4 ms·
> The flip-side is that this isn't the sort of security most of us want, and the fact that router firmware is "insecure" from this perspective is what enables t
by ryao 10y ago
> The flip-side is that this isn't the sort of security most of us want, and the fact that router firmware is "insecure" from this perspective is what enables things like DD-WRT to exist in the first place. See also: iOS jailbreaking, Android rooting, console homebrew, etc.
There is a difference between making updates available in a way that enables custom firmware and doing them in a way that permits MITM attacks. Locking down automatic downloads is a good thing. Locking down manual updates is not.
- izacus 10y agoPerhaps it was just a case of misunderstanding, but your sentence read like you were implying that preventing users from updating the firmwares was a good thing.
- ryao 10y agoThey did accomplish a good thing (preventing MITM attacks on firmware updates) as a side effect of doing something stupid (preventing users from flashing OSS). The right way to prevent MITM attacks would have been via HTTPS and PGP signatures that users are expected to verify when doing manual updates and is only verified automatically by auto-update mechanisms. Sadly, what was done was motivated by reasons that have nothing to do with security and consequently, is making equipment less secure.