<story><title>Router Firmware Backdoor</title><url>http://blog.ensolnepal.com/router_backdoor/</url></story><parent_chain><item><author>cnvogel</author><text>&amp;gt; Every user need to know their devices and vendor before purchasing.&lt;p&gt;This completely ignores the reality of how the majority of people buy and use their computers. Sure, personally I (as: the HN user typing this comment) can portscan my router, solder in the serial port to get the system console... but that&amp;#x27;s not something that can reasonably be required from any average Joe.&lt;p&gt;Things on that level of negligence should be dealt with just like bare cables touchable from the outside: Have some entity go into stores, buy the box, check it for the worst vulnerabilities, declare it unsuitable for sale and place a ban on the vendor.&lt;p&gt;We do this for childrens&amp;#x27; toys, electrical appliances, ... why not do it for IT equipment? Just to weed out the worst offenders in terms of security holes.</text></item></parent_chain><comment><author>userbinator</author><text>Be careful what you wish for... giving more control to the authorities is something that may have quite oppressive long-term effects.&lt;p&gt;You might solve this problem in the short term, but end up with only being able to buy approved devices containing more obscure, government-sponsored backdoors instead.</text></comment>
<story><title>Router Firmware Backdoor</title><url>http://blog.ensolnepal.com/router_backdoor/</url></story><parent_chain><item><author>cnvogel</author><text>&amp;gt; Every user need to know their devices and vendor before purchasing.&lt;p&gt;This completely ignores the reality of how the majority of people buy and use their computers. Sure, personally I (as: the HN user typing this comment) can portscan my router, solder in the serial port to get the system console... but that&amp;#x27;s not something that can reasonably be required from any average Joe.&lt;p&gt;Things on that level of negligence should be dealt with just like bare cables touchable from the outside: Have some entity go into stores, buy the box, check it for the worst vulnerabilities, declare it unsuitable for sale and place a ban on the vendor.&lt;p&gt;We do this for childrens&amp;#x27; toys, electrical appliances, ... why not do it for IT equipment? Just to weed out the worst offenders in terms of security holes.</text></item></parent_chain><comment><author>jakejake</author><text>I&amp;#x27;m sure somebody will probably point out to me why this is a terrible idea, but I have thought that ISPs probably can detect traffic known to be coming to&amp;#x2F;from bot networks and then send a letter of warning to the customer.  They can do it for supposedly illegal file sharing, so why not do something helpful and let customers know that fishy traffic is coming from their system?&lt;p&gt;I don&amp;#x27;t mean they should be able to shut you off or anything, but I personally wouldn&amp;#x27;t mind a notification letting me know that I may have been hacked.</text></comment>