4 ms·

I haven't seen my OnHub since I turned it on last year. This puts it well ahead of all other wifi access points I have owned.

jhoechtl 10y ago
I haven't seen my Asus ac68 ever since. Reading these comments all the way down leaves the impression as the hefty overpriced OnHub is the only reliable wifi router on earth.
- semi-extrinsic 10y ago
  I haven't seen my $50 Buffalo N300 since I bought it, flashed and configured dd-wrt on it about 2 years ago.
  - thrownaway2424 10y ago
    Your N300 is not getting security updates, but my OnHub is.
    - semi-extrinsic 10y ago
      Pray tell, security updates for what? My router has all WAN-side management features etc. turned off, WPS is turned off and it has a long random WPA passphrase. Unless someone breaks into my apartment, there just isn't a significant potential for security risks that I'm aware of.
      - delroth 10y ago
        Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can be used to attack your router from the LAN. Just use Javascript to autosubmit a form with action="http://192.168.1.1/exploitable/endpoint/" http://192.168.1.1/exploitable/endpoint/" (you can autodetect the IP, look for Javascript port scanners on Google) and you're in. And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn't have such vulnerabilities on its HTTP interface that can be accessed without auth, see https://www.cvedetails.com/vulnerability-list/vendor_id-9341/product_id-16564/Dd-wrt-Dd-wrt.html https://www.cvedetails.com/vulnerability-list/vendor_id-9341... for some real examples, including "getting root by sending an HTTP query that doesn't require any authentication". In fact, for that remote root exploit, disabling Javascript execution wouldn't even help that much, because it can be triggered through e.g. <img src="..."/> on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).
        shiftpgdn 10y ago
        DD-WRT allows you to set access control lists. A simple protection would be only allow device with X MAC address to see the admin page(s). That device could be a virtual machine that only exists to manage the router.
        greggman 10y ago
        How is that any more secure? Are you sure every native app on your phone isn't sending the correct network packets to your router to reconfigure it? Seems like in either case all you need is a password to protect either in a secure enough way. Or isolate the router config on its own vlan
        slrz 10y ago
        Or simply disable the freakin' web interface if people just can't get it secure? You should still apply security fixes for (relevant) kernel and sshd issues, of course.
        dzhiurgis 10y ago
        At this point it would be the best if Google just contributed to OpenWRT project itself.
      - victorhooi 10y ago
        All products probably have (undiscovered) security holes - whether it's issues with the firewall, issues with the management console, SSL vulnerabilities, manufacturer backholes that get discovered later, or vulnerability in the wireless encryption scheme - this is stuff we find out later (if we knew about it earlier, it would have been fixed). Having security updates pushed to your phone is never a bad thing. It's the reason why enterprise Linux distro updates promise security patches (but possibly not bug fixes) for such a long period - because people do care about these things. Security patches are a good thing.
      - nopinrop 10y ago
        Those precautions alone won't save you from CSRF and XSS vulnerabilities common in SOHO routers.
      - TheSpiceIsLife 10y ago
        Agreed. I'm way more concerned about my computers and phones being compromised than I am my router. In comparison to the other devices I use the router has a tiny attack surface.
        ithkuil 10y ago
        good thing the world is slowly moving to TLS, because your router, with its tiny attack surface, is the prototypical man in the middle
- stordoff 10y ago
  Same here - Asus RT-AC68U running DD-WRT has a current uptime >100 days and noticed no problems with it during that. The only downside is lack of auto-updates, but for my setup I'm not too concerned about that (WAN-side management features are disabled, and is behind another router anyway; occasional manual updates mostly mitigate LAN-side attacks [and web UI is usually disabled which prevents most of them anyway])

jhoechtl 10y ago

I haven't seen my Asus ac68 ever since. Reading these comments all the way down leaves the impression as the hefty overpriced OnHub is the only reliable wifi router on earth.

semi-extrinsic 10y ago
I haven't seen my $50 Buffalo N300 since I bought it, flashed and configured dd-wrt on it about 2 years ago.
- thrownaway2424 10y ago
  Your N300 is not getting security updates, but my OnHub is.
  - semi-extrinsic 10y ago
    Pray tell, security updates for what? My router has all WAN-side management features etc. turned off, WPS is turned off and it has a long random WPA passphrase. Unless someone breaks into my apartment, there just isn't a significant potential for security risks that I'm aware of.
    - delroth 10y ago
      Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can be used to attack your router from the LAN. Just use Javascript to autosubmit a form with action="http://192.168.1.1/exploitable/endpoint/" http://192.168.1.1/exploitable/endpoint/" (you can autodetect the IP, look for Javascript port scanners on Google) and you're in. And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn't have such vulnerabilities on its HTTP interface that can be accessed without auth, see https://www.cvedetails.com/vulnerability-list/vendor_id-9341/product_id-16564/Dd-wrt-Dd-wrt.html https://www.cvedetails.com/vulnerability-list/vendor_id-9341... for some real examples, including "getting root by sending an HTTP query that doesn't require any authentication". In fact, for that remote root exploit, disabling Javascript execution wouldn't even help that much, because it can be triggered through e.g. <img src="..."/> on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).
      - shiftpgdn 10y ago
        DD-WRT allows you to set access control lists. A simple protection would be only allow device with X MAC address to see the admin page(s). That device could be a virtual machine that only exists to manage the router.
      - greggman 10y ago
        How is that any more secure? Are you sure every native app on your phone isn't sending the correct network packets to your router to reconfigure it? Seems like in either case all you need is a password to protect either in a secure enough way. Or isolate the router config on its own vlan
      - slrz 10y ago
        Or simply disable the freakin' web interface if people just can't get it secure? You should still apply security fixes for (relevant) kernel and sshd issues, of course.
      - dzhiurgis 10y ago
        At this point it would be the best if Google just contributed to OpenWRT project itself.
    - victorhooi 10y ago
      All products probably have (undiscovered) security holes - whether it's issues with the firewall, issues with the management console, SSL vulnerabilities, manufacturer backholes that get discovered later, or vulnerability in the wireless encryption scheme - this is stuff we find out later (if we knew about it earlier, it would have been fixed). Having security updates pushed to your phone is never a bad thing. It's the reason why enterprise Linux distro updates promise security patches (but possibly not bug fixes) for such a long period - because people do care about these things. Security patches are a good thing.
    - nopinrop 10y ago
      Those precautions alone won't save you from CSRF and XSS vulnerabilities common in SOHO routers.
    - TheSpiceIsLife 10y ago
      Agreed. I'm way more concerned about my computers and phones being compromised than I am my router. In comparison to the other devices I use the router has a tiny attack surface.
      - ithkuil 10y ago
        good thing the world is slowly moving to TLS, because your router, with its tiny attack surface, is the prototypical man in the middle
stordoff 10y ago
Same here - Asus RT-AC68U running DD-WRT has a current uptime >100 days and noticed no problems with it during that. The only downside is lack of auto-updates, but for my setup I'm not too concerned about that (WAN-side management features are disabled, and is behind another router anyway; occasional manual updates mostly mitigate LAN-side attacks [and web UI is usually disabled which prevents most of them anyway])