5 ms·

That's why open source can never compete with business grade closed source stuff: - they fixed the in 3 hours instead of making customers wait 6 months for a p

by micw 2y ago

That's why open source can never compete with business grade closed source stuff: - they fixed the in 3 hours instead of making customers wait 6 months for a patch (if any) - they did not try to sue the reporter of the issue - they did not even tell the users to throw away the "outdated" but perfectly working devices, offering a small discount to buy new

holoduke 2y ago
Home assistant and vlc anyone?
- mnau 2y ago
  Ha was very user unfriendly when I last tried it ~3 years ago. Yaml was necessary and it required a lot of fiddling to make z-wave work. Each blind was detected as ~5 things (2 useless or no idea what for)... Checking what was position, what power, ect was rather annoying. I made work and something broke about a year later. I just replaced it with off the shelf stuff.
  - paledot 2y ago
    HASS configuration has gotten a lot better in the past few years. Almost everything can now be done via the UI, including automation and scripting, and it's one of the smoothest scripting GUIs I've used. It even supports cut/paste for visual blocks. And for those 5% cases, there's an inline YAML editor which will open (and validate) only the pertinent block of what I'm sure is a 1000-line YAML file for editing in-browser. Z-Wave is still dodgy, but the migration to zwavejs has been an improvement and probably is as good as things will get with the state of Z-Wave being what it is. It's still not perfect, but HASS has become one of my user-facing open-source success stories. Most of the remaining annoyances are out of their control at this point.
deleted 2y ago
[deleted]
tapper 2y ago
Just why I love OpenWrt. They even ask the people that use screen readers like me to test the web interface to make sure that all is working as it should.
deleted 2y ago
[deleted]
beAbU 2y ago
Maybe make it clear you are being sarcastic here. English is not my native language, and my initial interpretation was that "they" in your post referred to the "business grade closed source stuff", and that OpenWRT is really a dangerous bet because they are guilty of all the things you listed.
- soulofmischief 2y ago
  To be fair, that initial confusion is the intended effect of OP's humor. Poe's law and all, but you did figure it out so the joke seems effective. Prefixing or suffixing with sarcasm warnings neuters the joke.
- tgtweak 2y ago
  The sarcasm was abundantly clear in the first bullet point.
- nightpool 2y ago
  Did you read the article? OP was very clear that OpenWRT fixed the issue in under 3 hours.
orra 2y ago
Whilst this is true, it looks like OpenWRT fixed the hash truncation but not the command injection. I hope they're planning on fixing the command injection. As the blog post says, the created images are signed. Even without the signing, it's code execution from untrusted user input. And of course vulnerabilities can be strung together (just like in this hash collision case).
- cesarb 2y ago
  > Whilst this is true, it looks like OpenWRT fixed the hash truncation but not the command injection. They did fix both AFAIK, the command injection fix is https://github.com/openwrt/asu/commit/deadda8097d49500260b171d2bf8ad2b048da04b https://github.com/openwrt/asu/commit/deadda8097d49500260b17... (source: https://openwrt.org/advisory/2024-12-06 https://openwrt.org/advisory/2024-12-06).
  - orra 2y ago
    Thanks for the correction and sorry for the mistake. I skimmed the changes but apparently not very well.
sweeter 2y ago
I have a router that from my ISP I am forced to use that has had a few CVEs ranging from not good to really bad. Most of which are years old. I can get a replacement but it's just the same model. They don't care about security at all and don't care about patching it, even though they have exclusive access rights to the router and can remotely log in to it. It's completely ridiculous.
- TacticalCoder 2y ago
  The one I use looks scary too. And it came by default with a dumb password too. I wouldn't be surprised if it had a few CVEs hanging too. > I have a router that from my ISP I am forced to use... A friend of mine did impersonate the ISP's router's MAC address and used wireshark to sniff the traffic when the modem started. He then configured the ONT (which is physically inside a SFP plug, it's tiny) to establish the handshake/send the credentials. I don't think the ISP has any idea at all :)
  - sweeter 2y ago
    That's so satisfying! I want to try the same, it would make for a good blog post lol
- dml2135 2y ago
  What forces you to use it? You can’t bring your own router?
  - nunez 2y ago
    Routers supplied by AT&T here in the US for their fiber gigabit service do RADIUS authentication with the carrier gateway using certs built into the device. There used to be an older version of this router that had known vulnerabilities which made extracting those certs possible but they've since been patched and those certs have been invalidated.
    - eightysixfour 2y ago
PoignardAzur 2y ago
Not gonna lie, you had me in the beginning.
deleted 2y ago
[deleted]
jazz9k 2y ago
This only works for a handful of open source projects with corporate backing and the resources to fix these issues quickly. For most OSS projects, the maintainers are either too overworked or just don't feel like fixing security issues.
- bmicraft 2y ago
  > For most OSS projects, the maintainers are either too overworked or just don't feel like fixing security issues. Surely you can't be serious about "most" (= a clear majority) oss projects not fixing vulnerabilities in a reasonable time frame?
TiredOfLife 2y ago
>they did not even tell the users to throw away the "outdated" but perfectly working devices, offering a small discount to buy new Because they simply brick the device when updating and it's easier, faster, cheaper to buy a new device than to unbrick.

