Downgrades
Devices that got worse after people had already bought them — a firmware update that added an account requirement, a server shutdown, a feature moved behind a subscription, a vendor revoking access it had previously granted.
This is the page the whole project exists to fill, and it is deliberately kept narrow. Routine additions to the catalog live on Updates so that anything appearing here is worth your attention.
Since we started watching
| 2026-09-14 | vendor | Anova Culinary Precision Cooker 3.0 (AN525-US00) | vendor_risk 0 -> 1 on the vendor entering the ledger. Tier unchanged and never at issue: vendor conduct is not a tier input. |
| 2026-09-14 | vendor | Bambu Lab A1 | vendor_risk 0 -> 1 on the vendor entering the ledger. Tier unchanged and never at issue: vendor conduct is not a tier input. |
| 2026-09-14 | vendor | QNAP TS-233-US | vendor_risk 0 -> 2 and firmware_ota_forced unknown -> yes, applying the newly adopted rule on forced security patches: the forced install alone would have been firmware_ota_forced only, but it removed function from shipped devices, which is a ledger incident regardless of motive. Tier unchanged at D2. |
| 2026-09-05 | vendor | Sonos Ray | vendor_risk raised 0 -> 3 when Sonos was added to the ledger with three dated incidents. The tier is unchanged and was never affected: REJECT rests on the account being mandatory at setup, which is a fact about the device, not about the vendor's conduct. |
Before we started watching
These happened before this catalogue existed. We did not catch them — we recorded them, from public reporting — and they are kept separate so nothing here implies we were watching when we were not. They are on this page because they are precisely what it is about, and because the pattern is the reason to care about the rest of the site.
| 2025-11 | Withings | An r/withings open letter (357 upvotes, 150+ comments) collects owner reports of a BPM Connect losing sync capability and a ScanWatch losing SpO2/heart features, and of users locked out of already-purchased devices until new in-app data-sharing terms were accepted. A targeted search for independent reporting of a specific, dated removal found none — coverage in the same period describes features being ADDED by firmware update. The allegation is consistent and multi-user but rests on one community source. B source |
| 2025-03 | HP Inc. | Class action settled with court approval. No customer payout and no admission of wrongdoing; owners of 21 named models gained the option to decline Dynamic Security firmware, and to downgrade firmware on those models only. B source |
| 2025-03 | Brother Industries | Right-to-repair advocates alleged firmware updates degraded third-party toner function, including colour registration on colour models. Brother denies its updates block third-party consumables and attributes the reports to variation in third-party toner quality. Not independently established either way. B source |
| 2025-03 | Brother Industries | Brother's public denial, reported alongside the user complaints. B source |
| 2025-01-16 | Anova Culinary | Anova cancelled the end-of-support plan before it took effect, in its own words committing 'to keeping all our cookers fully supported', noting original units are now over ten years old and still running on maintained legacy infrastructure. This is why the entry is 1 and not 2: shipped hardware was threatened and then was not harmed. A source |
| 2025-01 | Bambu Lab | Firmware 01.08.03.00 (X1 series, 2025-01-17) introduced a mandatory 'Authorization Control System' requiring Bambu Connect cloud authentication to bind the printer, start a print job — over LAN as well as cloud — access remote video, or update firmware. Previously-free local and third-party paths, including OrcaSlicer integration, stopped working for anyone who applied it. Two things keep this at 1 rather than 2: the update could be declined outright, and Bambu documented a Developer Mode plus LAN Only path restoring full local MQTT/FTP with no cloud account, since extended to the A-series that bambu-lab-a1 belongs to. Note the mitigation arrived alongside the backlash rather than ahead of it, so a reader who wants to score this harder has grounds. A source |
| 2025-01 | Bambu Lab | Independent coverage of the rollout and the resulting backlash from the OrcaSlicer and third-party-accessory community, including Bambu's public acknowledgement of the reaction. B source |
| 2024-08 | Anova Culinary | Anova introduced a $2/month or $10/year subscription for app remote control and monitoring, announced 2024-08-14 and effective 2024-08-21 for accounts created from that date onward; pre-existing accounts were grandfathered free. Announced at the same time: a plan to end app and cloud support entirely for original first-generation Precision Cookers from September 2025. The subscription binds only new buyers and does not gate the cook itself, which runs from the device's own touchscreen — so it does not on its own justify a higher score. B source |
