How long is too long to wait for a security fix?

The great home network

Unfortunately, as you have already said, many people do not upgrade a single component. But who can blame them? For years they have been sold the promise of devices that just work with minimum configuration and so much of the blame is with the manufacturers. To be honest, most home users would likely screw up an upgrade anyhow - impatience causing them to turn things off etc as well as some devices having less than stellar interfaces.

I'm with the other vendor whose attitude is predominantly to force an upgrade on you. To be honest I cannot blame them as supporting multiple versions is a lot of work and encourages people to stick where they are thus cementing the problem in. You pay your money you take your choice. However, whilst this is fine in the home environment I don't think they would be able to sustain this in the SMB sector with their higher end gear. Not owning any of the rack kit I cannot say what their attitude is there. I am fine with upgrading to the latest and greatest after a few weeks so that any issues can emerge - been bitten far too many times by early adopter eagerness (which can leave you as a beta tester with some companies) to do otherwise. I wasn't too impressed with their fix which took too long (in my opinion) to release given they only did a recompile with a change to a switch.

When the openssl issues emerged the first thing I did was to close all ports maps on the router and leave nothing exposed. It was a pain in the arse but with heartbleed you just knew a script kiddy would get you with a port scan. I looked at my logs as soon as the fault was reported and witnessed scanning occurring from Rackspace hosted boxes in the US - that's when services were shutdown quicksmart.

After this episode I've now brought everything back with only SSH passed through and all other access via openvpn with an up to date install of Gargoyle on my home router.

Going forward there is a clear issue here - as these devices become more feature rich (with more attack vectors) and more accessible to your average user we are now left with a situation where, just like with the dreaded Adobe flash/reader pairing, these things need to self update unless told otherwise because the owner just won't be doing it and we don't want to be left with our data being scanned by someones convenience kit. As for the IoT, internet connected fridges and the like can kiss my arse because they will never have a place on my network.

How will we cope with the "Internet of Things"? Well judging on our current record, we wont!

"the balance between security and stability"

But stability is security, just another aspect in "Confidentiality, Integrity, Availability".

The key is layered defence - requiring attackers to break into your home to reach the management interface is one example.

For the Internet of Things, we need the manufacturers to make it easy to layer the security, not make a one-time setup insecure for "user convenience".

Home router patching? You're having a laugh...

"Patching your NAS is important, just as it is for your home router, switches, firewalls, servers and endpoints. Sadly, as has been made quite obvious, a great many people simply refuse to do so."

Last week, Orange (France) updated the firmware in (some? all?) of the domestic Liveboxes, after - when was the last update? 2012? Anyway.. This adds a nifty looking user interface that is horribly broken, gives you advanced configuration options that just don't work right (good luck associating a device with a 'fixed' IP address on the (W)LAN via DHCP), gives you an 80:20 chance that the box won't recognise a USB key plugged into it, and means the previously working DNLA server struggles with 720P and even some 480P content. The Livebox 2 (Sagem) is locked up tight. I really wish I could revert to the previous firmware, and disable auto-upgrades. Instead, we are all beta testers in software that is very clearly not up to expected release quality. I suspect this is tied in to IPv6 that Orange might be rolling out around 2017, maybe...

I am not against the idea of automatic upgrades, especially in domestic devices, however when said upgrade is clearly rushed out the door, unfinished, and mucks up stuff (people of Orange forums have reported drops in connection speeds and alsorts, but since my pipe is only 2mbit, I wouldn't notice!), it is hard to be in support of such automatic upgrades.

Point being - whether or not the home router firmware is updated is out of our hands, and it is especially galling when such upgrades are forced and offer a worse experience then before.

Best example I've see from a router/modem supplier (Dovado) has the default configuration to check daily for new firmware, once that is issued it can be configured to send an email and then it wait for a week before applying the update. That allows any issues with the firmware to spare the bulk of the user base and only hit early adopters.

"a great many people simply refuse to do so"

Sure, and for the rest of us, there are all those manufacturer's that refuse to update their firmware for bugs let alone patch vulnerabilities. After all why waste time working on stuff that is not going to make money in store next week?

- Because if you do it right, it doesn't take much time?

- Because people won't buy it if you don't maintain it. Perhaps that's why all those no-name NAS's sell so well (?) Arghhh... (trying not to get worked up).

Bring on the Internet of things (and permanent vulnerabilities)

Delayed update

We've had to delay our DSM update, because we are pretty sure it will break something, as it has in the past. Fortunately, our DSM NAS is not directly exposed to the internet: Unfortunately it is a mission-critical file server.

For whatever reason, my colleagues who specified and installed Linux & BSD derivitive workstations, appliances and servers don't think that patching and updating them is worth the effort.

this problem seems trivial compared to the latest hack!!