6 ms·

OpenWrt Joins Software Freedom Conservancy

159 points by vanburen 6y ago

outsomnia 6y ago
Well good for them... I think something had to change after this https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 After I read that, I removed openwrt on an old mips wifi router I had been using for years and moved to a fanless x86_64 running a minimal normal distro, set up via nmcli.
- Wowfunhappy 6y ago
  Could you expand on why you consider this vulnerability to be such a major indicator of incompetence, versus all the other major vulnerabilities that regularly pop up in software? They all seem obvious in hindsight, but as they say, hindsight is 20/20.
  - gamegod 6y ago
    > moved to a fanless x86_64 running a minimal normal distro, which uses apt-get over HTTP by default Fixed that for you.
    - outsomnia 6y ago
      Normal distros have package signatiure pki that works :-)
      - bridgerMic 6y ago
        Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example: CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/product_id-17236/Debian-APT.html https://www.cvedetails.com/vulnerability-list/vendor_id-23/p... Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution: CVE-2009-1358 apt-get does not check for the correct error code from gpgv CVE-2011-1829 APT does not properly validate inline GPG signatures CVE-2011-3634 APt accepts connections when the certificate host name fails validation CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature. etc etc. Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.
        outsomnia 6y ago
        Yes, it's true... for redhat the worst rpm cve I could see from a quick google was back in 2012. The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.
      - yjftsjthsd-h 6y ago
        And so does openwrt, since you'll notice that that CVE was fixed.
        outsomnia 6y ago
        Yes it was fixed when pointed out to them, after all openwrt users from 18.06+ had been exposed to this for three years. There's no known way to guard against bugs in the end, but... you can empirically test... they didn't check at all if their package signature check could detect tampering after patching it? For 3 years? Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.
  - outsomnia 6y ago
    Sure... 1) Still no dnssec on archive.openwrt.org 2) Still no tls on archive.openwrt.org Those together mean you can poison the dns for it and it will download packages from your fake site. And... 3) Problem was introduced Feb 2017, nobody checked tampered packages were still rejected until 2020. With 3) it means anyone can put whatever they want in the fake packages and the OS will install them. I don't need much from my router but I need it to be secure. So I got rid of openwrt the next week.
    - dastx 6y ago
      If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get verified based on predefined public keys. If the packages aren't signed by openwrt's private keys, the software will reject it. You'll notice many other package management software do the exact same thing. In any case, this is based on what other package management software does. I don't know if this is indeed the case.
      - outsomnia 6y ago
        That is indeed the theory. But the point here is how openwrt broke that "last / only line of defence" package signature check and nobody noticed for three years and two major releases.
        dastx 6y ago
        I am not aware of this. What happened?
        outsomnia 6y ago
        As I linked above, introduced Feb 2017 found Jan 2020 https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.
- pabs3 6y ago
  "Normal distros" have had this sort of vulnerability in the past unfortunately.
  - outsomnia 6y ago
    Maybe so, but I have faith RH will generally check it better since they are better funded, and problems more likely to be found quicker since more users.
- OneLeggedCat 6y ago
  To be clear, a solution like that would not be nearly so easy to set up and modify as OpenWRT is, correct? OpenWRT has so many powers, I'm always thinking of something new to do with it. But I'm not a networking expert, and without OpenWRT, it seems like setting up a normal distro to do that stuff would be overwhelming, and take up many more hours than I have to give. Is there a normal distro that is already set up similar to OpenWRT out of the box?
  - outsomnia 6y ago
