I never let my printer near the Internet. It goes on the "fucking trash" subnet which has no route out. Mine's an HP but it complains occasionally that it can't get new firmware which makes me feel warm inside.
Still have to be careful, they have another method where an update is delivered as a print job (that doesn't print anything). So also don't let any windows or mac (or android or ios or chromebook I guess) clients reach the printer by any means, even usb, with drivers you aren't 100% sure about.
That's devious and evil. Do you have further details about the mechanics? e.g. if it's delivered by JavaScript embedded in a PDF then maybe one could introduce a proxy that strips that out.
Having the method exist is reasonable - you want to have as many fallbacks as possible to avoid bricking the device if you manage to break the main update flow.
Applying updates without user consent is the evil part.
Unless they got specific consent that sounds like unauthorised access and unauthorised alteration of a computer system (which I gather to be judged criminal in UK & USA at least).
> unauthorised access and unauthorised alteration of a computer system (which I gather to be judged criminal in UK & USA at least).
I doubt it would ever be prosecuted. It is important to remember that the law doesn’t mean what you think it means, it means what the average prosecutor and/or judge thinks it means. Those laws were invented for use against scary “hackers”, not printer manufacturers updating their own products
I would call it that, but no one in the government will. Printer manufacturers lawyers will just equate it with the same automatic updates that the printer will do by itself if it could. And they will have a dozen words buried somewhere in the middle of a bible sized tos that you "agreed to".
Crimes in the US are only for individuals (and even then only for poors). If you are a registered corporation you may defraud, steal, or manslaughter without consequence.
> method where an update is delivered as a print job
I wonder if this is a way to install custom firmware. Probably not. I would guess that the code that decodes the firmware from the print job probably passes it through the same signature check code as the regular firmware update process.
Still it's an interesting route for exploit exploration.
Generally a modern printer has a shitty embedded Linux install in it. There's more than likely an exploitable vulnerability in the network services; even more so if it serves a web admin interface.
The complexity is really in constructing the replacement firmware to drive the hardware correctly; developing that is probably easier if you dismantle the printer and find debug leads on the motherboard. Getting the common chips like networking going sounds doable, but for the actual printing there's lots of trade secrets around driving the actual printing hardware.
A more likely route: a Chinese factory should be able to make a smallish batch of cheap monochrome laser printers with good-enough print quality, publish badly-written but usable specs for it, and make it easy to replace the firmware.
I don't know if I'd be surprised or not to find out that you actually can't print from ios. It seems crazy to me, especially considering ipads, but the entire Apple ecosystem seems crazy to me and yet it exists despite my incredulity.
I could even print from webos and palm but I guess that doesn't matter now. 50/50 toss up if the current webos on lg tvs still has any printer drivers. But if there was still any webos printer drivers, they will not be open source and so you can not trust them not to do unwanted things to your printer some day.
That means ios is not safe. Software that you don't control and was not written by end-users for end-users benefit, but was instead written by the same people who wrote the printer's firmware can send a print job from ios to the printer.
The printer doesn't care what physical connection or network protocol is used, including airprint, and in the case of ios, while you might be able to print some documents without using any software from HP, HP does still have a an "HP Smart" app (and probably others) for ios. Meaning that blocking the printer from the internet does not prevent the printer from receiving updates, and all of the closed-source platforms are the primary dangers as sources of update print jobs.
Technicall linux/bsd are not garanteed safe either.
It's possible for a native linux app to send the same kind of update, but just far less likely without the users knowledge or intent.
You have to go pretty far out of your way to install non-repo software from a printer manufacturers web site, and actively grant it permission to install and activate services that run on their own... And even if you did that, if such software even existed that was not well-behaved, the first time it did that to a linux user that didn't expect it, we would all find out about it and every google search on the topic of linux drivers for that printer would warn about the bad software.
Or just no one would ever actually bother even looking to try to install it in the first place simply because the normal open source drivers and apps work well and the manufacturers software is a crazy mess.
