Hacker News Reader

The state of SOHO router security is pretty sad. Sure, most of those infected were probably unpatched, possibly had remote-admin pages enabled, or were using default credentials but... why is it even possible to open the remote admin interface with default passwords?

Why don't they all auto-update by default for critical vulnerabilities?

View on HN

> Why don't they all auto-update by default for critical vulnerabilities?

Because it costs money for manufacturers to implement and maintain this functionality, and there's (currently) zero benefit to them for doing so and (currently) zero repercussions for doing what they do today after they sell you a device: nothing.

If the auto update happens to brick the device, it becomes expensive for the manufacturer.

Most of them have many models. Probably many are developed with copy-paste fashion, meaning separate updates and separate testing for each model.

Reply on news.ycombinator.com