    Right, it was more trouble and not as cheap as a commodity router, if you paid the same for a commodity router you'd be getting much more modern wifi like 11ax. However for people who considered OpenWRT, there are few equivalents... pfsense but it seemed I would have just moved sideways and the lesson of the CVE was to align with desktop type distros that have infrastructure teams and more eyes. This has two mini PCI cards for wifi, one for 2.4GHz and one for 5GHz, they don't reach comparable speeds but it is very reliable. It also has 128GB msata SSD mini PCI. Once Linux was installed, I was surprised nmcli + firewalld is really powerful now, I could set up a multizone AP with two mini PCI cards and Ethernet routing in a couple of hours googling, and it worked stably and just how I intended. For anything else, it's a normal Linux box with the kind of normal storage and packages you don't get on commodity routers.
    - champtar 6y ago
      I use Fedora on my VPS and up to date Firewalld is really limited compared to OpenWrt firewall3 config. Inter zone forwarding rules are still not a thing, MSS Clamping not sure, and not sure if there are anything close to OpenWrt mwan3. SFC is just legal representation, and joining it will not change anything to the development. As pointed by others, RCE (or equivalent) in package managers affected all of them, so this issue alone to switch seems an overreaction to me.
      - outsomnia 6y ago
        > SFC is just legal representation No, as the article says >> Conservancy will help OpenWrt continue to thrive and grow as its new fiscal sponsor. That's what I think they need, to resolve their security and testing issues. > Inter zone forwarding rules are still not a thing I can believe that firewalld is not there on some things, but for what I wanted to do, including VPN service, it worked out great. I was expecting it to be a much harder ride, it would have been a few years ago. > so this issue alone to switch seems an overreaction to me. When I realized for 3 years there had been no package security on my own box I had thought was in better defensible shape than running manufacturer firmware, I realized I had been living in a fantasy. You're free to make up your own mind.
- yjftsjthsd-h 6y ago
  > In order to exploit this vulnerability, a malicious actor needs to pose as MITM, serving a valid and signed package index - e.g. one obtained from downloads.openwrt.org - and one or more forged .ipk packages having the same size as specified in the repository index while an `opkg install` command is invoked on the victim system. You switched systems for this? Sure, they could have done defense in depth (not unlike Debian, which also relies on signatures), but this was a bug in signature verification and... Honestly, how would someone even exploit this?
  - outsomnia 6y ago
    As I mentioned there is no dnssec or tls on their archive site, with the package signature not being checked interested parties need to run a mirror of the real site with selected packages tampered and poison the dns of their target. And then they can wait for the targets to update. They can do that pretty cheaply and over the 3 years and two major releases the broken opkg shipped on, just collect victims. That's what a lot of people in a lot of different countries are paid to do for a living.
pabs3 6y ago
It is interesting to note that OpenWrt originated following a GPL enforcement action by Software Freedom Conservancy that saw the release of Linux kernel, busybox and other code. Also just after OpenWrt joined Conservancy recently, Conservancy announced their plan to enforce the GPL again, in another area of the consumer electronics space, with the intent to again use the result to create an open source solution for the devices being enforced against. https://sfconservancy.org/news/2020/oct/01/new-copyleft-strategy-launched-with-ARDC-grant/ https://sfconservancy.org/news/2020/oct/01/new-copyleft-stra... https://sfconservancy.org/copyleft-compliance/enforcement-strategy.html https://sfconservancy.org/copyleft-compliance/enforcement-st... https://sfconservancy.org/copyleft-compliance/firmware-liberation.html https://sfconservancy.org/copyleft-compliance/firmware-liber...
- toomuchtodo 6y ago
  Sounds like a solid defense against lock in, market capture, and similar deficiencies in the intersection of technology and commercialization.
shmerl 6y ago
Are there any routers with open source WiFi drivers that also keep their firmware up to date? WRT1900AC/WRT3200ACM situation because worse after NXP bought Marvell: https://community.nxp.com/t5/Wireless-Connectivity/Drivers-for-88W8964/m-p/997496 https://community.nxp.com/t5/Wireless-Connectivity/Drivers-f...
- Naac 6y ago
  You're better off building your own router and and buying a separate wifi access point. For example, you can buy this: amzn.com/B07FKMJGD6 - Put PFsense or Shorewall on it, and get one of the many Wifi APs available on the internet. The downside is more appliances, but the benefit is that you can swap one or the other our when you upgrade.