I had a Samsung color laser printer that actually had linux software provided by Samsung that I actually installed just to check it out. HOLY SHITBALLS it was terrible both outwardly just using it as a user and behind the scenes how it was written. Just crazy utter garbage all around. That software, since it wasn't open source, might do anything on it's own just like a Windows driver, including sending a printer update, but it was such junk, and so not-needed, that no linux user ever installs it, so it does no harm even though it exists and could.
Being able to print doesn't mean you have drivers for your printer - both the phone and printer support a semi-standardized protocol (probably bastardized postscript).
Yes but so what? I said don't let an ios client reach the machine. I didn't say it was Apple who wrote the software that will commit the act you don't want.
The same danger on Windows doesn't come from Microsoft. You download and install software from HP and it does the deed.
You could in theory write an open source driver that runs on windows and is safe. There are also old closed source drivers which just happen to be well behaved. Which is why I said "drivers you aren't 100% sure about".
On Android, depending on the version and distribution, there have been both pre-installed and user-installable printer drivers from hp and samsung and everyone else, pretty much just like on Windows. Even the pre-installed whichbare "part of the os" are written by the manufacturer not Google or AOSP. And just like Windows it is technically possible to write an open source driver that you can safely use and trust. Which again is why I said "drivers you aren't 100% sure about"
So what is the scenario you fear? An iOS or Android user goes to brother.com and prints brick_my_printer.pdf? With that level of paranoia you might as well trash the printer because an update could theoretically be steganographically hidden in a way no filter or intermediate print servers can catch without unacceptably degrading the print quality.
I don't "fear" anything. It is simply a fact that printers have an update mechanism that doesn't require the printer to have access to the internet, which is merely a print job.
And so if one wants, as the gggp comment did, to ensure that ones printer cannot be updated without ones deliberate instigation, one must also be aware of all possible sources of print jobs.
I don't know why you seem to have a problem with this. What scenario do you fear? In what way does this knowledge hurt you?
"goes to brother.com and prints brick_my_printer.pdf" is really quite a silly place to arrive, starting from "printers can be updated via print job".
An update print job is just a blob of data that anything can squirt at the printer. A person doesn't need to press "print" anywhere, or do anything at all, or even know that it happened.
Any driver or application software that was written by the same people as the printers own firmware can do it all by itself any time it wants, for the same reasons that the printers own firmware does in fact already do it all by itself any time it wants.
"HP printing devices have the ability to accept firmware upgrades, solutions software and custom color table “bundles
sent as a print job. The “Allow firmware updates sent as print jobs (Port 9100)” setting controls the ability for the
printing device to accept firmware over the standard printing port, and also applies to firmware sent over all print-path
methods including FTP, LDP, IPP(s), EWS Print page or Copy command."
(meaning that although the label on the setting in this particular printer's ui mentions "port 9100", it's not actually limited to jetdirect, the special print job is recognized no matter what path or protocol it took to arrive at the printer)
And why should we? It should all be "allow" and not "block". Machine should be serving _us_ the buyers/users.
I could never understand why my Windows Explorer (back in the ZoneAlarm days) were speaking to Microsoft when I was searching for my FileName.doc inside my C: Drive.
I could understand the Word or Excel accessing when I need "Help" (I assume online help file was more frequently updated).
No! Naughty developers and naughty businesses. My machines should leave my 127.0.01 when I want for MY uses and MY needs and MY convenience.
For vast majority of home users the only app that needs to 'get out' is their browser and their "windows udpate". Everything else is just tracking.
> Machine should be serving _us_ the buyers/users.
Yes.
But every now and then consumers get a tempting offer and trade a bit of their freedom for lower price, more comfort, more prestige, or something else. I.e. in practice buyers don’t mind that much and likely also don’t understand the difference and the consequences that well.
