4 ms·

Home routers aren’t exactly a high-margin industry. Manufacturers may not be willing to pay for developers who know what they’re doing.

nickpeterson 2y ago
That or they get developers who know exactly what they’re doing…
- toyg 2y ago
  * codemonkey takes low salary from router manufacturer * codemonkey integrates it with low salary from $state_actor * codemonkey be happy, manufacturer be happy, state actor be happy - win-win!
  - nickpeterson 2y ago
    I’m pretty sure you missed a step where “he gets up gets coffee”
  - ahazred8ta 2y ago
    State actor have many banana.
Havoc 2y ago
Don’t leave mystery backdoors exposed internet side isn’t exactly advanced knowledge though
- arp242 2y ago
  It's LAN side only. Not that this excuses things, but it's not internet side.
- dagw 2y ago
  Probably a temporary hack someone did to facilitate some internal testing and no one remembered to comment it out before building the release version.
  - sgc 2y ago
    I tend to think this type of failure is from utter lack of caring. They know it's there, they know it's a security hole, but are just too lazy to deal with it until it comes back to bite them.
repelsteeltje 2y ago
How would hn community feel about government intervention into this obvious market failure? For instance: mandate all firmware on home routers be open source. (Either by selling hardware only and give guidance on installing openwrt or disclosing the source to their existing proprietary crap) Is that a good idea? Is it realistic?
- tenebrisalietum 2y ago
  I would bet such intervention results in it no longer being allowed to use GPL-style open source code that lets you rebuild/customize firmware, and no longer being allowed/able to use firmware not signed by the manufacturer.
  - repelsteeltje 2y ago
    Do you mean vendors would try to subvert/work around such legislation?
    - tenebrisalietum 2y ago
      No. This concrete example illustrates my intended meaning: Asus has a couple of Wi-Fi access point/switch/router combos with their own Tomato derived firmware named AsusWRT. It's nice. Because it's GPL, the source is required to be available, and a project for a derivative firmware named Merlin exists. Merlin provides additional features. One can choose to flash this firmware if desired. If these devices must only accept signed firmware then the above becomes practically impossible and you cannot control the software running on your own device.
      - repelsteeltje 2y ago
        Ah. So essentially, malicious compliance with the open source requirement, using DRM/tpm. Probably under the gise of SECURITAHH... Yeah, I can see that. Might be remediated using legislation as well - mandate free access to third parties. The point being that (open) software development can continue maintenance beyond vendor support for the hardware. But yeah, that would still need some story - and clever thoughts - about authenticity and trustworthiness of the firmware and how to technically enforce them.

nickpeterson 2y ago

That or they get developers who know exactly what they’re doing…

toyg 2y ago
* codemonkey takes low salary from router manufacturer * codemonkey integrates it with low salary from $state_actor * codemonkey be happy, manufacturer be happy, state actor be happy - win-win!
- nickpeterson 2y ago
  I’m pretty sure you missed a step where “he gets up gets coffee”
- ahazred8ta 2y ago
  State actor have many banana.

Havoc 2y ago

Don’t leave mystery backdoors exposed internet side isn’t exactly advanced knowledge though

arp242 2y ago
It's LAN side only. Not that this excuses things, but it's not internet side.
dagw 2y ago
Probably a temporary hack someone did to facilitate some internal testing and no one remembered to comment it out before building the release version.
- sgc 2y ago
  I tend to think this type of failure is from utter lack of caring. They know it's there, they know it's a security hole, but are just too lazy to deal with it until it comes back to bite them.

repelsteeltje 2y ago

How would hn community feel about government intervention into this obvious market failure? For instance: mandate all firmware on home routers be open source. (Either by selling hardware only and give guidance on installing openwrt or disclosing the source to their existing proprietary crap) Is that a good idea? Is it realistic?

tenebrisalietum 2y ago
I would bet such intervention results in it no longer being allowed to use GPL-style open source code that lets you rebuild/customize firmware, and no longer being allowed/able to use firmware not signed by the manufacturer.
- repelsteeltje 2y ago
  Do you mean vendors would try to subvert/work around such legislation?
  - tenebrisalietum 2y ago
    No. This concrete example illustrates my intended meaning: Asus has a couple of Wi-Fi access point/switch/router combos with their own Tomato derived firmware named AsusWRT. It's nice. Because it's GPL, the source is required to be available, and a project for a derivative firmware named Merlin exists. Merlin provides additional features. One can choose to flash this firmware if desired. If these devices must only accept signed firmware then the above becomes practically impossible and you cannot control the software running on your own device.
    - repelsteeltje 2y ago
      Ah. So essentially, malicious compliance with the open source requirement, using DRM/tpm. Probably under the gise of SECURITAHH... Yeah, I can see that. Might be remediated using legislation as well - mandate free access to third parties. The point being that (open) software development can continue maintenance beyond vendor support for the hardware. But yeah, that would still need some story - and clever thoughts - about authenticity and trustworthiness of the firmware and how to technically enforce them.