Backblaze releases billion-hour hard drive reliability report

Found on Extremetech on Thursday, 19 May 2016
Browse Hardware

The company noted that as of this quarter, its 61,590 drives have cumulatively spun for over one billion hours (that’s 42 million days or 114,155 years, for those of you playing along at home).

The company notes that 4TB drives continue to be the sweet spot for building out its storage pods, but that it might move to 6, 8, or 10TB drives as the price on the hardware comes down.

In short, if you want reliable drives, buy HGST.

‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

Found on The Guardian on Saturday, 06 February 2016
Browse Hardware

Thousands of iPhone 6 users claim they have been left holding almost worthless phones because Apple’s latest operating system permanently disables the handset if it detects that a repair has been carried out by a non-Apple technician.

After installation a growing number of people have watched in horror as their phone, which may well have cost them £500-plus, is rendered useless. Any photos or other data held on the handset is lost – and irretrievable.

Could Apple’s move, which appears to be designed to squeeze out independent repairers, contravene competition rules? Car manufacturers, for example, are not allowed to insist that buyers only get their car serviced by them.

Investors want more share value, and you cannot have that when your sheep go to another shepherd; or, in Apple terms, you shoot the sheep who commit such an treacherous act.

Server retired after 18 years and ten months – beat that, readers!

Found on The Register on Thursday, 14 January 2016
Browse Hardware

Ross says the box was “Built and brought into service in early 1997” and has “been running 24/7 for 18 years and 10 months.”

“By the time it was probably due for a review, things had moved so far that all the original code was so tightly bound to the operating system itself, that later versions of the OS would have (and ultimately, did) require substantial rework. While it was running and not showing any signs of stress, it was simply expedient to leave sleeping dogs lie.”

That should be normal. Unless you need new hardware to increase resources, it should just work. However, sales persons tell you that hardware should be replaced every couple of years, even if you don't really need it.

New USB cables could replace all other cords

Found on CNet News on Friday, 25 December 2015
Browse Hardware

The move to USB Type-C is the latest technology shift that's likely to throw you for a loop. The fact that everyone uses USB amplifies the problem. After the standard settles in, we should all eventually benefit from chargers that work on any laptop, a simplified selection of ports and cables, and less fumbling when it's time to plug something in.

One thing is not in doubt: USB Type-C's arrival. While older ports will persist for years, eventually Type-C's smaller size and greater abilities will prevail.

Until a new standard emerges. Before, IDE was another standard. It also does not help that USB standards are often violated by developers.

More Than 80% of Mobile Apps Have Encryption Flaws, Study Finds

Found on eWEEK on Saturday, 05 December 2015
Browse Hardware

More than 80 percent of mobile devices have encryption flaws, while an application written in any of a trio of scripting languages—including PHP, ColdFusion and Classic ASP—are more likely to have serious flaws.

Many companies' security programs have become more mature, but a large number of smaller software startups have cropped up, with novice programmers in many cases, Wysopal said.

"These things are easy to fix, but they are so pervasive it goes to show that the mobile developers are really ignorant about how to write good crypto code," he said.

Maybe it would be a decent idea to make them liable for bad practices. Bugs can always happen, but neglecting established and known security approaches should not happen. Obviously it is common practice to produce insecure toys which are a security nightmares.

Pi Zero: A full Raspberry Pi for just $5

Found on Ars Technica on Thursday, 26 November 2015
Browse Hardware

The Zero is powered by a Broadcom BCM2835 (the same SoC in the Raspberry Pi 1), with a 1GHz ARM11 CPU core. There's 512MB of RAM; a micro SD slot; two micro USB sockets (data and power); and a mini HDMI socket that can output at 1080p60. Perhaps most importantly, though, the Zero has 40 GPIO pins with the same pinout as the Model A+, B+, and 2B. There's also some headers for RCA composite video out.

Another option, if you live in the UK, is to pick up a print copy of the MagPi magazine—available in shops today for £6—which comes with a free Pi Zero on the front cover.

A few decades ago you had to save your pocket money for a long time to finally buy a computer. These days, you get a by far more powerful system stuck on a magazine.

Woz says he's still a laptop guy, despite Tim Cook's comments

Found on CNet News on Sunday, 15 November 2015
Browse Hardware

Tim Cook, the company's CEO, insisted on Tuesday that he couldn't see any reason to buy a PC anymore.

I'm not sure that Cook really believes the PC is dead. Why would he launch new and rather alluring MacBooks if he did?

In what sounds like another remarkably Apple-critical comment, Woz said: "I don't like being in the Apple ecosystem. I don't like being trapped. I like being independent."

Luckily for Cook, fanboys over the world will happily believe him and go buy the newest shiny and overpriced toys.

Western Digital's hard drive encryption is useless. Totally useless

Found on The Register on Wednesday, 21 October 2015
Browse Hardware

On some models, the drive's encryption key can be trivially brute-forced, which is bad news if someone steals the drive: decrypting it is child's play. And the firmware on some devices can be easily altered, allowing an attacker to silently compromise the drive and its file systems.

Drives using a Symwave 6316 controller store their encryption keys on the disk, encrypted with a known hardcoded AES-256 key stored in the firmware, so recovery of the data is trivial.

All-in-one products are rarely what they promise. Don't rely on some custom solution which is limited to a single manufacturer, but instead use a cross-platform encryption which has been tested.

Here’s Why Cybersecurity Experts Want Public Source Routers

Found on Motherboard on Thursday, 15 October 2015
Browse Hardware

The experts reasoned that closed-source router firmware could expose users across the internet to security vulnerabilities. If these routers’ firmware were available for scrutiny online, the thinking goes, the wider community of experts and developers could work together to battle vulnerabilities without having to wait for router makers to release a patch—if they bother to do so at all.

Paul Vixie, the CEO of computer security firm Farsight Security, told Motherboard about one recent router vulnerability that allowed hackers to redirect their victims’ internet traffic to an ad server under their control.

This has worked for other areas, like encryption software where it is critically important that any 3rd party can verify the absence of backdoors. Considering the recent router security issues, this is a very valid demand.

Files on Seagate wireless disks can be poisoned, purloined – thanks to hidden login

Found on The Register on Monday, 07 September 2015
Browse Hardware

CERT.org has reported Seagate wireless hard drives include “undocumented Telnet services” accessible with a hard-coded password. This allows “unrestricted file download capability to anonymous attackers with wireless access to the device.”

The three flaws present in the device mean that anyone on your network – or who can reach it from the outside – armed with the default password of "root" and enough savvy to try the username “root” can download the entire contents of the Seagate devices, then upload malware into them.

That's why you want dumb devices. With all that zeroconf hardware that just "magically works" you add extra security issues to your network; and not all the issues are even known yet.