otherwise be.

When taking in third party dependencies you take over responsibility.

If I build a machine and the third-party screws I use break my customers come to me.

If I use bad quality npm modules as dependencies it's my bad.

If I use an embedded system with flaws it's my issue.

Re: WD My Book users wake up to find their data deleted

#395

Post by deckard1 »

jxramos wrote: post #39
munk-a wrote: post #26

Earlier quoted context omitted.

> Cloud backup is a stupid idea. At any moment it could go dark, for any reason, and you have no recourse. Might as well bare your throat and hand some random stranger a razor. I really disagree - physical storage in your home is the common alternative for a lot of consumer users - and that physical storage will involve maybe unplugging your external hard drive between backups - but otherwise never checking for the c…

do you know of any tools for consistency/accuracy? I've been meaning to do some basic md5 checks for all my files but haven't gotten around to it. Every now and then I find a corrupt jpg image that has a rectangular band running through it or something of the like.

parchive and md5deep

http://md5deep.sourceforge.net/

Re: WD My Book users wake up to find their data deleted

#396

Post by satyamkapoor »

sharken wrote: post #286
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

It's more like a business failure as in the decision to discontinue the devices were taken prematurely. But really as pointed out above, any IoT device will eventually have a security flaw discovered if updates are stopped. As a consumer the best bet is to switch to a supported device or disconnect the device from the internet.

True. This is what should be written in bold when you are buying any IoT device specifically those consumer grade lamps from small firms.

It's fun to control around from our phones but after 2 years it won't be much fun someone else controlling around

Re: WD My Book users wake up to find their data deleted

#397

Post by tomnipotent »

roblabla wrote: post #381
tomnipotent wrote: post #344

Earlier quoted context omitted.

> Because if you need a hard drive This is the third such major scandal from WD in as many years. First, selling SMR drives as CMR. Second, selling 7200RPM drives as 5400RPM. Now this. They've lost a lot of credibility, and I don't see any of the other manufacturers having issues rivaling WD.

> selling 7200RPM drives as 5400RPM I suppose you mean the other way around? Otherwise, what's the problem with selling a higher RPM device as a lower one? Isn't higher RPM better? (Genuine question, I don't know much about HDD).

> Isn't higher RPM better

WD Red is marketed for NAS/storage, where it's not uncommon to have 4/8/12/16 drives in the same chassis where noise/heat becomes a very different problem. It turns out that the drives generated the same heat and consumed the same power as 7200RPM drives, while the data sheets were outright lies and BS. WD decided on double down on the BS for several months, and only recently released new SKUs where the specs matched the marketing.

Re: WD My Book users wake up to find their data deleted

#398

Post by rocqua »

ChuckMcM wrote: post #278
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

> I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life?

Any situation where "you are on your own" should include the dropping of protections preventing you from actually fixing the device. If the manufacturer refuses to produce updates, that should NOT mean there is no way to update the software on the device.

Re: WD My Book users wake up to find their data deleted

#399

Post by alpaca128 »

slipframe wrote: post #367
nextlevelwizard wrote: post #229

Earlier quoted context omitted.

You don’t have that either. Stop the FUD. Just don’t have your only backup be connected to the Internet with remote wipe capabilities

How many My Book customers would even understand the meaning of your [correct] advice? When companies fuck people over with a defective product, we should resist the urge to tell the victims to be more tech savvy and not use those sort of products. Particularly when those products are intended for the general public.

It's always the same old thing. But the fundamental problem will never vanish: computers are complex, and no matter how hard you try with neat packaging and software, this complexity cannot be hidden. Sooner or later the illusion bursts at its seams and the user discovers another failure mode that they weren't even aware of.

WD really messed up there - but they and others will mess up again, so if the user's goal is not losing any data they'll still need to do more than buy the next shiny thing and click "accept" on the EULA. Because in the end pushing around the blame won't get you the files back.

Re: WD My Book users wake up to find their data deleted

#400

Post by caconym_ »

romwell wrote: post #3

There are two kinds of users: those who back up their data, and those who haven't experienced a data loss yet. This is your daily reminder that anything that's connected is not a backup . Yes, that includes the hard drive in your machine. For that matter, RAID is not a backup solution. Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically. That's not backup. And that includ…

> There are two kinds of users: those who back up their data, and those who haven't experienced a data loss yet.

I have never had a significant data loss, and I back up my data.

The weaknesses of cloud are obvious, and alone it's not enough, but leaving it on the table is dumb unless you have some other way of practically and reliably maintaining a far-offsite copy. Most people don't, and even fewer people have a good reason to bother when they're employing offsite backups as part of a broader strategy like 3-2-1.

Post reply on HN