> … and likely also don’t understand the difference and the consequences that well.
this could be a very good argument to explain why so many have become skeptical of companies.
we have example after example where companies take advantage of people.
hearing my grandfathers generation go on about “the days when you could trust a company to be fair” i used to think they were seeing with rose-tinted glasses, but more and more im convinced we’re dealing something much more nefarious than that generation.
> the days when you could trust a company to be fair
Those days never really existed. It was simply that their misbehavior affected groups of people who didnt have access to the media and power structures. For the US, e.g.: central Americans (banana company inspired coups), native tribes (water pollution, deforestation), poor whites (coal ash pollution), etc.
I can see that companies treated their employees better, but that might also be correlated with strong unions, less regulatory capture, more competition, or some other factor, rather than intrinsic goodness.
Companies used to hire Pinkerton detectives to put down strikes and make employees use company stores.
Behaviour has improved for various reasons.
All we’re seeing now is that people’s technological surface area is expanding from zero to infinity so there are lots of new little cracks and edge cases society still has to sort out.
of course there is. it just takes a lot of people to make the good choices, and when money is tight, that is very hard for people to do en masse.
this is part of the trend lately that has money flowing upwards and not back down again. if the end-user/customer is at the bottom, wages they're paid are what go into the economy and do the work that money does all the way up the chain of commerce until it reaches some rich guy shaped like a sphere who smokes cigars and laughs maniacally all the time. but because he's been tightening budgets on all the companies he's on the boards of, the employees of those companies get less money every year to spend on things. so more of the money stays in his hands. so customers have necessarily less choice on things they can buy and choices they can make in the marketplace.
eventually people get laid off or fired and now they have no money to do anything with and in the end take any job they can, if they aren't found by some employer before then. so they have less and less agency while the people selling things have more and more and more.
the end result of this is that we will become pets of the bourgeois which is exactly what they want. they not only have a need to win (which is fine by itself) but a need for all others to lose (which is not ok in any way) and they can never ever be happy with what they have.
I truly wish I had not had children. Life is going to be hard for them.
This is not what the vast majority of people want.
People want security issues patched, preferrably without them having to do any work or even know about it (because they won't do the work and get annoyed at popups they don't feel like they need). People want bugs fixed (and crash reports do actually help with that, despite what some say). People want companies to prioritize the features that they're using and fix places where users get "stuck", and that's much easier with telemetry. People will almost always choose free shit over products they have to pay for, and for many products, free only works if you know what ads the user should see.
there's thin line between 'autoupdates consisting of security patches and bugfixes' and 'we will extract every piece of data we can and possibly remove features with no way to rollback'.
most apps fall into the latter, into the network blackhole they go. You give them an inch, they take everything.
You cant even get away from this by paying (and i'm willing to to so!) because people who actually are willing to pay are the most valuable ones to advertisers - so the incentives are there to extract even more value in such case.
In case of products from outside of software domain there's this consumer assumption that product does the thing and just the thing - food doesn't try to poison you, toys are just toys and so on.
they are aware of tradeoffs - something's cheaper, it might be less safe, less featured or maybe made a bit worse.
99% of modern software is user hostile first - data extraction and maximizing value for adverts and then it might do a bad job of actually fulfilling its purpose, with updates usually making it worse over time, or jacking up prices in form of monthly subscription instead of license sale.
The only way it could have security issues is if it's connected directly to the internet (not behind NAT) or a device on my LAN is actively attacking it. The former case is difficult to accomplish without enough expertise to know better; the latter is plausible, but mitigated by a printer too simple to easily harbor a persistent threat.
Sure, and that could break the printer, cause it to print things I don't want it to, or cause it to serve malware to other devices. I would like the printer to be too simple for the third case to be realistic, but that may be harder to build today than something with a more complex embedded OS.
> And the vast majority of people hate ads like me.
I don't mind respectful¹ ads, and refrain from using sponsorblock & similar. What I object to, and actively block, is the stalking that is endemic in the ad industry and is in no way respectful.
----
[1] i.e. not the pop-ups/-unders of yore, not those that autoplay video or, worse, audio, not those that otherwise interfere with the normal use of the page I'm trying to look at, stalking etc.
