4 ms·

I care less about speed and recommend you do too. I use OpenWrt for several reasons. It’s really easy to setup up openvpn or firewire to protect all your device

I care less about speed and recommend you do too. I use OpenWrt for several reasons. It’s really easy to setup up openvpn or firewire to protect all your devices including iot. Secondly, I disable all radios except a single 2.4g to put a hard stop on beam forming capabilities. Call me paranoid but I don’t want my router to be capable of tracking movement throughout my house. Finally the adblock package is great. A really easy way to block ads on iot devices. OpenWrt can be installed on just about anything with luci supporting a lot of common routers. Ditch your factory spyware I mean firmware asap.

hypothesis 3y ago
Nevermind devices under your control, how are you going to stop your neighbor’s devices from tracking you?
- spacebacon 3y ago
  Memetic infiltration of the HOA.
- Kadin 3y ago
  You track them, obviously. Then it's mutually assured privacy destruction.
  - hypothesis 3y ago
    That's not good enough! You will need superior defense capabilities: e.g a house-sized Faraday cage. According to wikipedia they are now building prisons like that. [0] https://en.m.wikipedia.org/wiki/Faraday_cage https://en.m.wikipedia.org/wiki/Faraday_cage
TechBro8615 3y ago
How often do you install updates? My ISP router is a piece of crap, but it's running the same software as a few million other routers, so when there's a vulnerability, at least my ISP pushes out an automatic update to fix it. Obviously there's a tradeoff here, between the juicy target of a million homogenous ISP routers, and the ISP quickly patching them. But I bet there are also millions of routers running OpenWRT, albeit on a wider variety of hardware, with many disparate configurations and software versions. I'd expect some opportunistic hackers might see OpenWRT as a juicy target too. Does OpenWRT have good support for automatic, unattended security updates?
- nulbyte 3y ago
  > Does OpenWRT have good support for automatic, unattended security updates? I don't think this would work similarly to how it does on ISP hardware. ISPs have the ability to test their updates against known network conditions. OpenWRT developers do not have the same guarantee, and they don't even make or control all the software you would be using on the device.
  - spacebacon 3y ago
    https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... no unattended support yet but you can preserve packages. Here’s a link to past security advisories https://openwrt.org/docs/guide-developer/security https://openwrt.org/docs/guide-developer/security
- champtar 3y ago
  "OpenWrt 23.05 supports over 1750 devices" this makes it pretty much impossible to do anything unattended, you will always break something, don't think anyone wants to take the responsibility. Now there is Attended Sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... which makes it really easy to upgrade the whole system, but the user has to launch the process.
  - deleted 3y ago
    [deleted]
- Kadin 3y ago
  Yeeeah, no thanks. I don't want my hardware running automatic upgrades of any sort. I'd probably trust an open source team like OpenWRT's more than a shitbag company like my telco, or only-slightly-less-shitbaggy cableco, but as others have noted an open source effort likely won't ever have the resources to do it anyway. I deeply dislike the cableco's ability to push firmware files to my DOCSIS modem, and I'm certainly not letting them any further into my network than that. Sure, having your router get security updates is nice, but as a tradeoff for that, you're effectively giving your ISP a complete view into your home network. They could install firmware that gives them MAC addresses and then tags packet traffic by device, giving them a device-by-device, and hence person-by-person, packet-level (or at least connection-level, in the case of properly encrypted traffic) view of who is looking at what, all the time. With a more sophisticated beam-forming AP, they could physically track your devices (and thus people) around inside the house. That data would be phenomenally valuable, especially as ad-tracking systems get shut down. And they've realistically got at least a few years of absolutely bald-faced shut-up-and-bend-over abusive behavior before Congress would get around to regulating it, and that's given both the worst-case for their behavior and the best-case for regulators. Very likely they could do shit like that indefinitely, especially if they own the router hardware. Who knows -- maybe they already are? It's not like they'd have to tell anyone in the US if they were. I think I'd rather take my chances with random ransomware gangs than the guarantee of allowing a hostile actor -- my ISP -- into my private network. Those fuckers can stay where they belong, on the untrusted side of the firewall, pushing packets and nothing else.
cassianoleal 3y ago
> It’s really easy to setup up openvpn or firewire Did you mean Wireguard? FireWire [0] is a serial bus standard that used to compete with USB. :) [0] https://en.wikipedia.org/wiki/IEEE_1394 https://en.wikipedia.org/wiki/IEEE_1394
- spacebacon 3y ago
  lol yes, wireguard.

