5 ms·

You aren't thinking low enough for firmware. All modern WiFi APs require closed firmware blobs that run below or parallel to OpenWRT. You replacing the router

You aren't thinking low enough for firmware. All modern WiFi APs require closed firmware blobs that run below or parallel to OpenWRT. You replacing the router OS with OpenWRT does nothing when the radio has full DMA access and runs its own OS on its own processor. The OpenWRT layer will have no idea what it's running/infiltrating/exfiltrating. I say this as someone who has been running and building OpenWRT forever. It's great but it isn't a panacea.

chatmasta 1y ago
That's why I bought a PCEngines box (one of the last of their inventory before they went out of business) with completely transparent hardware and no Chinese manufacturer in the supply chain.
- DANmode 1y ago
  Neat. If it dies tomorrow, what’s next, out of curiosity?
  - denkmoon 1y ago
    For anyone asking this question I might suggest Protectli. They've got x86 systems with coreboot. That's about as good as you can get these days for open source-ness without going really obscure or outdated. I've got a VP2440 as my router and firewall. You can neuter the intel management engine with coreboot, but there's still going to be firmware blobs somewhere in it, especially if you're trying to build a wifi ap. One of my 2 pcengines APUs has developed an issue with its solder joints I suspect. It hangs at the bootloader unless the unit is already warm. Can't complain at all, it lasted ages and problems like this are just life for things that thermally cycle, it was in a pretty extreme climate for most of its life. Doesn't help with me needing a replacement now pcengines is out of business though, hence getting a protectli box.
    - Retz4o4 1y ago
      Thank you! Been liking for replacements like this.
    - alias_neo 1y ago
      > I might suggest Protectli This is the route I went. After a decade plus of shite consumer routers and finally an EdgeRouter which died (along with Ubiquiti's quality) I bought a Protectli box, build and flashed Coreboot and run OPNSense. It's been going strong with regular updates (and by regular I mean as regular as your Linux workstation) for over half a decade now. It wasn't cheap, somewhere in the region of £700 after adding SSD and RAM but it's a way, way overkill model and never exceeds 10% RAM usage and 15% CPU with an IDS running and a bunch of VLANs and Gigabit symmetric WAN. My original goal for overspeccing it was longevity, but I regret it now, I want to upgrade to 10G+ networking and I can't justify replacing it when it runs so well and wasn't cheap.
toast0 1y ago
Sure, but if you run OpenWRT you can pick the radio firmware image. And you can trust Qualcomm cause they're from San Diego and made Eudora; their firmware won't have intentional security issues.
- wiredpancake 1y ago
  [dead]
- deletedie 1y ago
  And yet American products are the only ones we've ever had hard evidence on wrt intentional security issues in collaboration with US Intelligence.
  - knappe 1y ago
    Source for this claim?
    - overfeed 1y ago
      snowden-cisco-nsa-tao-interdiction.jpg
  - fulafel 1y ago
    Sometimes it's Swiss companies run by the CIA: https://www.npr.org/2020/03/05/812499752/uncovering-the-cias-audacious-operation-that-gave-them-access-to-state-secrets https://www.npr.org/2020/03/05/812499752/uncovering-the-cias...
  - yard2010 1y ago
    Comparing US intelligence to the other bad actor intelligence is wild - like comparing a paper cut to AIDS. For now, at least.
    - blitzar 1y ago
      The US intelligence apparatus is the GOAT of overthrowing foreign governments. They love it so much they even sometimes come back and overthrow the puppet regime they put in place a few years earlier (or just bomb the shit out of the civilians). If it isnt AIDS then it is certainly a Cancer.
m000 1y ago
I would first worry about Intel ME on my computer, and then about my router's firmware blob.
Sunspark 1y ago
I run OpenWRT on my TP-Link and have been happy with it. The radio sounds much like Intel's ME. I think we all know there's a problem, but we don't have the power to do anything about it because what alternative is there? Ancient hardware?
__jochen__ 1y ago
Do you trust the seller on AliExpress selling the OpenWRT One router? OpenWRT links directly to it (from https://openwrt.org/start https://openwrt.org/start): https://www.aliexpress.com/item/1005007795779282.html https://www.aliexpress.com/item/1005007795779282.html

chatmasta 1y ago

That's why I bought a PCEngines box (one of the last of their inventory before they went out of business) with completely transparent hardware and no Chinese manufacturer in the supply chain.

