> If a user forgets their password or

Isn't this the reason for a hardware reset button?

Having this available over the internet is probably negligent.

I read the support thread on WDs website and someone mentioned doing a hardware reset using a button.

How common is it now for a hardware button that isn't just dedicated input for software?

Probably common, but connecting that function to the web (via PHP in this case) is pretty stupid.

I would think it would run a firmware function to do the resetting, and if not that, then some sort of sell script that is not callable by their web interface.

Due to all this stupidness, my weekend is going to be consumed by trying to find out if my Synology has something stupid in it (assuming I can even figure that out).

So my trust in "personal" network storage devices has been shattered. Hopefully Synology is not as dumb.

Just set up an old computer to be your nas and call it a day. Would be much quicker, and you can be much more confident it does only what you want it to do

My son has my old computer for playing fortnight. :)

So I'm reading up on TrueNAS to see if that's the way for me to go.

Frankly, I love my Synology, but it at EOL (can't do the new version of DSM) but my needs are pretty simple, hence either straight Linux or TrueNAS seem to be my best options.

I do- it was just a curiosity given the topic.

I tried to start implementing separate lans/vlans at home for trusted and untrusted devises. But quickly realized I don't really trust any of it, save my personal laptop and a few of the servers I run.

... and after a while, when you realize the hole goes deeper, you stop trusting these as well

It's pretty much devolved to users instead of devices:

1) devices only I have write access to 2) devices others have access to 3) iot (which are basically users I've never met)

At least I can segregate me running a port scan from my laptop, to a family members phone running a portscan from some spyware game they downloaded.

I have a good idea how much I can trust my own devices, even if my phone's baseband OS is sending an unstoppable stream of location data and super cookies.

But this NAS/cloud connected storage thing is a bit of a oddball, since you're supposed to trust it with your data, but can't trust it with unfettered network access.

intel/amd me running second own os on everything. One malicious lib, GG security theatre.

At least 100% common for wifi routers? Not sure why all wifi routers have one though.

Even most of these are software controlled. You can usually change what the button does with ddwrt or similar.

As long as the software is coded to trigger reset only on that signal, it probably didn't matter.

Or he just was working on a feature, and got annoyed with password prompts. Commented out authorization code, then forgot to comment it back in

And that's why the first person who performs the PR code review should be the person requesting it.