hypothesis 3y ago

Nevermind devices under your control, how are you going to stop your neighbor’s devices from tracking you?

spacebacon 3y ago
Memetic infiltration of the HOA.
Kadin 3y ago
You track them, obviously. Then it's mutually assured privacy destruction.
- hypothesis 3y ago
  That's not good enough! You will need superior defense capabilities: e.g a house-sized Faraday cage. According to wikipedia they are now building prisons like that. [0] https://en.m.wikipedia.org/wiki/Faraday_cage https://en.m.wikipedia.org/wiki/Faraday_cage

TechBro8615 3y ago

How often do you install updates? My ISP router is a piece of crap, but it's running the same software as a few million other routers, so when there's a vulnerability, at least my ISP pushes out an automatic update to fix it. Obviously there's a tradeoff here, between the juicy target of a million homogenous ISP routers, and the ISP quickly patching them. But I bet there are also millions of routers running OpenWRT, albeit on a wider variety of hardware, with many disparate configurations and software versions. I'd expect some opportunistic hackers might see OpenWRT as a juicy target too. Does OpenWRT have good support for automatic, unattended security updates?

nulbyte 3y ago
> Does OpenWRT have good support for automatic, unattended security updates? I don't think this would work similarly to how it does on ISP hardware. ISPs have the ability to test their updates against known network conditions. OpenWRT developers do not have the same guarantee, and they don't even make or control all the software you would be using on the device.
- spacebacon 3y ago
  https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... no unattended support yet but you can preserve packages. Here’s a link to past security advisories https://openwrt.org/docs/guide-developer/security https://openwrt.org/docs/guide-developer/security
champtar 3y ago
"OpenWrt 23.05 supports over 1750 devices" this makes it pretty much impossible to do anything unattended, you will always break something, don't think anyone wants to take the responsibility. Now there is Attended Sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... which makes it really easy to upgrade the whole system, but the user has to launch the process.
- deleted 3y ago
  [deleted]
Kadin 3y ago
Yeeeah, no thanks. I don't want my hardware running automatic upgrades of any sort. I'd probably trust an open source team like OpenWRT's more than a shitbag company like my telco, or only-slightly-less-shitbaggy cableco, but as others have noted an open source effort likely won't ever have the resources to do it anyway. I deeply dislike the cableco's ability to push firmware files to my DOCSIS modem, and I'm certainly not letting them any further into my network than that. Sure, having your router get security updates is nice, but as a tradeoff for that, you're effectively giving your ISP a complete view into your home network. They could install firmware that gives them MAC addresses and then tags packet traffic by device, giving them a device-by-device, and hence person-by-person, packet-level (or at least connection-level, in the case of properly encrypted traffic) view of who is looking at what, all the time. With a more sophisticated beam-forming AP, they could physically track your devices (and thus people) around inside the house. That data would be phenomenally valuable, especially as ad-tracking systems get shut down. And they've realistically got at least a few years of absolutely bald-faced shut-up-and-bend-over abusive behavior before Congress would get around to regulating it, and that's given both the worst-case for their behavior and the best-case for regulators. Very likely they could do shit like that indefinitely, especially if they own the router hardware. Who knows -- maybe they already are? It's not like they'd have to tell anyone in the US if they were. I think I'd rather take my chances with random ransomware gangs than the guarantee of allowing a hostile actor -- my ISP -- into my private network. Those fuckers can stay where they belong, on the untrusted side of the firewall, pushing packets and nothing else.

cassianoleal 3y ago

> It’s really easy to setup up openvpn or firewire Did you mean Wireguard? FireWire [0] is a serial bus standard that used to compete with USB. :) [0] https://en.wikipedia.org/wiki/IEEE_1394 https://en.wikipedia.org/wiki/IEEE_1394

spacebacon 3y ago
lol yes, wireguard.