  - shmerl 6y ago
    Yeah, you could, but Intel doesn't sell good MIMO cards for parallel access. I think at most they sell 2x2 ones? What is out there that has more and also has an open source driver with up to date firmware (if it's open - even better).
    - simplyaccont 6y ago
      Here you go http://www.compexshop.com/index.php/cPath/57 http://www.compexshop.com/index.php/cPath/57
      - shmerl 6y ago
        Thanks! So it's using Ath10k? Does it work well in practice? In the past, anything but iwlwifi was really awful.
        simplyaccont 6y ago
        depends on what you buy, ath9k or ath10k. works well. those chips are mainly used for AP, so drivers are suitable. There is also more "AP Optimized" firmwares. used my own builds for many years but lately bought two netgears R7800 and flashed them with openwrt. the reason is that it's hard to find boards that can fit 2 oversized mini-pcie cards (one for 2.4 and one for 5) and cost of the build becomes too high. though on this compex shop they do have some "dedicated" boards, but they are somewhat underpowered if you want to throw a bunch of things on them. One big upside, it's very educational.
john4532452 6y ago
If you are the person who uses rooted mobile then this is definitely your material. I had a router that stalled if i use torrent and had to reboot to get it to working. Then i explored and found this amazing project. Router firmware's are fully of buggy and on top of that they abuse users just because they can https://news.ycombinator.com/item?id=24530009 https://news.ycombinator.com/item?id=24530009 Buy a router that supports openwrt and you can block ads at the router level among a lot of other cool things.
heavyset_go 6y ago
OpenWRT is one of my favorite projects, I won't buy routers unless I can put OpenWRT on them. Also interesting is that it's become a general embedded Linux platform, too.
- pseudosavant 6y ago
  I am the same way. My routers/APs must support OpenWRT. I think it is hard for people to appreciate how great it is to have a legit Linux distribution for your router. The alternatives (e.g. DD-WRT, Tomato, etc) are "just firmware".
- m463 6y ago
  I agree. my network is a wrt1900acs + 2 mikrotik rb2011 switches, all running openwrt. I also have an mikrotik rb750gl somewhere. I started out with vanilla openwrt, but over time I ended up customizing and building everything myself. In the beginning I used the gui, but now I skip it and just edit the config files directly via emacs+tramp. I have a few vlans - one that can get out directly, one that can get out through a proxy, and one that can't really get out. I've been considering moving to a firewall box + separate wifi box. I've also been thinking it might be cool to do 802.1x and see if I can get machines to sign in and get put on their vlan automatically.
flas9sd 6y ago
> older equipment is often saved from planned obsolescence by alternative solutions. [..] We seek to ensure they can do this for other types of electronic products. However, without the complete, corresponding source code (CCS), including the scripts to control its compilation and installation, the fundamental purpose of copyleft is frustrated. Consumers, hobbyists, non-profit e-recyclers and the general public are left without the necessary tools they need and deserve, and which the license promises them. so true. OpenWrt is alot of networking fun and allows me to run a more current kernel on a measly (and perfectly fine for my uplink) MIPS device from 2012 than the one of the 450€ smartphone. But some chips will never see a reimplementation if datasheets and specs are missing. I pray for mainline kernel support, but while some SoC get integrated, GPU and peripherals are another story. As a consumer, this is sick. How is anybody even allowed to sell this way. The 17th october marks the "international repair day" of the repair community. But even with "the right to repair" - without controlling the software, you still might hold a brick in your hands.
CodeGlitch 6y ago
Can anyone recommend the best OpenWRT router that is reasonably priced? 802.11ax supported, but will settle for 802.11ac.
- amq 6y ago
  Basically, anything with IPQ40xx: https://github.com/openwrt/openwrt/tree/master/target/linux/ipq40xx/files/arch/arm/boot/dts https://github.com/openwrt/openwrt/tree/master/target/linux/... Those just work and are reasonably priced (~90 USD).
- hathym 6y ago
  I just bought a mini gl-inet router that is based on openwrt, its a marvelous little thing https://www.gl-inet.com/products/gl-mt300n-v2/ https://www.gl-inet.com/products/gl-mt300n-v2/

