That’s a totally reasonable point of view, would be nice. But, the days of fixed-function hardware are almost completely gone. These routers (and lots of electronics) are just Linux computers stuffed in small boxes, and come with a lot of the same kinds of dependencies as your desktop. As such, when a security vulnerability is discovered, for example, it’s kind-of a good idea to be able to accept a software update, and when people are discovering them in every corner of the OS and utilities and daemons they run, it suddenly makes sense from a completely practical perspective to update automatically on a regular basis, which is what most people need for their computers & phones. They all should accept and respect the ability to disable auto-updates though. Maybe this case is an exploit or something.

Routers tend to be complex devices that have vulnerabilities. This has led to bot armies of routers.

Users won't apply fixes.

Therefore auto-updates became the norm.

This _was_ a bot army of routers. It just so happened that the army's orders were to do something uncoordinated and useless.

You can trust the users implicitly, or you can trust ASUS implicitly.

It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP.

> It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP.

This would imply that the ISP has abilities to interpose between malicious traffic and the user that, with modern technologies like DNS-over-HTTP, they simply don’t have. To most ISPs (that don’t force you to install MITM CA certs), user traffic is increasingly a black box. Which means that attacker traffic can blend right in as part of said black box. The only thing that can see into the black box is the device on the end of the line.

In most cases the device is getting it's IP information on boot by negotiation or request from the ISP. All the ISP needs is a database of blacklisted equipment and some middleware box to receive connections from insecure home devices when it detects them.

It's not about catching related traffic when it occurs, more managing the immediate implications from insecure devices on the network. The ISP can see the device, it doesn't need to inspect the traffic.

I'm convinced there are now multiple generations of engineers that have no idea that it is possible to write software that doesn't require over the air updates nor telemetry.

Have we all forgotten how Nest thermostats turned off the heat in the middle of January 2016 because of a botched software update? (Probably. It was hard to get Google to surface a link without a date due to so much SEO bullshit).

https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-g...

If that happens just jump the low voltage to your wires. Most heat pump setups have two inputs: on/off and heat/cool via the reversing valve.

You can even wire an old style thermostat in parallel if you want, or have it available to slot in.

Note that this doesn’t always work with smart thermostats. From first hand experience, there are some models out there that will generally work fine but will not complete booting up if one of the outputs is detected as closed.

Yeah, in that case you can get an old thermostat that disconnects easily and wire it somewhere out of the way.

(Though replacing a smart thermostat with a mercury switch one is a five minute job if you're comfortable with it.)

It’s not necessarily the engineers. Product and Leadership needs the telemetry in order to justify the expenses for their department or team or whatever and therefore justify the existence of those engineers.

Maybe, I guess, but it’d be pretty weird to be an engineer of any kind and not know about local file systems. More likely, both companies and most users want remote updates, and companies certainly love as much telemetry as they can get.

At least in this case, ASUS routers all have local firmware install functionality, so this particular case is certainly not an example of engineers not knowing it’s possible to write offline updates.

Now if you’re really lamenting the lack of computing devices that cannot be updated remotely by design, that’s a different story, and might be on a ship that sailed a while back. The problem there is that local updates are inconvenient enough for most people that they aren’t done, which is problematic from support and security perspectives, even though there are legit problems with remote updates too…

> It was hard to get Google to surface a link without a date due to so much SEO bullshit

Google no longer does search, it does "recommendation" and it sucks hard.

No longer??? It's been more than a decade. A lot more

For some of us, a decade really isn't a long time.

Now get off my lawn ))

I just searched [Nest thermostats turned off the heat because of a botched software update] and the first result was correct

Security updates is the important part. Particularly when dealing with vulnerable equipment which can be compromised and botnet malware dropped on it. A 0 day in a popular DVR/NVR or home router can lead to tens of thousands of devices that can throw a lot of heat. ISPs have been not great in this space so it's left to a small community to chase down the manufacturers to push updates out. The tragic part is for some devices - the company has gone out of business.

The scary part of auto update is when a company does a bad job of it. For example: letting the auto update site domain expire or point to an IP at a hosting provider that someone might pick up and if the devices don't do proper endpoint validation folks can use it to force downloads of compromised images.

All of these things have happened.

"Do all routers these days "phone home" anyway and modify settings on autopilot?"

Depends.

"Homemade" routers running open source OS that user can compile themselves need not "phone home" against computer owner intent. "Home" is the owner, not some company.

Commercial routers running closed source OS that owner cannot edit and re-compile can be expected to try to phone home for something, IMHO. A disturbing trend certainly not started by ASUS but which seems to be infecting most hardware sold with pre-installed closed source OS.

> A disturbing trend I think it's inevitable and probably not completely bad that hardware vendors are taking responsibility for vulnerabilities in their products.

I know I would prefer something like that for my non-savvy people. Considering there are smart light bulbs with vulnerabilities which are years away from the landfill. The only question is which botnet will they join the next time they power cycle.