Conversation

Notices

1. Embed this notice
   abadidea (0xabad1dea@infosec.exchange)'s status on Monday, 25-Nov-2024 22:08:20 JST abadidea

   Good news: The Dell firmware update utility definitely checks whether update executables are signed.

   Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 28-Nov-2024 13:00:42 JST Rich Felker

     in reply to

     • Phil

     @0xabad1dea @phil Telemetry is not needed here at all. The failure would be detected if they even tested the update on a single machine they owned. No need to look at machines they don't own.

   • Embed this notice
     abadidea (0xabad1dea@infosec.exchange)'s status on Thursday, 28-Nov-2024 13:00:43 JST abadidea

     in reply to

     • Phil

     @phil 100%, there should always be a chance to say no to telemetry but even if only a fraction of users consent, the 100% failure rate among reporters should be quickly raising a huge red flag somewhere

   • Embed this notice
     abadidea (0xabad1dea@infosec.exchange)'s status on Thursday, 28-Nov-2024 13:00:45 JST abadidea

     in reply to

     This firmware update has been periodically failing since I got this laptop from work several weeks ago, and only today did I put in the effort to track down where it was hiding the logs with the real reason. This suggests that not only do they have a process issue that meant an unsigned update got posted, but they have no ability to detect that there’s a 100% failure rate to install after downloading it

   • Embed this notice
     Phil (phil@social.kern.pm)'s status on Thursday, 28-Nov-2024 13:00:45 JST Phil

     in reply to

     @0xabad1dea People keep being upset about "telemetry". But that's the kind of telemetry that you'd want as someone pushing software to people.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 28-Nov-2024 14:43:26 JST Rich Felker

     in reply to

     • Phil

     @0xabad1dea @phil "Telemetry" is *always* outsourcing your testing expenses onto your users/customers.