by micw 2y ago

holoduke 2y ago

Home assistant and vlc anyone?

mnau 2y ago
Ha was very user unfriendly when I last tried it ~3 years ago. Yaml was necessary and it required a lot of fiddling to make z-wave work. Each blind was detected as ~5 things (2 useless or no idea what for)... Checking what was position, what power, ect was rather annoying. I made work and something broke about a year later. I just replaced it with off the shelf stuff.
- paledot 2y ago
  HASS configuration has gotten a lot better in the past few years. Almost everything can now be done via the UI, including automation and scripting, and it's one of the smoothest scripting GUIs I've used. It even supports cut/paste for visual blocks. And for those 5% cases, there's an inline YAML editor which will open (and validate) only the pertinent block of what I'm sure is a 1000-line YAML file for editing in-browser. Z-Wave is still dodgy, but the migration to zwavejs has been an improvement and probably is as good as things will get with the state of Z-Wave being what it is. It's still not perfect, but HASS has become one of my user-facing open-source success stories. Most of the remaining annoyances are out of their control at this point.

deleted 2y ago

[deleted]

tapper 2y ago

Just why I love OpenWrt. They even ask the people that use screen readers like me to test the web interface to make sure that all is working as it should.

deleted 2y ago

[deleted]

beAbU 2y ago

Maybe make it clear you are being sarcastic here. English is not my native language, and my initial interpretation was that "they" in your post referred to the "business grade closed source stuff", and that OpenWRT is really a dangerous bet because they are guilty of all the things you listed.

soulofmischief 2y ago
To be fair, that initial confusion is the intended effect of OP's humor. Poe's law and all, but you did figure it out so the joke seems effective. Prefixing or suffixing with sarcasm warnings neuters the joke.
tgtweak 2y ago
The sarcasm was abundantly clear in the first bullet point.
nightpool 2y ago
Did you read the article? OP was very clear that OpenWRT fixed the issue in under 3 hours.

orra 2y ago

Whilst this is true, it looks like OpenWRT fixed the hash truncation but not the command injection. I hope they're planning on fixing the command injection. As the blog post says, the created images are signed. Even without the signing, it's code execution from untrusted user input. And of course vulnerabilities can be strung together (just like in this hash collision case).

cesarb 2y ago
> Whilst this is true, it looks like OpenWRT fixed the hash truncation but not the command injection. They did fix both AFAIK, the command injection fix is https://github.com/openwrt/asu/commit/deadda8097d49500260b171d2bf8ad2b048da04b https://github.com/openwrt/asu/commit/deadda8097d49500260b17... (source: https://openwrt.org/advisory/2024-12-06 https://openwrt.org/advisory/2024-12-06).
- orra 2y ago
  Thanks for the correction and sorry for the mistake. I skimmed the changes but apparently not very well.

sweeter 2y ago

I have a router that from my ISP I am forced to use that has had a few CVEs ranging from not good to really bad. Most of which are years old. I can get a replacement but it's just the same model. They don't care about security at all and don't care about patching it, even though they have exclusive access rights to the router and can remotely log in to it. It's completely ridiculous.

TacticalCoder 2y ago
The one I use looks scary too. And it came by default with a dumb password too. I wouldn't be surprised if it had a few CVEs hanging too. > I have a router that from my ISP I am forced to use... A friend of mine did impersonate the ISP's router's MAC address and used wireshark to sniff the traffic when the modem started. He then configured the ONT (which is physically inside a SFP plug, it's tiny) to establish the handshake/send the credentials. I don't think the ISP has any idea at all :)
- sweeter 2y ago
  That's so satisfying! I want to try the same, it would make for a good blog post lol
dml2135 2y ago
What forces you to use it? You can’t bring your own router?
- nunez 2y ago
  Routers supplied by AT&T here in the US for their fiber gigabit service do RADIUS authentication with the carrier gateway using certs built into the device. There used to be an older version of this router that had known vulnerabilities which made extracting those certs possible but they've since been patched and those certs have been invalidated.
  - eightysixfour 2y ago

PoignardAzur 2y ago

Not gonna lie, you had me in the beginning.

deleted 2y ago

[deleted]

jazz9k 2y ago

This only works for a handful of open source projects with corporate backing and the resources to fix these issues quickly. For most OSS projects, the maintainers are either too overworked or just don't feel like fixing security issues.

bmicraft 2y ago
> For most OSS projects, the maintainers are either too overworked or just don't feel like fixing security issues. Surely you can't be serious about "most" (= a clear majority) oss projects not fixing vulnerabilities in a reasonable time frame?

TiredOfLife 2y ago

>they did not even tell the users to throw away the "outdated" but perfectly working devices, offering a small discount to buy new Because they simply brick the device when updating and it's easier, faster, cheaper to buy a new device than to unbrick.