Hacker News Reader

Comment by brudgers | Hacker News Reader

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones.

BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't care. "BIOS updates with TLS!" stickers aren't going to improve sales.

Buying a laptop creates a consumer not a customer relationship. I want to pay the least, the manufacturer wants to deliver the least. A few years out, shiny-low-cost will drive my next purchase more than brand loyalty.

View on HN

Except if that were the case, it's even cheaper to not develop a live update capability at all.

They went through the process of specifying and developing a automated utility that downloads files, parses manifests and then acts accordingly to install BIOS or other updates, tested it and bundled it with their retail system build, and after all that effort didn't take the one tiny step to sign their files or at least put a $10 TLS certificated on their servers?

To me the more likely answer is that (as observed) this dates back to XP days or even earlier, when securing this sort of stuff was not front-of-mind. Back then, finding downloadable software served over https was rare. ftp or http was far more likely. And I think ASUS just never thought about updating their tools. They worked, so never really got a thorough second look at any point up until today.

Field firmware updates for hardware are to greatly reduce the risk a product needs to be recalled -- this is a worst case scenario with great cost for the manufacturer. To some extent it also reduces the pre-ship software verification costs -- potential damage from a bug slipped is greatly reduced.

Security risks are harder to quantify for the bottom line.

To some extent it also reduces the pre-ship software verification costs -- potential damage from a bug slipped is greatly reduced.

It also encourages reducing effort spent in fixing bugs before release, which is why I absolutely loathe this "update culture": the "we can always fix it sometime later" mentality is like procrastination, and leads to barely-working products being released.

It is true that before easy field-updateability, products did ship with unfixable bugs, but I feel like it has only gotten worse from there.

My observation is that consumer grade laptops have upgradable BIOS to handle bugs, but there's only a brief lifecycle in which the manufacturer performs updates of about a year to coincide with a typical [US] manufacturer's warranty. My suspicion is that providing the upgrade service is cheaper than the combination of resulting warranty claims and potential lawsuits which could result from not fixing the BIOS automatically.

I don't deny the possibility that adding TLS to the update mechanisms might make the world better. On the other hand, I haven't seen a business case that shows a clear benefit for company's like ASUS to change all the moving parts in their logistics chain. Admittedly, I haven't looked very hard.

For no-name brands sure, but ASUS is the #1 Taiwanese manufacturer(HTC and ASUS used to vie for that position before HTC's decline).

It's a shame because they make really good hardware.

That's why this kind of thing needs to be dealt with on a legislative level.

Insecure automatic updates need to be met with automatic, unappealable per-day fines calibrated to gobble the margin this kind of behavior creates.

Then hardware manufacturers would just stop shipping updatable software.

Which might be better, but consequences of actions and all that.

True but it creates business for ThinkPad and I'm loyal to them. They fupped too though

"youre" a small enough amount that they dont care, but other niche companies like system76 will go through the trouble of testing and white labeling a machine

I'm typing this on a ThinkPad...though it was used and runs Linux and was a Buy it Now $135 including shipping on eBay. And last time I had the new laptop fever (about six months ago) ThinkPads were all I looked at...odds are though I'll buy used again.

You mean the Lenovo thinkpads which come with tons of malware like superfish and different insecure plain http update mechanisms?

Actually, the ThinkPads never came with that, only IdeaPads, etc.

That’s the advantage of using the business line of products: it’s usually not as fucked up.

Reply on news.ycombinator.com