7 ms·

What stood out for me was the kernel version of netgear equipment used: 2.6.36.4 That is a kernel nearly 10 years old. Of course, the router itself was release

by arpa 6y ago

What stood out for me was the kernel version of netgear equipment used: 2.6.36.4 That is a kernel nearly 10 years old. Of course, the router itself was released 7 years ago... and of course vendor stopped updating fimware as soon as they could... and of course it's still in production and for sale... and of course it costs $150+. It's a good thing dd-wrt and similar exist.

ATsch 6y ago
The bigger problem with these is usually not the vendor of the router, but the vendor of the SoC the device is built on. SoC vendors will usually provide you with a linux kernel that has an incredible amount of frequently shoddy out of tree patches and tweaks which make it very hard to rebase to a new version even if you really wanted to.
- arpa 6y ago
  That is also true.
- steeve 6y ago
  Exactly this. This situation is the same with SBCs. A product having a mainline kernel is a huge plus.
- ksec 6y ago
  I remember IBM donated ( or released ) an OpenPOWER 14nm CPU design ( with 7nm design coming in a few years time ). I wonder how far are we from having CoreBoot, mostly opened hardware Router and Appliances.
- iforgotpassword 6y ago
  But then why should I prefer Netgear over some Chinese no-name device that costs a fraction and does exactly the same while also never getting updates? Where does that extra money go to? But like op said, nowadays I just check OpenWRT compatibility when it comes to buying a home router, a well supported device usually receives updates for a good decade. (Anecdotally I've had three Netgear devices in my life and all of them caused severe problems. Enough for me to have them on my personal blacklist for life.)
  - throw0101a 6y ago
    You can go with Asus with has monthly/quarterly updates, as well as folks like Merlin (and others) who use the open source components to roll their own binaries. There's code in there besides the kernel that could have (security) bugs and backdoors.
    - greyhair 6y ago
      I was looking for the ASUS plug before I posted my own. My router history is Linksys -> Netear -> ASUS. Unless ASUS botches something badly, my next router will also be ASUS.
  - randomhacker123 6y ago
    The extra money goes into marketing to tell you that they are the best vendor. The hardware design and manufacture is outsourced to different vendors, in this case to Foxconn. See here: http://en.techinfodepot.shoutwiki.com/wiki/Netgear_R7000 http://en.techinfodepot.shoutwiki.com/wiki/Netgear_R7000 The software engineering is probably also outsourced mostly.
- eqvinox 6y ago
  > The bigger problem with these is usually not the vendor of the router, but the vendor of the SoC the device is built on. That just means the device vendor isn't exerting the necessary pressure/valuation on the SoC manufacturer. Of course the SoC manufacturer is gonna try and get away with bare minimum of work for absolute maximum of profit, just like the device vendor. The pressure needs to start at the end of the chain (which is end users) :/
  - ATsch 6y ago
    I totally agree. But the amount of pressure required is incredibly big. As in, Google has been trying it for years in the Android world and is only seeing success now with drastic measures that vendors hate, like forbidding use of any kernel patches outright.
    - eqvinox 6y ago
      Yeah... this might be something that needs legal action, like manufacturer liability for security issues within a specific timeframe... (could even be a "best before" date on electronics; at least this way you know what you get when you buy, the vendor can decide on their own how much support they want to offer, and the user can choose between the "good for 2 years" router and the "good for 5 years" one...)
- randomhacker123 6y ago
  The pressure from the device vendors to the SoC vendor to support the kernel version which was initially used for the SoC and fixing bugs and adding new feature is much bigger than the pressure to upgrade to new major kernel versions. The board manufactures normally do not want to upgrade. I very rarely see that device manufactures are doing a major kernel upgrade when a new SDK with support for a new major kernel is available from the SoC vendor. This only happens when they need new features from the new major kernel which can not easily be backported and a very big customer is requesting this and normally they also need a good internal software engineering department.
bottled_poe 6y ago
I’ve said it before an I’ll say it again. Netgear are the worst network equipment supplier I’ve ever owned. You just need to look through their “customer support” forums to determine how understaffed and incompetent they are. Will never buy again.
- tjalfi 6y ago
  Have you owned any Allied-Telesyn equipment? We had some of their switches at a previous job; resetting the admin password required placing a phone call to Romania.
mobilio 6y ago
2.6? I’ve seen also 2.4 on devices few years ago...
randomhacker123 6y ago
Using an very old and unsupported kernel is completely normal for embedded consumer devices like home routers. Normally the kernel is chosen by the SoC vendor when they start the new SoC project. Updating to a new major kernel version takes multiple man years of work because of all the vendor patches hacked into the kernel. Probably 500k to 2M lines of kernel code for such a router. After such an update you also have to run all your validation again which also takes effort. Normally there are 4 years between the start of a new SoC project and the first device with this SoC hitting the consumer market. Then this SoC is used for new projects the next 4 years and shipped in new products an additional 4 years. Now the kernel is 12 years old. ;-) Even when an SoC vendor provides a new SDK with a more recent kernel, most of the device manufacturers like Netgear would not upgrade existing products to this new SDK with the new kernel. They also have extensions to the kernel and would have to adapt them and then do an extensive validation again. Normally even security updates are only taken if someone proves that this specific devices is affected. Often board manufacturers do not even want to use the new SDK with the new kernel and security updates for new products when they already have devices with the old SDK, because this would reduce their possibility for reuse. The SoC vendor wants to reduce effort and will avoid to supporting many different kernel versions. If the major customers do not want to upgrade to a more recent kernel version they will stay at something old because the board manufacturers want to. The problem is that the customer does not care for security. The customer cares for security features you can print on a box, but not for something like fixing publicly known bugs in the kernel in 6 months. The home router industry is a hardware business, it is run by hardware experts and they run software like hardware. You start a project, build the system (hardware + software)), you validate the features and then ship it. Now you can start the next project. If you want to change this you have to request this directly, for small customers this is no really useful, but if you are an ISP and buy 500k units a year, then you can put some peruse on the supply chain. Please communicate your requirements often and to many people in your supply chain and not as one of the 5000 requirements in the excel sheet. If you decide against a vendor because of their software, communicate this to them directly and to many people in his organization, to increase the likelihood that it reaches someone who understand this and fixes it in the future. If they improve you can choose between more vendors next time.
- 6y ago
JacobSuperslav 6y ago
Netgear is known to stop releasing firmware updates to their routers ASAP!
slezyr 6y ago
> It's a good thing dd-wrt and similar exist. It depends on the hardware, for example, mine D-Link DIR-320 (A) has 32MB of RAM and 4MB of ROM (3801599 bytes, to be precise). It's not enough to fit last kernel (IIRC 4.8 for OpenWRT) even without GUI, I had compile it with some hacks. Edit. It has 256MB of RAM, 128MB of ROM. There is no excuse for this. https://openwrt.org/toh/netgear/r7000 https://openwrt.org/toh/netgear/r7000
tapper 6y ago
If your router will not flash to OpenWrt then don't by it!
Reith 6y ago
> What stood out for me was the kernel version of netgear equipment used: 2.6.36.4 Does having a modern kernel solve this issue? As I understand even on a modern linux-based router one should disable those ALGs as it's their [lack of] interface with connection state which is broken.

