5 ms·

The comment you reply to both explains the utility and proposes ways of mitigating the "huge security hole".

by detaro 4y ago

naasking 4y ago
So two clicks to turn on wifi that I can do from anywhere in my house is easier than digging my router out of my closet to write down and type in the serial number? This was supposed to be an idea that makes OpenWRT "usable immediately with little effort". This is not that.
- detaro 4y ago
  I didn't see the part where they suggested to disable configuration over wired ethernet, or this was the only thing suggested. And yes, a lot of the time when people are setting up a router they have the router at hand.
  - naasking 4y ago
    > I didn't see the part where they suggested to disable configuration over wired ethernet In case I wasn't clear, configuring it over wired Ethernet is exactly what I'm suggesting. This is a far more usable and secure default than default than wireless on with the password as some universal default or using the serial number.
  - wolrah 4y ago
    > And yes, a lot of the time when people are setting up a router they have the router at hand. While I have no doubt that this is true for home-grade firewall/NAT/wifi combo boxes in general, with very few exceptions OpenWRT is not a thing you get out of the box nor a thing "normal people" install. The Venn diagram of "people who have chosen to install an alternate firmware on their home network appliance" and "people who don't have an ethernet capable device around at basically all times" can't have a lot of overlap.
    - jorvi 4y ago
      The problem is not the fact of not having an Ethernet cable around, these days almost no laptop has an Ethernet port.
      - wolrah 4y ago
        Which is a problem easily solved with a cheap USB ethernet dongle, and again while the general mainstream computing audience may or may not have those I think it's reasonable to assume that the average person who has chosen to install OpenWRT probably wishes laptops still came with ethernet ports and purchased an adapter immediately or soon after. Maybe I'm wrong about that, but to me OpenWRT means geek audience, and geeks generally understand the value of a wired connection.
- jorvi 4y ago
  > So two clicks to turn on wifi How would you communicate with the router without an ethernet connection to it? Remember, WiFi is off by default. At that point you're probably gonna have to do some serial or JTAG magic, which is gonna involve physically breaking open the router and soldering. So much for 'two clicks'.
  - naasking 4y ago
    > How would you communicate with the router without an ethernet connection to it? Using the Ethernet port is exactly what I'm suggesting. This is far simpler than using the serial number as the wifi password, and more secure than a universal password. Furthermore, there are legal liabilities involved with the wifi spectrum. Different countries reserve different bands in the spectrum and have different limits on transmission power. OpenWRT would have to provide different builds for different countries, maintain and validate this list and risk making costly legal mistakes here, or if there's some lowest common denominator, then risk giving OpenWRT getting a reputation for bad wifi. No, best to let the user accept the liability of configuring their own router. The improvements in usability are marginal and the potential costs to OpenWRT are considerable.
    - jorvi 4y ago
      > Furthermore, there are legal liabilities involved with the wifi spectrum. OpenWRT is already ‘exposed’ (not really) to this risk, because as soon as you flip the radio to ‘on’, it’s just set to the default, not your specific region. > The improvements in usability are marginal and the potential costs to OpenWRT are considerable. And here we have it, the exact attitude the OP was talking about. Open source needs to become more considerate of its users.
      - naasking 4y ago
        > OpenWRT is already ‘exposed’ (not really) to this risk, because as soon as you flip the radio to ‘on’, it’s just set to the default, not your specific region. The radio does not turn on unless you tell it to by saving your configuration. That's where the liability lies and that liability falls on the user at present. Placing it on the project is not acceptable. > And here we have it, the exact attitude the OP was talking about. Open source needs to become more considerate of its users. Inapplicable when the attitude exists for a good reason. Users can go elsewhere for free stuff if they're not happy with it.

The comment you reply to both explains the utility and proposes ways of mitigating the "huge security hole".

by detaro 4y ago

The comment you reply to both explains the utility and proposes ways of mitigating the "huge security hole".

So two clicks to turn on wifi that I can do from anywhere in my house is easier than digging my router out of my closet to write down and type in the serial number? This was supposed to be an idea that makes OpenWRT "usable immediately with little effort". This is not that.

detaro 4y ago
I didn't see the part where they suggested to disable configuration over wired ethernet, or this was the only thing suggested. And yes, a lot of the time when people are setting up a router they have the router at hand.
- naasking 4y ago
  > I didn't see the part where they suggested to disable configuration over wired ethernet In case I wasn't clear, configuring it over wired Ethernet is exactly what I'm suggesting. This is a far more usable and secure default than default than wireless on with the password as some universal default or using the serial number.
- wolrah 4y ago
  > And yes, a lot of the time when people are setting up a router they have the router at hand. While I have no doubt that this is true for home-grade firewall/NAT/wifi combo boxes in general, with very few exceptions OpenWRT is not a thing you get out of the box nor a thing "normal people" install. The Venn diagram of "people who have chosen to install an alternate firmware on their home network appliance" and "people who don't have an ethernet capable device around at basically all times" can't have a lot of overlap.
  - jorvi 4y ago
    The problem is not the fact of not having an Ethernet cable around, these days almost no laptop has an Ethernet port.
    - wolrah 4y ago
      Which is a problem easily solved with a cheap USB ethernet dongle, and again while the general mainstream computing audience may or may not have those I think it's reasonable to assume that the average person who has chosen to install OpenWRT probably wishes laptops still came with ethernet ports and purchased an adapter immediately or soon after. Maybe I'm wrong about that, but to me OpenWRT means geek audience, and geeks generally understand the value of a wired connection.
jorvi 4y ago
> So two clicks to turn on wifi How would you communicate with the router without an ethernet connection to it? Remember, WiFi is off by default. At that point you're probably gonna have to do some serial or JTAG magic, which is gonna involve physically breaking open the router and soldering. So much for 'two clicks'.
- naasking 4y ago
  > How would you communicate with the router without an ethernet connection to it? Using the Ethernet port is exactly what I'm suggesting. This is far simpler than using the serial number as the wifi password, and more secure than a universal password. Furthermore, there are legal liabilities involved with the wifi spectrum. Different countries reserve different bands in the spectrum and have different limits on transmission power. OpenWRT would have to provide different builds for different countries, maintain and validate this list and risk making costly legal mistakes here, or if there's some lowest common denominator, then risk giving OpenWRT getting a reputation for bad wifi. No, best to let the user accept the liability of configuring their own router. The improvements in usability are marginal and the potential costs to OpenWRT are considerable.
  - jorvi 4y ago
    > Furthermore, there are legal liabilities involved with the wifi spectrum. OpenWRT is already ‘exposed’ (not really) to this risk, because as soon as you flip the radio to ‘on’, it’s just set to the default, not your specific region. > The improvements in usability are marginal and the potential costs to OpenWRT are considerable. And here we have it, the exact attitude the OP was talking about. Open source needs to become more considerate of its users.
    - naasking 4y ago
      > OpenWRT is already ‘exposed’ (not really) to this risk, because as soon as you flip the radio to ‘on’, it’s just set to the default, not your specific region. The radio does not turn on unless you tell it to by saving your configuration. That's where the liability lies and that liability falls on the user at present. Placing it on the project is not acceptable. > And here we have it, the exact attitude the OP was talking about. Open source needs to become more considerate of its users. Inapplicable when the attitude exists for a good reason. Users can go elsewhere for free stuff if they're not happy with it.