That's seriously messed up. I'd have to very seriously second-guess buying anything that involves software of any kind from this company.
> The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012. These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle.
So support can be discontinued after two years after introducing a product??? That's ridiculous. It's not even like this was a one-off product and they're no longer supporting that line of work. WD still sells MyBooks.
The fallout from this will be worse for western digitals brand than just patching the cloud service or smartly shutting it off if they weren’t going to support it.
The manufacturer can only provide a warranty and exclude a lot from it. Like Motorola does with the batteries of the smartphones, which only have 3 months of warranty. The seller has to cover the 2 years.
There is no obligation to support a device, like to provide firmware to fix bugs. If the hardware/firmware has a bug, it is a defect, which entitles you to a fault-free replacement within 2 years.
https://europa.eu/youreurope/business/dealing-with-customers...
In particular there is mention of purpose:
> is not fit for purpose - either its standard purpose or a specific purpose ordered by the customer which you accepted
The seller will tell you to send the item to the manufacturer to check if it is a "warranty" case. You, on the other hand, will tell your seller that you won't do that, that you will send the product to him, and that the will have to check if it is covered by the "legal warranty" (notice the difference between just "warranty" of the manufacturer, and "legal warranty" of the seller). It is up to the seller then to forward the product to the manufacturer or to provide you directly a replacement or repair it himself.
If you send it to the manufacturer, like the seller wanted you to, the manufacturer can send it back to you untouched, saying it is not covered by his "warranty". You will have to pay the shipping. Then you will have to send it to the seller, and also let him know that you had to pay for shipping to the manufacturer, that you'd like that money back as well, which the seller can reject (but probably won't).
The seller is in a worse position than the manufacturer, because only he is bound to the the things mentioned on the page you linked to.
For instance Apple had to extend its warranty to 2 years in europe, while leaving it at one year everywhere else for a while. The same way, most sellers won’t deal with makers that will put them on the spot for repeated repairs down the line.
Apple had to extend it because they are not only the manufacturer, but also a seller (same goes for Google and Microsoft).
If you buy your MacBook on Amazon then it can very well be the case that you are not getting the same warranty you get when you buy it directly from Apple. In that case Amazon is responsible for covering the difference in warranty, and you'll have to deal with Amazon if you have problems. But Amazon will tell you to send it to Apple, and if they don't cover it, send it to Amazon, and they'll either repair or replace the device for you.
> The same way, most sellers won’t deal with makers that will put them on the spot for repeated repairs down the line.
This is why the manufacturers will usually be accommodating towards the seller. You're in a better position if you let them both take care of it between themselves, instead of doing the seller's work. Of course this will take more time, but you're more likely to get a better result.
If you live in Europe, just keep in mind that you usually have more rights if you contact the seller instead of the manufacturer, as there's no small print you'd need to read on a warranty card. Either the device works or it doesn't.
These WD devices were phoning home on scheduled intervals and it appears that got issued a factory-reset command, but only at the “quick” format level so everything might still be there but will need to go through a recovery procedure.
If you connect a device to the Internet, you must maintain it. If it's a server, you need typically some system administrator behind. If it's a hardware object such as a camera or a NAS, you need a maintenance contract.
Having a device connected to the Internet without any maintenance is asking for troubles.
This is the only wrongdoing here for WD: not informing their customer that "end of life support" strictly means "DO NOT CONNECT ANYMORE TO THE INTERNET YOU FOOLS!"