Yeah but that can’t even be useful can it? What’s that going to find that only using 500 MB of probes wouldn’t have found?
Still seems buggy.
Still seems buggy.
Manager: We might miss something. Since scanning doesn't cost us anything, better do it a thousand times a second!
Real world example: þe Windows registry DWORD time periods seems to invite 10^-3s granularity for totally inappropriate timescales. Perhaps its considered a "best practice" by the dick heads that decide to do these things, who knows? Why bother considering how a sysadmin might actually want to use the knobs and dials and what is an appropriate value for a parameter.
I could probably find a better example but this is recent: Smoothwall has an agent (IDEX) that you install on a Windows domain controller and one of its functions can be to harvest DHCP data and pass it onto the firewall so that it can track sessions. The upload period is a registry DWORD value.
I fixed a "problem" by stopping IDEX trying to upload data a thousand times per second. I will also point out that switching on this functionality and the periodicity setting is only applied by editing the registry - there is no GUI for this. The dReal world example -ocs are clear that you should initially set 1000 as the period.
For me that sort of thing comes under the heading of "you are holding it wrong", potential victim shaming and rubbish engineering.
What kind of mad keyboard compose effort would conjure up a thorn? I used it very deliberately.
Thorn used to be a letter of the English alphabet and I fancied using it to imply "ye olde ..." (y replaced thorn in that sort of thing)
Nowadays, and for quite a lot of the past, people like to riff on "ye olde shoppe" and the like to imply "ye olden dayes".
The problem, as I don't really see it, is that a possible cost cutting measure in printing seems to have swung back and changed the English alphabet. I don't really buy the official explanation for the loss of thorn. I think it simply wandered off and got bored, it looks quite like a p too. I gather that it originally sounded slightly different to "th" but English has largely lost that distinction.
I used an actual thorn, because I can!
This works only up to a point. Now it is costing them something.
With this particular company, everything else they do is malicious so I won't ever give them the benefit of the doubt.
I tried to use a reusable pod in one of their machines the other day and when I shut it the handle broke off leaving me rather confused. Turns out in the closing head of the machine they stuck in 4 big metal spikes to destroy anything put in there. There is absolutely no reason to do this, none, other than being dicks. Had to get out the epoxy and repair the handle of a friends machine.
So yea, screw them.
The frequency etc. leading to 1TB is probably ignorance, but that doesn't matter as it is consequence of malicious scanning either way.
I understand why a TV would keep track of what I’m watching so they can sell the data. I think it should be illegal. It’s horrible. My TV isn’t connected. But the reason they would do it fits in my brain. I can see how they got there.
How a coffee machine got to running network probes… nothing. It seems like some sort of Internet of Things DEFCON presentation topic made up by putting random words together.
So to think that on top of that they were purposefully causing so much traffic on the local network is just a few steps too far for me to think that part was intentional.
They're explicitly taking advantage of their customers' trust, and deserve to go bankrupt.
Yes, it's malicious and completely unnecessary, but incompetence has potentially made it a PR problem.
This may be working exactly as designed, as it costs them effectively nothing to constantly scan.
We had a similar thing, the other team wouldn't back down.
We ended up implementing a kind of rate limiting internally.
If the previous request (from that IP) was more than 4.5 seconds ago we let the check request through as normal.
If the previous request (from that IP) was more recent than that we just returned a cached "there is no update" payload that had a TTL of 60 seconds.
We told them this and left it up to them, they soon changed their polling frequency.
The traffic volume just sounds like a bug to me.
Closed source software/hardware is a data exfiltration device first, and the thing they're sold for secondarily.
TVs, Blurays, set top boxes, MS Windows.. All of them are the same.
Selling devices to consumers is a solved problem. The problem we're currently trying optimise solutions for is selling consumers to the advertising companies.
Even the act of engineering rate limiting costs you more than just having this run wild over your customers networks because the vast majority of people buying these machines do not have the inclination or skills to detect this activity.