159 points by vanburen 6y ago

Well good for them... I think something had to change after this https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 After I read that, I removed openwrt on an old mips wifi router I had been using for years and moved to a fanless x86_64 running a minimal normal distro, set up via nmcli.

Wowfunhappy 6y ago
Could you expand on why you consider this vulnerability to be such a major indicator of incompetence, versus all the other major vulnerabilities that regularly pop up in software? They all seem obvious in hindsight, but as they say, hindsight is 20/20.
- gamegod 6y ago
  > moved to a fanless x86_64 running a minimal normal distro, which uses apt-get over HTTP by default Fixed that for you.
  - outsomnia 6y ago
    Normal distros have package signatiure pki that works :-)
    - bridgerMic 6y ago
      Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example: CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/product_id-17236/Debian-APT.html https://www.cvedetails.com/vulnerability-list/vendor_id-23/p... Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution: CVE-2009-1358 apt-get does not check for the correct error code from gpgv CVE-2011-1829 APT does not properly validate inline GPG signatures CVE-2011-3634 APt accepts connections when the certificate host name fails validation CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature. etc etc. Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.
      - outsomnia 6y ago
        Yes, it's true... for redhat the worst rpm cve I could see from a quick google was back in 2012. The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.
    - yjftsjthsd-h 6y ago
      And so does openwrt, since you'll notice that that CVE was fixed.
      - outsomnia 6y ago
        Yes it was fixed when pointed out to them, after all openwrt users from 18.06+ had been exposed to this for three years. There's no known way to guard against bugs in the end, but... you can empirically test... they didn't check at all if their package signature check could detect tampering after patching it? For 3 years? Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.
- outsomnia 6y ago
  Sure... 1) Still no dnssec on archive.openwrt.org 2) Still no tls on archive.openwrt.org Those together mean you can poison the dns for it and it will download packages from your fake site. And... 3) Problem was introduced Feb 2017, nobody checked tampered packages were still rejected until 2020. With 3) it means anyone can put whatever they want in the fake packages and the OS will install them. I don't need much from my router but I need it to be secure. So I got rid of openwrt the next week.
  - dastx 6y ago
    If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get verified based on predefined public keys. If the packages aren't signed by openwrt's private keys, the software will reject it. You'll notice many other package management software do the exact same thing. In any case, this is based on what other package management software does. I don't know if this is indeed the case.
    - outsomnia 6y ago
      That is indeed the theory. But the point here is how openwrt broke that "last / only line of defence" package signature check and nobody noticed for three years and two major releases.
      - dastx 6y ago
        I am not aware of this. What happened?
        outsomnia 6y ago
        As I linked above, introduced Feb 2017 found Jan 2020 https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.
pabs3 6y ago
"Normal distros" have had this sort of vulnerability in the past unfortunately.
- outsomnia 6y ago
  Maybe so, but I have faith RH will generally check it better since they are better funded, and problems more likely to be found quicker since more users.
OneLeggedCat 6y ago
To be clear, a solution like that would not be nearly so easy to set up and modify as OpenWRT is, correct? OpenWRT has so many powers, I'm always thinking of something new to do with it. But I'm not a networking expert, and without OpenWRT, it seems like setting up a normal distro to do that stuff would be overwhelming, and take up many more hours than I have to give. Is there a normal distro that is already set up similar to OpenWRT out of the box?
- outsomnia 6y ago
  Right, it was more trouble and not as cheap as a commodity router, if you paid the same for a commodity router you'd be getting much more modern wifi like 11ax. However for people who considered OpenWRT, there are few equivalents... pfsense but it seemed I would have just moved sideways and the lesson of the CVE was to align with desktop type distros that have infrastructure teams and more eyes. This has two mini PCI cards for wifi, one for 2.4GHz and one for 5GHz, they don't reach comparable speeds but it is very reliable. It also has 128GB msata SSD mini PCI. Once Linux was installed, I was surprised nmcli + firewalld is really powerful now, I could set up a multizone AP with two mini PCI cards and Ethernet routing in a couple of hours googling, and it worked stably and just how I intended. For anything else, it's a normal Linux box with the kind of normal storage and packages you don't get on commodity routers.
  - champtar 6y ago
    I use Fedora on my VPS and up to date Firewalld is really limited compared to OpenWrt firewall3 config. Inter zone forwarding rules are still not a thing, MSS Clamping not sure, and not sure if there are anything close to OpenWrt mwan3. SFC is just legal representation, and joining it will not change anything to the development. As pointed by others, RCE (or equivalent) in package managers affected all of them, so this issue alone to switch seems an overreaction to me.
    - outsomnia 6y ago
      > SFC is just legal representation No, as the article says >> Conservancy will help OpenWrt continue to thrive and grow as its new fiscal sponsor. That's what I think they need, to resolve their security and testing issues. > Inter zone forwarding rules are still not a thing I can believe that firewalld is not there on some things, but for what I wanted to do, including VPN service, it worked out great. I was expecting it to be a much harder ride, it would have been a few years ago. > so this issue alone to switch seems an overreaction to me. When I realized for 3 years there had been no package security on my own box I had thought was in better defensible shape than running manufacturer firmware, I realized I had been living in a fantasy. You're free to make up your own mind.
yjftsjthsd-h 6y ago
> In order to exploit this vulnerability, a malicious actor needs to pose as MITM, serving a valid and signed package index - e.g. one obtained from downloads.openwrt.org - and one or more forged .ipk packages having the same size as specified in the repository index while an `opkg install` command is invoked on the victim system. You switched systems for this? Sure, they could have done defense in depth (not unlike Debian, which also relies on signatures), but this was a bug in signature verification and... Honestly, how would someone even exploit this?
- outsomnia 6y ago
  As I mentioned there is no dnssec or tls on their archive site, with the package signature not being checked interested parties need to run a mirror of the real site with selected packages tampered and poison the dns of their target. And then they can wait for the targets to update. They can do that pretty cheaply and over the 3 years and two major releases the broken opkg shipped on, just collect victims. That's what a lot of people in a lot of different countries are paid to do for a living.

pabs3 6y ago

It is interesting to note that OpenWrt originated following a GPL enforcement action by Software Freedom Conservancy that saw the release of Linux kernel, busybox and other code. Also just after OpenWrt joined Conservancy recently, Conservancy announced their plan to enforce the GPL again, in another area of the consumer electronics space, with the intent to again use the result to create an open source solution for the devices being enforced against. https://sfconservancy.org/news/2020/oct/01/new-copyleft-strategy-launched-with-ARDC-grant/ https://sfconservancy.org/news/2020/oct/01/new-copyleft-stra... https://sfconservancy.org/copyleft-compliance/enforcement-strategy.html https://sfconservancy.org/copyleft-compliance/enforcement-st... https://sfconservancy.org/copyleft-compliance/firmware-liberation.html https://sfconservancy.org/copyleft-compliance/firmware-liber...

toomuchtodo 6y ago
Sounds like a solid defense against lock in, market capture, and similar deficiencies in the intersection of technology and commercialization.

shmerl 6y ago

Are there any routers with open source WiFi drivers that also keep their firmware up to date? WRT1900AC/WRT3200ACM situation because worse after NXP bought Marvell: https://community.nxp.com/t5/Wireless-Connectivity/Drivers-for-88W8964/m-p/997496 https://community.nxp.com/t5/Wireless-Connectivity/Drivers-f...

Naac 6y ago
You're better off building your own router and and buying a separate wifi access point. For example, you can buy this: amzn.com/B07FKMJGD6 - Put PFsense or Shorewall on it, and get one of the many Wifi APs available on the internet. The downside is more appliances, but the benefit is that you can swap one or the other our when you upgrade.
- shmerl 6y ago
  Yeah, you could, but Intel doesn't sell good MIMO cards for parallel access. I think at most they sell 2x2 ones? What is out there that has more and also has an open source driver with up to date firmware (if it's open - even better).
  - simplyaccont 6y ago
    Here you go http://www.compexshop.com/index.php/cPath/57 http://www.compexshop.com/index.php/cPath/57
    - shmerl 6y ago
      Thanks! So it's using Ath10k? Does it work well in practice? In the past, anything but iwlwifi was really awful.
      - simplyaccont 6y ago
        depends on what you buy, ath9k or ath10k. works well. those chips are mainly used for AP, so drivers are suitable. There is also more "AP Optimized" firmwares. used my own builds for many years but lately bought two netgears R7800 and flashed them with openwrt. the reason is that it's hard to find boards that can fit 2 oversized mini-pcie cards (one for 2.4 and one for 5) and cost of the build becomes too high. though on this compex shop they do have some "dedicated" boards, but they are somewhat underpowered if you want to throw a bunch of things on them. One big upside, it's very educational.

john4532452 6y ago

If you are the person who uses rooted mobile then this is definitely your material. I had a router that stalled if i use torrent and had to reboot to get it to working. Then i explored and found this amazing project. Router firmware's are fully of buggy and on top of that they abuse users just because they can https://news.ycombinator.com/item?id=24530009 https://news.ycombinator.com/item?id=24530009 Buy a router that supports openwrt and you can block ads at the router level among a lot of other cool things.

heavyset_go 6y ago

OpenWRT is one of my favorite projects, I won't buy routers unless I can put OpenWRT on them. Also interesting is that it's become a general embedded Linux platform, too.

pseudosavant 6y ago
I am the same way. My routers/APs must support OpenWRT. I think it is hard for people to appreciate how great it is to have a legit Linux distribution for your router. The alternatives (e.g. DD-WRT, Tomato, etc) are "just firmware".
m463 6y ago
I agree. my network is a wrt1900acs + 2 mikrotik rb2011 switches, all running openwrt. I also have an mikrotik rb750gl somewhere. I started out with vanilla openwrt, but over time I ended up customizing and building everything myself. In the beginning I used the gui, but now I skip it and just edit the config files directly via emacs+tramp. I have a few vlans - one that can get out directly, one that can get out through a proxy, and one that can't really get out. I've been considering moving to a firewall box + separate wifi box. I've also been thinking it might be cool to do 802.1x and see if I can get machines to sign in and get put on their vlan automatically.

flas9sd 6y ago

> older equipment is often saved from planned obsolescence by alternative solutions. [..] We seek to ensure they can do this for other types of electronic products. However, without the complete, corresponding source code (CCS), including the scripts to control its compilation and installation, the fundamental purpose of copyleft is frustrated. Consumers, hobbyists, non-profit e-recyclers and the general public are left without the necessary tools they need and deserve, and which the license promises them. so true. OpenWrt is alot of networking fun and allows me to run a more current kernel on a measly (and perfectly fine for my uplink) MIPS device from 2012 than the one of the 450€ smartphone. But some chips will never see a reimplementation if datasheets and specs are missing. I pray for mainline kernel support, but while some SoC get integrated, GPU and peripherals are another story. As a consumer, this is sick. How is anybody even allowed to sell this way. The 17th october marks the "international repair day" of the repair community. But even with "the right to repair" - without controlling the software, you still might hold a brick in your hands.

CodeGlitch 6y ago

Can anyone recommend the best OpenWRT router that is reasonably priced? 802.11ax supported, but will settle for 802.11ac.

amq 6y ago
Basically, anything with IPQ40xx: https://github.com/openwrt/openwrt/tree/master/target/linux/ipq40xx/files/arch/arm/boot/dts https://github.com/openwrt/openwrt/tree/master/target/linux/... Those just work and are reasonably priced (~90 USD).
hathym 6y ago
I just bought a mini gl-inet router that is based on openwrt, its a marvelous little thing https://www.gl-inet.com/products/gl-mt300n-v2/ https://www.gl-inet.com/products/gl-mt300n-v2/