• 0 Posts
  • 83 Comments
Joined 1 year ago
cake
Cake day: June 22nd, 2023

help-circle

  • But even the car thing is not the responsibility of the manufacturer to fix. It’s the owner’s responsibility and only of they actually are using it.

    If companies have to update all products to keep up with modern safety standards, it would mean no new products would ever be made and the products would be exceptionally expensive since you’d only buy them once. That’s not the type of economic system we live in.

    And no, a router that is defective is not going to tank the digital economy just because the manufacturer doesn’t fix it. Definitely not a d-link product. That’s why enterprise grade commercial products are so much more expensive. They are designed for longer life. If that’s what you want, then buy a commercial product and pay the company a subscription fee for support or warrantee in cases like this.



  • Those are things that get inspected regularly because of public safety issues, not ownership issues, and in the US at least, that only happens in a subset of states anyway. That is about using something you know will likely hurt someone vs using something you know will hurt you and possibly your customers. There’s a big difference in liability there.

    Vacuums for example do not get regular inspections, and owners are allowed to use any product they want, even defective ones, in their own home or business, even if they pose, say, an electrical shock risk or something else that wasn’t something that would have made it fail its initial certification. We don’t force vacuum manufacturers to fix old product design issues.

    And even if we did, how long back would we make them fix? Would 100 year old vacuums need to be brought up to modern safety standards like grounded plugs and all of the wiring to be redone to ground all the parts or more modern motors that use less power so they don’t need to be grounded? What if only one person in the whole world still uses that product?

    It’s just not a reasonable thing to expect re-engineering old devices when a new potential owner safety issue is found.




  • I’m not saying they shouldn’t fix the issue necessarily, assuming it’s even possible. I’m saying they shouldn’t be held to higher standards than any other product just because the engineering effort involved in software is undervalued compared to physical objects. If a product made 15 years ago didn’t follow modern safety standards and is no longer being sold by the manufacturer, we don’t make them update their old products.

    As for tooling, yes, and with software it often requires “tooling” that no longer exists in order to develop the patch including hardware that may no longer be manufactured. It’s not like the product manufacturer manufactures all of the parts like circuits and microchips. Just like vacuum manufacturers don’t usually make the bearings and gears and such, they just assemble them. So same concept.

    We may require them to keep parts with the existing design, but we don’t require them to fix safety issues that were not found to be out of compliance when it was originally approved for production. We might make them fix it if they’re still selling them, but we don’t make them fix these issues if they are not.











  • You have to put on a show that you are sticking to those processes, on paper. But the fines for data breaches are generally way less than they save on not having a fully funded IT department and using security products that someone got a kickback for rather than the best product.

    “Hacking” isn’t some magical, intensely creative process for geniuses loke on TV. For the most part, it’s usually just finding the really common things that IT departments don’t do because they are underfunded and treat IT people like replaceable cogs. There is software out there to exploit those deficiencies. So they are forced to do things like use default or obvious admin passwords because who knows who is going to be there tomorrow to fix something and without the proper tools to store credentials, there’s no way to properly secure things.

    And when a security vulnerability is found, there’s a reason why many don’t bother informing the company before going to the media. Those companies pour tons of money into lawyers to avoid admitting the fault, often getting the innocent person who found the problem arrested, and never fix the actual issue. Just ask any pro whitehat security researcher not hired by the company all the things they have to do to protect themselves from being sued or arrested for “hacking” when they notice a problem.

    And government technical auditors are a rarity because the regulators are underfunded. So they might go through some small list of things during regular audits, but they don’t know to check if a DBMS system that contains backups and is stored “in the cloud” is using a default password or other common hacking targets. Hackers don’t go after the primary infrastructure most of the time. It’s not necessary because there are so many sloppy processes or left over insecure projects that “the last guy” was working on or that got defunded before it was completed, but only the primary infrastructure gets audited usually because that’s all there is time and money for.

    As for going somewhere else, there often aren’t other places to go and when there are they usually have the same problem because there’s very little reason for any of them to compete with each other. Most industries have consolidated so much that there are only a handful of parent companies left so it’s easy to collude just because their leaders are often all in the same room at conferences and such.