dr1 wrote:
I think we need more details than "just upgrade, don't ask questions".
No thanks.... I've upgraded my routers but many (most?) people won't have (yet or ever) so it would be totally counter productive and put those users at risk if the issue is something which could be exploited. i.e. " we found a flaw in processing of HTTP packets whereby if you send a packet like this, your trousers fall down..." - that's just alerting every hacker. Just because you're on the ball, doesn't mean you should throw less informed or complacent users under the bus who don't upgrade....
I am a bit annoyed that that this critical issue has only just been emailed around to users now, given that the release was made on December 20th.
Why are you annoyed? (And I'm not sure the release was on 20th Dec for any model actually)
Has it just been ramped up to critical because you're now seeing exploitation in the wild?
No, it has not - and I have asked specifically. For the end user mailing list, they waited until they had firmware for all models because people don't register by specific model, plus allowing for some time to ensure there weren't any major issues before a million people upgraded on one day.
I think this is proactive of DrayTek; there's no known public exploit, they're not being blackmailed by some hackers (as far as I know) but they still issues critical firmware to improve something. Other vendors might just fix it quietly and hope no-one ever discovers. They are on YOUR side - no need to make it into some sinister conspiracy theory.