by arpa 6y ago

ATsch 6y ago

The bigger problem with these is usually not the vendor of the router, but the vendor of the SoC the device is built on. SoC vendors will usually provide you with a linux kernel that has an incredible amount of frequently shoddy out of tree patches and tweaks which make it very hard to rebase to a new version even if you really wanted to.

arpa 6y ago
That is also true.
steeve 6y ago
Exactly this. This situation is the same with SBCs. A product having a mainline kernel is a huge plus.
ksec 6y ago
I remember IBM donated ( or released ) an OpenPOWER 14nm CPU design ( with 7nm design coming in a few years time ). I wonder how far are we from having CoreBoot, mostly opened hardware Router and Appliances.
iforgotpassword 6y ago
But then why should I prefer Netgear over some Chinese no-name device that costs a fraction and does exactly the same while also never getting updates? Where does that extra money go to? But like op said, nowadays I just check OpenWRT compatibility when it comes to buying a home router, a well supported device usually receives updates for a good decade. (Anecdotally I've had three Netgear devices in my life and all of them caused severe problems. Enough for me to have them on my personal blacklist for life.)
- throw0101a 6y ago
  You can go with Asus with has monthly/quarterly updates, as well as folks like Merlin (and others) who use the open source components to roll their own binaries. There's code in there besides the kernel that could have (security) bugs and backdoors.
  - greyhair 6y ago
    I was looking for the ASUS plug before I posted my own. My router history is Linksys -> Netear -> ASUS. Unless ASUS botches something badly, my next router will also be ASUS.
- randomhacker123 6y ago
  The extra money goes into marketing to tell you that they are the best vendor. The hardware design and manufacture is outsourced to different vendors, in this case to Foxconn. See here: http://en.techinfodepot.shoutwiki.com/wiki/Netgear_R7000 http://en.techinfodepot.shoutwiki.com/wiki/Netgear_R7000 The software engineering is probably also outsourced mostly.
eqvinox 6y ago
> The bigger problem with these is usually not the vendor of the router, but the vendor of the SoC the device is built on. That just means the device vendor isn't exerting the necessary pressure/valuation on the SoC manufacturer. Of course the SoC manufacturer is gonna try and get away with bare minimum of work for absolute maximum of profit, just like the device vendor. The pressure needs to start at the end of the chain (which is end users) :/
- ATsch 6y ago
  I totally agree. But the amount of pressure required is incredibly big. As in, Google has been trying it for years in the Android world and is only seeing success now with drastic measures that vendors hate, like forbidding use of any kernel patches outright.
  - eqvinox 6y ago
    Yeah... this might be something that needs legal action, like manufacturer liability for security issues within a specific timeframe... (could even be a "best before" date on electronics; at least this way you know what you get when you buy, the vendor can decide on their own how much support they want to offer, and the user can choose between the "good for 2 years" router and the "good for 5 years" one...)
randomhacker123 6y ago
The pressure from the device vendors to the SoC vendor to support the kernel version which was initially used for the SoC and fixing bugs and adding new feature is much bigger than the pressure to upgrade to new major kernel versions. The board manufactures normally do not want to upgrade. I very rarely see that device manufactures are doing a major kernel upgrade when a new SDK with support for a new major kernel is available from the SoC vendor. This only happens when they need new features from the new major kernel which can not easily be backported and a very big customer is requesting this and normally they also need a good internal software engineering department.