DANmode 1y ago
Neat. If it dies tomorrow, what’s next, out of curiosity?
- denkmoon 1y ago
  For anyone asking this question I might suggest Protectli. They've got x86 systems with coreboot. That's about as good as you can get these days for open source-ness without going really obscure or outdated. I've got a VP2440 as my router and firewall. You can neuter the intel management engine with coreboot, but there's still going to be firmware blobs somewhere in it, especially if you're trying to build a wifi ap. One of my 2 pcengines APUs has developed an issue with its solder joints I suspect. It hangs at the bootloader unless the unit is already warm. Can't complain at all, it lasted ages and problems like this are just life for things that thermally cycle, it was in a pretty extreme climate for most of its life. Doesn't help with me needing a replacement now pcengines is out of business though, hence getting a protectli box.
  - Retz4o4 1y ago
    Thank you! Been liking for replacements like this.
  - alias_neo 1y ago
    > I might suggest Protectli This is the route I went. After a decade plus of shite consumer routers and finally an EdgeRouter which died (along with Ubiquiti's quality) I bought a Protectli box, build and flashed Coreboot and run OPNSense. It's been going strong with regular updates (and by regular I mean as regular as your Linux workstation) for over half a decade now. It wasn't cheap, somewhere in the region of £700 after adding SSD and RAM but it's a way, way overkill model and never exceeds 10% RAM usage and 15% CPU with an IDS running and a bunch of VLANs and Gigabit symmetric WAN. My original goal for overspeccing it was longevity, but I regret it now, I want to upgrade to 10G+ networking and I can't justify replacing it when it runs so well and wasn't cheap.

toast0 1y ago

Sure, but if you run OpenWRT you can pick the radio firmware image. And you can trust Qualcomm cause they're from San Diego and made Eudora; their firmware won't have intentional security issues.

wiredpancake 1y ago
[dead]
deletedie 1y ago
And yet American products are the only ones we've ever had hard evidence on wrt intentional security issues in collaboration with US Intelligence.
- knappe 1y ago
  Source for this claim?
  - overfeed 1y ago
    snowden-cisco-nsa-tao-interdiction.jpg
- fulafel 1y ago
  Sometimes it's Swiss companies run by the CIA: https://www.npr.org/2020/03/05/812499752/uncovering-the-cias-audacious-operation-that-gave-them-access-to-state-secrets https://www.npr.org/2020/03/05/812499752/uncovering-the-cias...
- yard2010 1y ago
  Comparing US intelligence to the other bad actor intelligence is wild - like comparing a paper cut to AIDS. For now, at least.
  - blitzar 1y ago
    The US intelligence apparatus is the GOAT of overthrowing foreign governments. They love it so much they even sometimes come back and overthrow the puppet regime they put in place a few years earlier (or just bomb the shit out of the civilians). If it isnt AIDS then it is certainly a Cancer.

m000 1y ago

I would first worry about Intel ME on my computer, and then about my router's firmware blob.

Sunspark 1y ago

I run OpenWRT on my TP-Link and have been happy with it. The radio sounds much like Intel's ME. I think we all know there's a problem, but we don't have the power to do anything about it because what alternative is there? Ancient hardware?

__jochen__ 1y ago

Do you trust the seller on AliExpress selling the OpenWRT One router? OpenWRT links directly to it (from https://openwrt.org/start https://openwrt.org/start): https://www.aliexpress.com/item/1005007795779282.html https://www.aliexpress.com/item/1005007795779282.html