3 ms·

How often do you install updates? My ISP router is a piece of crap, but it's running the same software as a few million other routers, so when there's a vulnera

How often do you install updates? My ISP router is a piece of crap, but it's running the same software as a few million other routers, so when there's a vulnerability, at least my ISP pushes out an automatic update to fix it. Obviously there's a tradeoff here, between the juicy target of a million homogenous ISP routers, and the ISP quickly patching them. But I bet there are also millions of routers running OpenWRT, albeit on a wider variety of hardware, with many disparate configurations and software versions. I'd expect some opportunistic hackers might see OpenWRT as a juicy target too. Does OpenWRT have good support for automatic, unattended security updates?

nulbyte 3y ago
> Does OpenWRT have good support for automatic, unattended security updates? I don't think this would work similarly to how it does on ISP hardware. ISPs have the ability to test their updates against known network conditions. OpenWRT developers do not have the same guarantee, and they don't even make or control all the software you would be using on the device.
- spacebacon 3y ago
  https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... no unattended support yet but you can preserve packages. Here’s a link to past security advisories https://openwrt.org/docs/guide-developer/security https://openwrt.org/docs/guide-developer/security
champtar 3y ago
"OpenWrt 23.05 supports over 1750 devices" this makes it pretty much impossible to do anything unattended, you will always break something, don't think anyone wants to take the responsibility. Now there is Attended Sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... which makes it really easy to upgrade the whole system, but the user has to launch the process.
- deleted 3y ago
  [deleted]
Kadin 3y ago
Yeeeah, no thanks. I don't want my hardware running automatic upgrades of any sort. I'd probably trust an open source team like OpenWRT's more than a shitbag company like my telco, or only-slightly-less-shitbaggy cableco, but as others have noted an open source effort likely won't ever have the resources to do it anyway. I deeply dislike the cableco's ability to push firmware files to my DOCSIS modem, and I'm certainly not letting them any further into my network than that. Sure, having your router get security updates is nice, but as a tradeoff for that, you're effectively giving your ISP a complete view into your home network. They could install firmware that gives them MAC addresses and then tags packet traffic by device, giving them a device-by-device, and hence person-by-person, packet-level (or at least connection-level, in the case of properly encrypted traffic) view of who is looking at what, all the time. With a more sophisticated beam-forming AP, they could physically track your devices (and thus people) around inside the house. That data would be phenomenally valuable, especially as ad-tracking systems get shut down. And they've realistically got at least a few years of absolutely bald-faced shut-up-and-bend-over abusive behavior before Congress would get around to regulating it, and that's given both the worst-case for their behavior and the best-case for regulators. Very likely they could do shit like that indefinitely, especially if they own the router hardware. Who knows -- maybe they already are? It's not like they'd have to tell anyone in the US if they were. I think I'd rather take my chances with random ransomware gangs than the guarantee of allowing a hostile actor -- my ISP -- into my private network. Those fuckers can stay where they belong, on the untrusted side of the firewall, pushing packets and nothing else.
- spacebacon 3y ago
  No device is needed to track bodies in a house btw.

nulbyte 3y ago

> Does OpenWRT have good support for automatic, unattended security updates? I don't think this would work similarly to how it does on ISP hardware. ISPs have the ability to test their updates against known network conditions. OpenWRT developers do not have the same guarantee, and they don't even make or control all the software you would be using on the device.

spacebacon 3y ago
https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... no unattended support yet but you can preserve packages. Here’s a link to past security advisories https://openwrt.org/docs/guide-developer/security https://openwrt.org/docs/guide-developer/security

champtar 3y ago

"OpenWrt 23.05 supports over 1750 devices" this makes it pretty much impossible to do anything unattended, you will always break something, don't think anyone wants to take the responsibility. Now there is Attended Sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... which makes it really easy to upgrade the whole system, but the user has to launch the process.

deleted 3y ago
[deleted]

Kadin 3y ago

Yeeeah, no thanks. I don't want my hardware running automatic upgrades of any sort. I'd probably trust an open source team like OpenWRT's more than a shitbag company like my telco, or only-slightly-less-shitbaggy cableco, but as others have noted an open source effort likely won't ever have the resources to do it anyway. I deeply dislike the cableco's ability to push firmware files to my DOCSIS modem, and I'm certainly not letting them any further into my network than that. Sure, having your router get security updates is nice, but as a tradeoff for that, you're effectively giving your ISP a complete view into your home network. They could install firmware that gives them MAC addresses and then tags packet traffic by device, giving them a device-by-device, and hence person-by-person, packet-level (or at least connection-level, in the case of properly encrypted traffic) view of who is looking at what, all the time. With a more sophisticated beam-forming AP, they could physically track your devices (and thus people) around inside the house. That data would be phenomenally valuable, especially as ad-tracking systems get shut down. And they've realistically got at least a few years of absolutely bald-faced shut-up-and-bend-over abusive behavior before Congress would get around to regulating it, and that's given both the worst-case for their behavior and the best-case for regulators. Very likely they could do shit like that indefinitely, especially if they own the router hardware. Who knows -- maybe they already are? It's not like they'd have to tell anyone in the US if they were. I think I'd rather take my chances with random ransomware gangs than the guarantee of allowing a hostile actor -- my ISP -- into my private network. Those fuckers can stay where they belong, on the untrusted side of the firewall, pushing packets and nothing else.

spacebacon 3y ago
No device is needed to track bodies in a house btw.