News for hackers. Stuff that matters.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by fauigerzigerk on Sunday June 05, 2016 @09:15AM (#11840767)
Astonishing. Is there any PC maker left that hasn't been found to be grossly negligent or actively malicious?
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by fallenshell on Sunday June 05, 2016 @09:27AM (#11840833)
Purism and Apple
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by Nullabillity on Sunday June 05, 2016 @10:38AM (#11841179)
> Apple

"or actively malicious."

Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by TazeTSchnitzel on Sunday June 05, 2016 @11:01AM (#11841294)
How are Apple actively malicious?
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by Nullabillity on Sunday June 05, 2016 @12:12PM (#11841619)
Let's see here:

* Started the trend of non-replaceable batteries in phones

* Started the trend of non-replaceable batteries in laptops

* Started the trend of locked-down devices where the owner can't decide what software to run

* Custom screws in order to prevent people from fixing their devices

* Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices

* Soldering in stuff that doesn't need to be

And so on, and so forth. It'd be easier to come up with a list of good decisions they've made. In fact, for the sake of balance, here you go:

Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by blkhp19 on Sunday June 05, 2016 @01:38PM (#11842072)
I'm certain that if you are really honest with yourself, you'll agree that the "malicious" practices you point out are entirely different - not even comparable - to the security negligence pointed out in the OP. When I buy an Apple computer, I'm aware of everything you listed - and in fact, I enjoy it. I don't want to worry about a thing when I buy my computer. I'm not interested in self repairing, upgrading, or tinkering. If I buy an Asus however, I would have had no idea that my entire system was at risk. That kind of negligence is malicious in my eyes - not creating closed off hardware.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by TazeTSchnitzel on Sunday June 05, 2016 @05:26PM (#11843221)
Apple's devices tend to be more difficult to repair or upgrade yourself, yes, but this is not malicious, even if it is somewhat hostile.

Also, I should point out that while Apple's phones don't let you install unapproved software, this isn't true of the Mac, which, unlike Microsoft-approved PCs[0], lets you install alternative operating systems (you can even boot to DOS!), disable its security features, etc.

[0] I know that MS do allow OEMs to allow disabling Secure Boot, but it's not required as of Windows 10. Meanwhile, Apple's computers don't have it in the first place!

Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by Nullabillity on Monday June 06, 2016 @06:58AM (#11845806)
> Apple's devices tend to be more difficult to repair or upgrade yourself, yes, but this is not malicious, even if it is somewhat hostile.

If they consciously take a hostile action (and let's face it, you don't accidentally design a new screw) then yes, I'd call that malicious. If you do that repeatedly then I'd consider you evil.

> Also, I should point out that while Apple's phones don't let you install unapproved software, this isn't true of the Mac, which, unlike Microsoft-approved PCs[0], lets you install alternative operating systems (you can even boot to DOS!), disable its security features, etc.

Gatekeeper seems like a step towards it. And regardless, Microsoft isn't exactly a paragon to compare yourself against.[0]

[0]: https://www.youtube.com/watch?v=FlcngdW2Ju4

Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by TazeTSchnitzel on Monday June 06, 2016 @07:15AM (#11845865)
Gatekeeper applies only to GUI apps and can be trivially turned off.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by Nullabillity on Monday June 06, 2016 @07:40AM (#11845978)
For now.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by prashnts on Sunday June 05, 2016 @01:36PM (#11842053)
Right. These can also be interpret as their reason to make slimmer devices. People buying these products would presumably know what they're getting into.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by rincebrain on Sunday June 05, 2016 @01:38PM (#11842069)
Custom screws, unless they're customized beyond the driver required to remove them, almost certainly don't qualify as a tool for making slimmer devices.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by xiaoma on Sunday June 05, 2016 @05:28PM (#11843222)
How does needlessly soldering ram in make a device slimmer?
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by TazeTSchnitzel on Sunday June 05, 2016 @05:29PM (#11843225)
Replaceable RAM modules take up more space.
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by kosmic_k on Monday June 06, 2016 @04:30AM (#11845372)
4 out of 6 complaints here all help reduce the size of an electronics product.

In fact some of those decisions led me to chose an Apple product over a non apple one.

Locked down software ended up being a business decision for Apple's App store. As for the screws, I have no idea, but you can easily find appropriate screwdrivers online so it doesn't seem like that big of a deal to me.

Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by Nullabillity on Monday June 06, 2016 @06:53AM (#11845791)
> Locked down software ended up being a business decision for Apple's App store.

Just as all the others? That's not a defense.

Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by dump121 on Sunday June 05, 2016 @09:48AM (#11840930)
MSFT, if we ignore Windows10 :(
Re:ASUS delivers BIOS/UEFI auto-updates over HTTP with no ve... by walrus01 on Sunday June 05, 2016 @01:24PM (#11841997)
Wang?