Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes but so what? I said don't let an ios client reach the machine. I didn't say it was Apple who wrote the software that will commit the act you don't want.

The same danger on Windows doesn't come from Microsoft. You download and install software from HP and it does the deed.

You could in theory write an open source driver that runs on windows and is safe. There are also old closed source drivers which just happen to be well behaved. Which is why I said "drivers you aren't 100% sure about".

On Android, depending on the version and distribution, there have been both pre-installed and user-installable printer drivers from hp and samsung and everyone else, pretty much just like on Windows. Even the pre-installed whichbare "part of the os" are written by the manufacturer not Google or AOSP. And just like Windows it is technically possible to write an open source driver that you can safely use and trust. Which again is why I said "drivers you aren't 100% sure about"



So what is the scenario you fear? An iOS or Android user goes to brother.com and prints brick_my_printer.pdf? With that level of paranoia you might as well trash the printer because an update could theoretically be steganographically hidden in a way no filter or intermediate print servers can catch without unacceptably degrading the print quality.


Why do you ask about a "scenario you fear"?

I don't "fear" anything. It is simply a fact that printers have an update mechanism that doesn't require the printer to have access to the internet, which is merely a print job.

And so if one wants, as the gggp comment did, to ensure that ones printer cannot be updated without ones deliberate instigation, one must also be aware of all possible sources of print jobs.

I don't know why you seem to have a problem with this. What scenario do you fear? In what way does this knowledge hurt you?


"goes to brother.com and prints brick_my_printer.pdf" is really quite a silly place to arrive, starting from "printers can be updated via print job".

An update print job is just a blob of data that anything can squirt at the printer. A person doesn't need to press "print" anywhere, or do anything at all, or even know that it happened.

Any driver or application software that was written by the same people as the printers own firmware can do it all by itself any time it wants, for the same reasons that the printers own firmware does in fact already do it all by itself any time it wants.

I don't know why you find this so unbelievable.

Two seconds on kagi yields http://h10032.www1.hp.com/ctg/Manual/c06530233.pdf

"HP printing devices have the ability to accept firmware upgrades, solutions software and custom color table “bundles sent as a print job. The “Allow firmware updates sent as print jobs (Port 9100)” setting controls the ability for the printing device to accept firmware over the standard printing port, and also applies to firmware sent over all print-path methods including FTP, LDP, IPP(s), EWS Print page or Copy command."

(meaning that although the label on the setting in this particular printer's ui mentions "port 9100", it's not actually limited to jetdirect, the special print job is recognized no matter what path or protocol it took to arrive at the printer)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: