4 ms·

The first answer is obviously auto-updates. The second answer is also obvious: Try to avoid as many bugs as possible before shipping the product. If you includ

by hannob 9y ago

The first answer is obviously auto-updates. The second answer is also obvious: Try to avoid as many bugs as possible before shipping the product. If you include a highly exposed software like dnsmasq make sure you look for bugs in it before shipping it. I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one...

raesene9 9y ago
This is one of those times it's a shame I only have one upvote for a comment... Open source is extremely heavily used by commercial software and hardware manufacturers and the reality is that very few of them contribute back, meaningfully, to Open source security. The end result will continue to be bugs like this, with ever growing impact.
bannedtruth 9y ago
HATEOAS
newman314 9y ago
Also, good secure defaults. I see too many pieces of software ship with insecure defaults for ease of use. This needs to stop.
sitkack 9y ago
The other one is that embedded devices need to running their components in sandboxes.
- gcp 9y ago
  To be honest, a compromised dnsmasq can do quite a lot of harm even if it is running in a sandbox. The rest of the system expects to trust the output.
thephyber 9y ago
> I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one... "Tragedy of the Commons." If all manufacturers in the space assume someone else will pay for the audit (or assume it won't get audited), then it doesn't get audited. If one does pay for it, they all get to benefit due to the nature of open source patches. It's funny yet sad that it took Google Security acting on a bug report by a (presumably unrelated) engineer to find some of these security issues. Google has strong incentives to protect its own network (its livelihood depends on intellectual property and safeguarding data). The companies that sell mostly disposable SOHO routers have such little interest in security, yet it's literally the gateway most of us use to the internet.
jlgaddis 9y ago
> I don't remember having seen any professional security audit for dnsmasq before. Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53 [2] about a year and a half ago. The final report [3] (PDF) lists one "medium" and five "low" issues. It just goes to show that a "successful" audit (i.e., one that doesn't find any major/critical issues) ultimately doesn't prove much of anything at all WRT the overall security of a piece of software. [0]: https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source [1]: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dnsmasq https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#d... [2]: https://cure53.de/ https://cure53.de/ [3]: https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf

by hannob 9y ago

raesene9 9y ago

This is one of those times it's a shame I only have one upvote for a comment... Open source is extremely heavily used by commercial software and hardware manufacturers and the reality is that very few of them contribute back, meaningfully, to Open source security. The end result will continue to be bugs like this, with ever growing impact.

bannedtruth 9y ago

HATEOAS

newman314 9y ago

Also, good secure defaults. I see too many pieces of software ship with insecure defaults for ease of use. This needs to stop.

sitkack 9y ago

The other one is that embedded devices need to running their components in sandboxes.

gcp 9y ago
To be honest, a compromised dnsmasq can do quite a lot of harm even if it is running in a sandbox. The rest of the system expects to trust the output.

thephyber 9y ago

> I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one... "Tragedy of the Commons." If all manufacturers in the space assume someone else will pay for the audit (or assume it won't get audited), then it doesn't get audited. If one does pay for it, they all get to benefit due to the nature of open source patches. It's funny yet sad that it took Google Security acting on a bug report by a (presumably unrelated) engineer to find some of these security issues. Google has strong incentives to protect its own network (its livelihood depends on intellectual property and safeguarding data). The companies that sell mostly disposable SOHO routers have such little interest in security, yet it's literally the gateway most of us use to the internet.

jlgaddis 9y ago

> I don't remember having seen any professional security audit for dnsmasq before. Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53 [2] about a year and a half ago. The final report [3] (PDF) lists one "medium" and five "low" issues. It just goes to show that a "successful" audit (i.e., one that doesn't find any major/critical issues) ultimately doesn't prove much of anything at all WRT the overall security of a piece of software. [0]: https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source [1]: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dnsmasq https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#d... [2]: https://cure53.de/ https://cure53.de/ [3]: https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf