4 ms·

Is it really any different than every person who insists on running pfSense for security reasons then immediately suggesting some Chinese shitbox PC off AliExpr

Is it really any different than every person who insists on running pfSense for security reasons then immediately suggesting some Chinese shitbox PC off AliExpress as the ideal platform to run it on? Also, since when has having a Wikipedia page proven a company legitimate? You know most companies author their own pages anyway, that's kind of how Wikipedia works.

unethical_ban 2y ago
As opposed to the people who run insecure software on questionable hardware? Is everyone supposed to buy Checkpoint?
- ElectRabbit 2y ago
  By looking at the security history of Checkpoint.. uhm.. :-)
wtallis 2y ago
> suggesting some Chinese shitbox PC off AliExpress as the ideal platform to run it on? How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide, but it's implausible that a Chinese intelligence agency would indiscriminately deploy an attack that made use of a compromised Intel Management Engine firmware signing key to put firmware rootkits in cheap hardware sold to individual consumers. On an embedded system like the OpenWRT Two where the entire BOM of the system will be public and the OS has full control over the raw flash memory, a purely software-based supply chain attack would be extremely difficult, and a hardware-based supply chain attack would be expensive. Do you think an intelligence agency would really bother with this for a device that is mostly going to be shipping to nerdy hobbyists? There's more to a threat model than just recognizing that an attack may be technically feasible.
- donnachangstein 2y ago
  > How reasonable do you think it is to be this automatically suspicious of any computer coming from China? Based on their track record? Pretty fucking reasonable. I would say that most probably isn't malicious collaboration with the CCP, rather sheer incompetence. Shipping secure anything just isn't part of their culture. Read a comment on HN the other day from someone that evaluated Huawei hardware for a telco and swore it was so full of holes to be unusable. The ingrained extreme cheapness of Chinese culture doesn't help. Security is viewed as a luxury - why waste time and money on it when that could be better spent elsewhere? That said, the incompetence gives them plausible deniability when the intelligence agencies take advantage to exploit the holes for their own use.
  - wtallis 2y ago
    What kind of security vulnerabilities do you think an incompetent PC OEM is going to accidentally introduce to a barebones PC that's basically shipping an Intel reference platform and no SSD? Or that GL.iNet might be able to introduce to a system where OpenWRT is assembling the firmware image that gets flashed to the board, and if there are any closed-source components they'd be coming from Mediatek and not developed by GL.iNet? Shipping telco hardware with a massive bespoke software stack implementing an impossibly-complex pile of standards is very different from what we're talking about here.
    - coderatlarge 2y ago
      I’ve reluctantly come to the view that Apple is the best bet for a consumer to get a somewhat reasonable (price notwithstanding) compromise between hardware vertical integration and software that offers substantial bug bounties and large market incentives to not allow bad vulnerabilities to sit for too long. With deep enough pockets to hang tough if needed in various situations.
      - throwaway48476 2y ago
        Apple also ships bloated buggy software with a massive TCB that makes it almost trivially easy for state actors to break in.
- josteink 2y ago
  > How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide The problem seems to be that this firmware doesn’t really get updated once the machine is sold. That’s legitimate criticism for a security-critical network component.
  - wtallis 2y ago
    It's not ideal, but it's not a deal-breaker for every use case. The kind of firmware you get on a barebones industrial-oriented miniPC style router from China doesn't have much potential for a remotely-exploitable vulnerability. Most of the NICs aren't even going to be touched by the boot firmware. The user-supplied OS can take care of applying CPU microcode updates. If the PC doesn't ship with a rootkit already present in the firmware, it's pretty hard for the firmware to be a security problem unless it's secondary to a security vulnerability in the OpenWRT or pfSense software. Running an up-to-date OpenWRT or pfSense on a normal PC hardware platform with outdated UEFI firmware is still a big step up in security compared to running factory firmware+OS on a cheap consumer wireless router.
  - Brian_K_White 2y ago
    I would say that there is no special value to firmware updates when you have no visibility into or control over the authors of the updates. We need adversarial competitive firmware that comes from different sources the same as we have for software. I know why we don't have that. It doesn't change the fact that that is what we need.
- 486sx33 2y ago
  VERY reasonable , if not a total piece of crap with fake copied hardware, a security nightmare with hardware level integrated spyware. Don’t bother importing. They should start seizing these at the port
throwaway48476 2y ago
Usually the kind of people installing their own router software are the homelabbers who would buy a netgate appliance or equivalent in a professional setting.
neilv 2y ago
The people who source no-name/random-name computer/networking hardware off of AliExpress to use for routers aren't the security-conscious people I'm talking about. As I said, GL.iNet is a popular company. I didn't say that having a Wikipedia page proves that a company is legitimate. I know how Wikipedia works.

unethical_ban 2y ago

As opposed to the people who run insecure software on questionable hardware? Is everyone supposed to buy Checkpoint?

ElectRabbit 2y ago
By looking at the security history of Checkpoint.. uhm.. :-)

wtallis 2y ago

> suggesting some Chinese shitbox PC off AliExpress as the ideal platform to run it on? How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide, but it's implausible that a Chinese intelligence agency would indiscriminately deploy an attack that made use of a compromised Intel Management Engine firmware signing key to put firmware rootkits in cheap hardware sold to individual consumers. On an embedded system like the OpenWRT Two where the entire BOM of the system will be public and the OS has full control over the raw flash memory, a purely software-based supply chain attack would be extremely difficult, and a hardware-based supply chain attack would be expensive. Do you think an intelligence agency would really bother with this for a device that is mostly going to be shipping to nerdy hobbyists? There's more to a threat model than just recognizing that an attack may be technically feasible.

donnachangstein 2y ago
> How reasonable do you think it is to be this automatically suspicious of any computer coming from China? Based on their track record? Pretty fucking reasonable. I would say that most probably isn't malicious collaboration with the CCP, rather sheer incompetence. Shipping secure anything just isn't part of their culture. Read a comment on HN the other day from someone that evaluated Huawei hardware for a telco and swore it was so full of holes to be unusable. The ingrained extreme cheapness of Chinese culture doesn't help. Security is viewed as a luxury - why waste time and money on it when that could be better spent elsewhere? That said, the incompetence gives them plausible deniability when the intelligence agencies take advantage to exploit the holes for their own use.
- wtallis 2y ago
  What kind of security vulnerabilities do you think an incompetent PC OEM is going to accidentally introduce to a barebones PC that's basically shipping an Intel reference platform and no SSD? Or that GL.iNet might be able to introduce to a system where OpenWRT is assembling the firmware image that gets flashed to the board, and if there are any closed-source components they'd be coming from Mediatek and not developed by GL.iNet? Shipping telco hardware with a massive bespoke software stack implementing an impossibly-complex pile of standards is very different from what we're talking about here.
  - coderatlarge 2y ago
    I’ve reluctantly come to the view that Apple is the best bet for a consumer to get a somewhat reasonable (price notwithstanding) compromise between hardware vertical integration and software that offers substantial bug bounties and large market incentives to not allow bad vulnerabilities to sit for too long. With deep enough pockets to hang tough if needed in various situations.
    - throwaway48476 2y ago
      Apple also ships bloated buggy software with a massive TCB that makes it almost trivially easy for state actors to break in.
josteink 2y ago
> How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide The problem seems to be that this firmware doesn’t really get updated once the machine is sold. That’s legitimate criticism for a security-critical network component.
- wtallis 2y ago
  It's not ideal, but it's not a deal-breaker for every use case. The kind of firmware you get on a barebones industrial-oriented miniPC style router from China doesn't have much potential for a remotely-exploitable vulnerability. Most of the NICs aren't even going to be touched by the boot firmware. The user-supplied OS can take care of applying CPU microcode updates. If the PC doesn't ship with a rootkit already present in the firmware, it's pretty hard for the firmware to be a security problem unless it's secondary to a security vulnerability in the OpenWRT or pfSense software. Running an up-to-date OpenWRT or pfSense on a normal PC hardware platform with outdated UEFI firmware is still a big step up in security compared to running factory firmware+OS on a cheap consumer wireless router.
- Brian_K_White 2y ago
  I would say that there is no special value to firmware updates when you have no visibility into or control over the authors of the updates. We need adversarial competitive firmware that comes from different sources the same as we have for software. I know why we don't have that. It doesn't change the fact that that is what we need.
486sx33 2y ago
VERY reasonable , if not a total piece of crap with fake copied hardware, a security nightmare with hardware level integrated spyware. Don’t bother importing. They should start seizing these at the port

throwaway48476 2y ago

Usually the kind of people installing their own router software are the homelabbers who would buy a netgate appliance or equivalent in a professional setting.

neilv 2y ago

The people who source no-name/random-name computer/networking hardware off of AliExpress to use for routers aren't the security-conscious people I'm talking about. As I said, GL.iNet is a popular company. I didn't say that having a Wikipedia page proves that a company is legitimate. I know how Wikipedia works.