That's up to you. I block everything and I'll never go back. I just want the whole advertising industry to go away. They've betrayed my trust so often that I'm never going to let them back in. In any form. I don't care about the collateral damage in the services and sites they 'support'.
When I ask around me people don't really have a very nuanced view either, though they're not as hostile as me, most of them just believe it is unavoidable. They don't have the skills I have in ad avoidance. But they don't have any kind of ethical concerns.
Internet advertising is a race to the bottom. If you're not using scummy tactics then your competitors will, and you lose money -- or your entire business.
I can't remember the last time I was exposed to respectful ads. My home PiHole deny-lists keep growing in size and this will continue unless the internet at large changes. Which I don't believe it will, barring any civilization-wide disaster.
> I can't remember the last time I was exposed to respectful ads.
There are still some out there, or at least some that aren't actively disrespectful. At least sponsor spots in podcasts don't stalk me online, etc, at least when they are honest about what is happening¹. They are very much in the minority though.
----
[1] The 3D printing “community” on youtube is rife with “personal” recommendations that are obviously paid for but try to look more organic. “Today I'll test if you _really_ need to dry your PLA filament rolls, in a video sponsored by the company that makes one of the dryers I'll be testing…”
I have doubled my battery life on Moto Edge with Rethink DNS, blocking everything per app. There's so much junk I don't want to phone home that tries 50 times a day.
This sort of solution appeals to me but I wonder what the trade-off is. I am now sending data about domains I visit and when to a different entity not my ISP, how do I trust them more?
You don't have to use any DNS features, Rethink will happily let you set your DNS resolvers to whatever you like, you can just use it as an on-device VPN that allows you to block or isolate everything per app or per connection.
My reply is low value for HN but your comment is the literal embodiment of an older meme:
- Tech Enthusiasts:
Everything in my house is wired to the Internet of Things! I control it all from my smartphone! My smart-house is bluetooth enabled and I can give it voice commands via Alexa! I love the future!
- Programmers / Engineers:
The most recent piece of technology I own is a printer from 2004 and I keep a loaded gun ready to shoot it if it ever makes an unexpected noise.
P.S. More seriously I agree, we witnessed multiple times over the enshitification that inevitably follows.
We have this saying in Spanish "en casa del herrero, cuchillo de palo" (the blacksmith rather uses wooden-made knifes at home), meaning that when you're an insider to some of the nasty things that are part of certain products, you'll end up wanting to avoid it altogether. And in a sector as unregulated and wild regarding user protections as is the technology and software world, no surprise lots of engineers know that things look grim when you know the secrets of how they're done.
You jest but my first experience with this were Compuserve CD's in the 90's. I saw my hard drive light blinking when I did not ask the computer to do anything so I killed the power then powered on, ejected the CD and threw it into the trash. Ever since that experience I've been highly skeptical of any program and vindicated hundreds of times since.
That was a result of launching their program think early web client app to talk to their network. I did not install anything yet it started enumerating the hard drive. I had a LED for the CD and a LED for the hard drive. This was a 386-DX40 (40Mhz) with a 144MB RLL hard drive. There was enough flickering to indicate they were reading a lot of data.
I think the midwit meme captures this best, where at both ends of the IQ bell curve the characters say "I hate technology", and the guy in the middle loves it.
I had an ARM win11 tablet that constantly cycled my ancient printer with the $11 2000 page toner. A firewall between the tablet and the printer was the answer.
I went even more radical, personally: got a DCP-L2510D that simply doesn't have WiFi/Ethernet, only USB. Both scanning and printing work perfectly via CUPS and I'm happy as one can be.
Check out Amazon Sidewalk—if any of your neighbors connect a device supporting it to the internet, your devices will find them and use their internet connection if you don’t provide one! Apparently their network covers like 90% of the US population (at a low data rate), and they’ve made it possible for non-Amazon devices to implement it.
