Samsung's mis-sent fridge update makes the case for separate test and release signing keys

According to The Chosun Daily, Samsung found that the update "was incorrectly distributed to some customers during testing" ^[5]. The company halted the distribution and will repair the units free of charge ^[5]. Its notice to Korean customers described abnormal symptoms in power and screen ^[2]. On Samsung's own account, the error happened on the distribution side. A build still in testing reached customers' homes, and the fridges installed it ^[1].

A design note published on dev.to argues that the device should decide which builds it accepts ^[10]. Test builds get signed with one key and releases with another. Units leaving the factory hold only the release key. A test-signed build pushed down the wrong channel then fails the check and is refused ^[10]. The same note wants test units kept as a named fleet, so that "all units" never includes them by accident ^[18].

I think this is the guard to build first. It costs a second key in the build pipeline and a signature check at install. Not every device runs that check. A Moxa advisory of 2 October describes protocol gateways that do not properly verify a firmware image's authenticity before installing it ^[11].

The key split has a limit, and its authors state it. A release candidate carries the release key, so it passes the check and still needs the later stages ^[17].

Recovery on the device comes next. The new image goes to a second slot and starts on trial. If it never marks itself good, the next reset sends the bootloader back to the old image ^[13]. MCUboot, an open source microcontroller bootloader, calls this a test swap; the project says the mechanism exists "to prevent devices from becoming 'bricked' by bad firmware" ^[13]. The note adds three conditions ^[14]. Good has to mean the job is being done, with sensors reading and the controller answering. An image that has not marked itself good within a set time has to reset. A watchdog running before the new image starts has to force that reset if the image hangs.

The first condition is the subtle one. An image that boots, draws its screen and marks itself good while cooling has stopped would pass any check that only asks whether it started.

Samsung's notice sent owners to the service centre for a technician's visit ^[9]. That recovery path works, and its capacity is set by payroll. The note's authors write that they do not know how these refrigerators are built, and they do not guess ^[19].

Hardware is the expensive prescription. The appliance's main job, cooling here, gets a controller of its own that keeps its own settings and runs firmware that changes rarely. The connected side asks it for things and does not run it ^[12]. The part that updates monthly can then hang, restart or sit half written while cooling keeps its schedule. That choice is made on the schematic, by deciding which processor switches the load ^[12].

Staged release is the last guard. The team's units go first, a small slice of the field next and everything else last, with a pause before each step ^[15]. Every unit reports in after an update, and the rollout stops by itself when updated units go quiet ^[15]. One part of Samsung's response is good practice. According to The Chosun Daily, it plans to use the update history to identify the customers affected ^[16]. Knowing which unit installed which build, and at what time, turns "some customers' refrigerators" into a list of units ^[16].

The note ends with bench tests run through the real update path. Send a test unit an image that starts and then does nothing, and check that it comes back by itself with its main job running throughout. Then cut the power while an image is being written ^[20].