They note that "In a statement, Barracuda said it will be providing the replacement product to impacted customers at no cost"

Would you still switch to a non barracuda device ?

If you have to go through the cost of a replacement anyways - as in, the time and effort to actually do it - the cost of the hardware matters a lot less.

I suspect there is a higher level question at play stemming from the "deny" comments. Do you think Barracuda is uniquely vulnerable to these types of threats and, if not, would their competitors make similar efforts to recover?

If this is the mindset of some people it's no wonder that companies would rather deny the problem and stick their heads in the sand.

The mindset that changing a system out has risks and that engineers/ops time is very expensive?

I mean, I hear you, it sucks that being honest about the issue is leading to punishment, but rationally this is just how people are going to end up responding. If they really want to avoid this, don't give it to them for free, pay them for it.

No it’s not. Considering changing vendors because a vendor did the right thing and sent out free replacements for potentially compromised hardware is not something any sane client would do.

The GP didn't say that though. They said they were already considering replacing one vendor with another, prior to this incident.

As I understood it, the calculus was 'do nothing and keep the current barracuda stuff for a while longer or find another vendor and replace the barracuda stuff?' Now the former option is gone, and the calculus is 'replace current barracuda stuff with barracuda or another vendor?' So if you were already considering switching vendors, now is an opportune time to do so. You're going to be paying the eng/ops cost now anyhow, and as many in this thread have pointed out, one or two fairly off-the-shelf hw appliances are not exactly a big spend.

>You're going to be paying the eng/ops cost now anyhow,

No you’re not. The people in this thread saying that have never actually managed technology because a vendor change that also requires a hardware swap is significantly more expensive than the drop in hardware swap.

The only exception to this is if you were already in the middle of the transition and were planning to phase it out shortly anyway.

This notion is detached from reality. A drop-in replacement of the same thing is an order of magnitude less work than switching vendors.

Even adequately researching alternatives, let alone doing some trial testing, will take far more time than a swap.

They've already been researching alternatives.

the physical cost of the equipment is often the cheapest part of a deployment.

Given that the replacement will be free, doesn't that make your case harder to make?

He's already made up his mind, so he'll probably just leave out this important tidbit when discussing the issue with "management"

It’s certainly not free to arrange getting the new device, swap, reconfigure, and hopefully you have HA to avoid downtime.

It is an email server. You can set up some kind of system that “catches” incoming email while you take your hardware offline and replace it. Your internal users won’t be able to send or receive emails but anyone outside the organization would be none the wiser that your system was down. If you notify ahead of time and can keep downtime to under an hour, will it matter?

> certainly not free to arrange getting the new device, swap, reconfigure, and hopefully you have HA to avoid downtime

Compared to migrating to a new vendor?

Which you would need anyway if you switch to hardware from a different vendor.

Can I ask - which competing devices are you planning to replace these Barracuda email security gateway servers with? Thank you.

A large portion of organic at this point run their mail with Google or Microsoft, and are already paying for capabilities in those systems on par with third party offerings.

There is often a counter "but I still get some spam with exchange online/google workspace", to which I would counter that you will still get spam with a barracuda.