| 2024-05 | Sonos | The 7 May app rewrite shipped without features that worked on already-sold speakers the day before: alarms and sleep timers, local music library search and management, playlist editing, SonosNet Wi-Fi settings, and much of the accessibility support blind users relied on. The old app could not be kept. The CEO apologised, put the fixes on a public Trello board, and estimated $20-30M to repair; annual revenue fell 4% and he left the company in January 2025. B source |
| 2024-03 | Ring (Amazon) | From 29 March 2024, Home and Away modes — and the Live View customisation tied to them — required a Ring Protect subscription on video doorbells and cameras, for existing owners as well as new buyers. Ring Alarm owners who bought before that date were grandfathered; doorbell and camera owners were not. B source |
| 2024 | Ring (Amazon) | The entry Ring plan rose to $4.99/month or $49.99/year, reported as a 43% increase over the pre-March-2024 price. B source |
| 2023-11 | Chamberlain Group (myQ, LiftMaster) | Blocked all third-party API access to myQ, breaking working integrations on devices customers already owned. Home Assistant removed its myQ integration in the 2023.12 release. Chamberlain's stated reason was preventing 'unauthorized usage' of its ecosystem. B source |
| 2023 | Chamberlain Group (myQ, LiftMaster) | Ended support for Google Assistant. B source |
| 2023 | eufy (Anker Innovations) | Class action filed alleging eufy security cameras secretly uploaded user images and live footage to the cloud contrary to its local-storage marketing. B source |
| 2022-12 | eufy (Anker Innovations) | Camera streams were shown to be retrievable in VLC with no encryption and no authentication, contradicting eufy's marketing. Anker admitted the streams were not encrypted as claimed and committed to moving all cameras to WebRTC with AES/RSA encryption. B source |
| 2022-11 | eufy (Anker Innovations) | Security researcher Paul Moore showed a eufy Doorbell Dual uploading face thumbnails and user information to eufy's cloud while the device was configured for local storage only. Anker initially denied the behaviour, then conceded images were uploaded 'for notification purposes'. B source |
| 2022-01-26 | QNAP Systems | QNAP's own DeadBolt security advisory (QSA-22-02), confirming the campaign, the affected QTS versions and the company's instruction to update immediately and to disable internet-facing access — the vendor-side record of the event above. A source |
| 2022-01 | QNAP Systems | During the DeadBolt ransomware campaign, which had encrypted roughly 3,600 internet-exposed units, QNAP force-installed firmware 5.0.0.1891 on customer NAS devices — including, per owner and admin reports, on devices where automatic updates had been explicitly disabled. QNAP confirmed to BleepingComputer that it forced the install, citing a remote-code-execution flaw fixed in that build. Two losses followed for some owners: iSCSI connections stopped working after the update, and users who had bought a decryption key and were mid-recovery found the update had removed the ransomware executable and ransom screen, leaving them unable to finish decrypting their own data. The security motive is real and is why this is scored 2 rather than higher; the loss of function is why it is scored at all. B source |
| 2022 | Chamberlain Group (myQ, LiftMaster) | Discontinued the official Apple HomeKit integration for myQ. B source |
| 2020-11 | HP Inc. | A firmware update enabled Dynamic Security on some already-sold printer models, blocking non-HP cartridges. Customers were not notified the update would impede function and had no way to opt out. B source |
| 2020-01 | Sonos | Announced that a set of 'legacy' products would stop receiving software updates and new features from May 2020. The units kept playing, so this is the weakest of the three on the loss-of-function axis — but it partitioned existing systems, because a legacy device sharing a household system constrained what the rest of that system could do. B source |
| 2019-12 | Sonos | The Trade Up programme's 'Recycle Mode' permanently deactivated working speakers in exchange for 30% off a new one: confirming it in the app started a 21-day countdown after which the unit was bricked with no way to recover it, and recyclers could not resell or reuse the hardware. Eligible units included the Connect, Connect:Amp, ZP80/90/100/120 and Play:5 (Gen 1). Opt-in rather than forced — which is the honest qualification — but it destroyed functioning hardware by design. Withdrawn in March 2020 after sustained criticism; the discount now validates a serial number instead, and units already set to recycle could not be reversed. B source |
| 2018-2022 | HP Inc. | Earlier Dynamic Security settlements: $1.5M in California (2018), AUD$50 per affected customer in Australia (2018), EUR10M in Italy (2020), $1.35M in Europe (2022). B source |
Vendor conduct is scored in the ledger, separately from any device's tier. A company that has done this before can do it again, but it does not change what the hardware in front of you does today.