undefined

points

[-]

>The product label also says "Made in Denmark.

That label only means most of the final assembly process have been completed in Denmark, it doesn't mean all HW & firmware inside of it have been developed in Denmark by vikings.

A lot of HW & FW by EU companies whose main specialty isn't HW and FW, tends to be outsourced to third party consultancies (sometimes even offshored), who won the bid to do it as cheap as possible, so you never know what quality you're gonna get inside of it, despite the provenance label.

One of the biggest scams right now is the Made in Germany label on cars/household appliances, which isn't in any way an indicator of quality like it used to be.

by encom6 hours ago|

prev|

[-]

I promise I'm not simping for Danfoss, just because I'm danish, but... Is it really their fault the customers aren't putting these things behind VPN? Yes, the thing should be secure ideally, but why take the risk?

by jttnr4 hours ago|

parent|

[-]

Agreed, it's not necessarily Danfoss's fault. The customer bought the appliance and is free to do whatever they want with it, that's what ownership is about and I fully support this. But in a situation like this, who bears responsibility? The customer whose appliance is exposed to the internet, likely having been installed by an authorized technician in the first place, or Danfoss, whose now-insecure maintenance interface listens on 0.0.0.0? I don't have an answer.

As others have pointed out, this interface is intended for use by service personnel.

My point is simply that situations like this can be prevented in several ways: on the customers side, if they have a capable IT department, or on the vendors side, by designing with the expectation that some customers will inevitably expose devices to the internet, regardless of what the manuals and training materials say.