Hacker News Reader

Comment by TheCapn | Hacker News Reader

> "It was not immediately clear whether or not the company has released any patches for this, with the page on its website merely referring readers to a login-protected page."

Or as I learned in the last week with Cisco, it doesn't even matter if you have an account! You can't download software updates to the hardware they sold you unless you pay extra for a Service Contract!

Leaving security holes in the software? Well gosh, we're real sorry about that. How 'bout you cough up a nominal fee for each of those "Security Appliances" you bought so we can give you the privilege of fixing our mistakes. Thanks!

View on HN

That is completely untrue. You can open a case and get access to downloads outside your support contract if you reference a vulnerability that’s affecting your current hardware.

> open a case and get access [...] if you reference a vulnerability that’s affecting your current hardware.

Ok, but that's bullshit, isn't it? Not all customers are going to be proactive/attentive enough to know their hardware is vulnerable. Cisco knows there is vulnerable gear in the wild, knows there is a fix, but withholds the fix until people come begging? Almost feels like the sort of thing that should be illegal (or at least on the losing end of a civil suit).

Didn't Microsoft do something similar by stopping support for Windows XP, but providing support longer for people who pay special support contracts?

Of course Microsoft also released some free security updates beyond the date too.

"I'm not holding you hostage and demanding $20k, you can instead just give me your first born child!"

Holy crap does anybody actually think that's remotely acceptable behavior? I get better support on discounted Chinese routers I've bought in back alleys - they at least put out their patches for free.

Really? So my cisco home modem messing up DNS and appending Utopia.net, burned in hardware by cisco will get a new firmware if I just ask for it?

Please go on and let me know where I can open this case.

I am not sarcastic, I really need that fixed.

That's ridiculous.

Most security-critical devices are moving in the direction of auto-updating. I'm not super into that, but I see the justification. You're telling me that Cisco is so far in the opposite direction that if I want to patch a device, I can't download the firmware myself, I have to open a service request saying, "I'd like the latest security patches", and then answer the question, "Why? What specifically are you worried about?"

That is not the setup of a company that cares about security.

Putting firmware patches behind any kind of account authentication is mind-boggling to me. I wouldn't have guessed that there's a hardware company that does that.

HPE is like that too. I see lots of their servers show up on Craigslist, but hell if I would buy one when I can't get BIOS updates, especially in the post-Meltdown/Spectre world.

The kernel will patch the microcode well before any untrusted code is run too.

Until the "untrusted code" patches the kernel.

All of the meltdown/spectre mitigations will be added by un up to date kernel even without the BIOS doing it, during the normal boot up process.

If untrusted code can patch the kernel after that, then it's already ten kinds of game over. Also, if this attacker can patch the kernel, then it can patch firmware, as they run at the same security context.

Reply on news.ycombinator.com