PC Gaming

8559 readers

551 users here now

For PC gaming news and discussion. PCGamingWiki

Rules:

Be Respectful.
No Spam or Porn.
No Advertising.
No Memes.
No Tech Support.
No questions about buying/building computers.
No game suggestions, friend requests, surveys, or begging.
No Let's Plays, streams, highlight reels/montages, random videos or shorts.
No off-topic posts/comments, within reason.
Use the original source, no clickbait titles, no duplicates. (Submissions should be from the original source if possible, unless from paywalled or non-english sources. If the title is clickbait or lacks context you may lightly edit the title.)

founded 1 year ago

MODERATORS

[email protected]

376

D-Link refuses to patch a security flaw on over 60,000 NAS devices — the company instead recommends replacing legacy NAS with newer models (www.tomshardware.com)

submitted 5 days ago by [email protected] to c/[email protected]

57 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 11 points 5 days ago (1 children)

It looks like they just didn't neutralize/sanitize controllable input data so it should be a pretty easy fix. I think if a security researcher gives you a layup by identifying an easily fixable vulnerability a company should just take it, even if the product is old. If for no other reason than it's bad marketing when news articles like this come out.

[–] [email protected] 3 points 5 days ago

Yeah, I know what you mean, and yep it looked like just input sanitization on a very specific thing. I don't disagree, headlines being headlines, and even just broad benefit vs. overall level of effort seems pretty positive to me from an outsider's perspective.

But then again, issuing a firmware update is also an implicit guarantee that no (unrelated) functionality will degrade, which really needs a degree of testing in order to be a responsible business decision. And then on the optics side, I can see there being a benefit to a hard line in the sand regarding EOL, vs getting into the weeds of determining on a case by case basis what merits violating their own policy, and all the implications such granular judgment calls would entail (although they and all others probably must do something similar, to some degree).

Idk, I don't own much or any of their stuff these days, no real skin in the game, nor do I have any particularly relevant info or opinions on the company. Just rambling lol.