> I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router man

> I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one... "Tragedy of the Commons." If all manufacturers in the space assume someone else will pay for the audit (or assume it won't get audited), then it doesn't get audited. If one does pay for it, they all get to benefit due to the nature of open source patches. It's funny yet sad that it took Google Security acting on a bug report by a (presumably unrelated) engineer to find some of these security issues. Google has strong incentives to protect its own network (its livelihood depends on intellectual property and safeguarding data). The companies that sell mostly disposable SOHO routers have such little interest in security, yet it's literally the gateway most of us use to the internet.