D-Link Home Routers Open to Remote Takeover Will Remain Unpatched
This is the new normal, folks.  Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years.  Today's manufacturers cannot afford to update software for hardware devices they have already moved on from.  Changing that requires a significant upheaval in their business models.<p>This applies to every "connected device:" printers, cell phones, home routers, refrigerators, thermostats -- you name it.  Michael DeGusta did a great infographic demonstrating this for Android phones in 2011 [1, 2].  Sadly, this hasn't materially changed in the eight years since.  Just this year, Google added new terms to the Android license requiring security patches, but even then only for "popular devices." [3] Imagine those dynamics in the secondary and tertiary markets of printers and refrigerators.<p>As an industry, we've been to this rodeo before.  The advancements we've made in operating system and core applications security over the last 20 years have more about patching speed and agility than shipping fewer bugs.  However, those areas have backing and control from Apple and Microsoft, managing the end to end ecosystem.  There is not a similarly equipped manufacturer of embedded operating systems with the scale to provide post-sale/post-deployment patching infrastructure.<p>Since this is Hacker News, I'll point out the enormous opportunity to anyone who can address that problem.  Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates?  Can you provide infrastructure device manufacturers can use to manage post-deployment updates themselves?  Do you have a better approach to it?  There's a burgeoning multi-billion dollar market waiting for a few leaders to take it over.<p>1 - <a href="https://theunderstatement.com/post/11982112928/android-orphans-visualizing-a-sad-history-of" rel="nofollow">https://theunderstatement.com/post/11982112928/android-orpha...</a><p>2 - 
 img link is broken in his post, the graphic itself: <a href="http://media.theunderstatement.com/016a_android_orphans.png" rel="nofollow">http://media.theunderstatement.com/016a_android_orphans.png</a><p>3 - <a href="https://www.theverge.com/2018/10/24/18019356/android-security-update-mandate-google-contract" rel="nofollow">https://www.theverge.com/2018/10/24/18019356/android-securit...</a>