If a user forgets their password or buys a used drive then they won’t know the password. It’s common in the hardware industry to be able to factory reset a device somehow.
Isn't this the reason for a hardware reset button?
Having this available over the internet is probably negligent.
I would think it would run a firmware function to do the resetting, and if not that, then some sort of sell script that is not callable by their web interface.
Due to all this stupidness, my weekend is going to be consumed by trying to find out if my Synology has something stupid in it (assuming I can even figure that out).
So my trust in "personal" network storage devices has been shattered. Hopefully Synology is not as dumb.
1) devices only I have write access to 2) devices others have access to 3) iot (which are basically users I've never met)
At least I can segregate me running a port scan from my laptop, to a family members phone running a portscan from some spyware game they downloaded.
I have a good idea how much I can trust my own devices, even if my phone's baseband OS is sending an unstoppable stream of location data and super cookies.
But this NAS/cloud connected storage thing is a bit of a oddball, since you're supposed to trust it with your data, but can't trust it with unfettered network access.
So I'm reading up on TrueNAS to see if that's the way for me to go.
Frankly, I love my Synology, but it at EOL (can't do the new version of DSM) but my needs are pretty simple, hence either straight Linux or TrueNAS seem to be my best options.