bottled_poe 6y ago

I’ve said it before an I’ll say it again. Netgear are the worst network equipment supplier I’ve ever owned. You just need to look through their “customer support” forums to determine how understaffed and incompetent they are. Will never buy again.

tjalfi 6y ago
Have you owned any Allied-Telesyn equipment? We had some of their switches at a previous job; resetting the admin password required placing a phone call to Romania.

mobilio 6y ago

2.6? I’ve seen also 2.4 on devices few years ago...

randomhacker123 6y ago

Using an very old and unsupported kernel is completely normal for embedded consumer devices like home routers. Normally the kernel is chosen by the SoC vendor when they start the new SoC project. Updating to a new major kernel version takes multiple man years of work because of all the vendor patches hacked into the kernel. Probably 500k to 2M lines of kernel code for such a router. After such an update you also have to run all your validation again which also takes effort. Normally there are 4 years between the start of a new SoC project and the first device with this SoC hitting the consumer market. Then this SoC is used for new projects the next 4 years and shipped in new products an additional 4 years. Now the kernel is 12 years old. ;-) Even when an SoC vendor provides a new SDK with a more recent kernel, most of the device manufacturers like Netgear would not upgrade existing products to this new SDK with the new kernel. They also have extensions to the kernel and would have to adapt them and then do an extensive validation again. Normally even security updates are only taken if someone proves that this specific devices is affected. Often board manufacturers do not even want to use the new SDK with the new kernel and security updates for new products when they already have devices with the old SDK, because this would reduce their possibility for reuse. The SoC vendor wants to reduce effort and will avoid to supporting many different kernel versions. If the major customers do not want to upgrade to a more recent kernel version they will stay at something old because the board manufacturers want to. The problem is that the customer does not care for security. The customer cares for security features you can print on a box, but not for something like fixing publicly known bugs in the kernel in 6 months. The home router industry is a hardware business, it is run by hardware experts and they run software like hardware. You start a project, build the system (hardware + software)), you validate the features and then ship it. Now you can start the next project. If you want to change this you have to request this directly, for small customers this is no really useful, but if you are an ISP and buy 500k units a year, then you can put some peruse on the supply chain. Please communicate your requirements often and to many people in your supply chain and not as one of the 5000 requirements in the excel sheet. If you decide against a vendor because of their software, communicate this to them directly and to many people in his organization, to increase the likelihood that it reaches someone who understand this and fixes it in the future. If they improve you can choose between more vendors next time.

6y ago

JacobSuperslav 6y ago

Netgear is known to stop releasing firmware updates to their routers ASAP!

slezyr 6y ago

> It's a good thing dd-wrt and similar exist. It depends on the hardware, for example, mine D-Link DIR-320 (A) has 32MB of RAM and 4MB of ROM (3801599 bytes, to be precise). It's not enough to fit last kernel (IIRC 4.8 for OpenWRT) even without GUI, I had compile it with some hacks. Edit. It has 256MB of RAM, 128MB of ROM. There is no excuse for this. https://openwrt.org/toh/netgear/r7000 https://openwrt.org/toh/netgear/r7000

tapper 6y ago

If your router will not flash to OpenWrt then don't by it!

Reith 6y ago

> What stood out for me was the kernel version of netgear equipment used: 2.6.36.4 Does having a modern kernel solve this issue? As I understand even on a modern linux-based router one should disable those ALGs as it's their [lack of] interface with connection state which is broken.