5 ms·

That was true when the term firmware was first coined, but I'm not convinced it's still true. The "firmware" of a WiFi router is effectively a full Linux system

by moyix 12y ago

That was true when the term firmware was first coined, but I'm not convinced it's still true. The "firmware" of a WiFi router is effectively a full Linux system, and it needs to be updated as often. The case is less strong for things like hard drives, but even there, I think we see growing firmware complexity and a corresponding increase in buggy code (I suspect this is is caused by both economic incentives and the mere fact that lines of code are proportional to number of bugs). My Crucial M4 SSD was recently affected by an integer overflow bug [1] that caused the firmware to hang when it got to ~5000 hours of use, and these sorts of firmware glitches are not uncommon. In any case, I think the question of whether it needs to be a physical switch or cryptographic signing is one that should probably be addressed on a case by case basis: internet connected devices really should have a way to update firmware without physical intervention, but on other devices it's probably not so critical. [1] http://forum.crucial.com/t5/Crucial-SSDs/BSOD-Crucial-M4/td-p/79098 http://forum.crucial.com/t5/Crucial-SSDs/BSOD-Crucial-M4/td-...

marssaxman 12y ago
Sounds like that WiFi router is trying to do too much and should be re-engineered so its firmware no longer needs to be updated as a matter of course.
- moyix 12y ago
  WiFi routers kind of inherently need to do a lot: 1. Drivers for wifi & ethernet ports, and other hardware needed for the device. 2. TCP stack and routing mechanisms for forwarding packets between the two. 3. Access control for wifi portion, which (depending on how much flexibility is needed) may involve keeping track of individual user accounts and permissions. 4. Some way to administer this complexity. Currently the only thing that seems to fly with users is a web administration interface. 5. All the "usual" OS stuff to manage this: process scheduler, filesystem layer, memory management, etc. Sure, you could design a special purpose OS that's simpler than Linux, but the development effort required would be much higher, and it's not clear to me that you'd end up with something much more bug-free.
- na85 12y ago
  Couldn't agree more. All these are symptoms of lazy designers/managers essentially saying "fuck it, just throw a micro in there and do it in software". A router doesn't need to be a full-stack linux system waiting to get pwned. A memory stick doesn't need to have a full computer embedded in there waiting to be exploited by BadUSB.

by moyix 12y ago

marssaxman 12y ago

Sounds like that WiFi router is trying to do too much and should be re-engineered so its firmware no longer needs to be updated as a matter of course.

moyix 12y ago
WiFi routers kind of inherently need to do a lot: 1. Drivers for wifi & ethernet ports, and other hardware needed for the device. 2. TCP stack and routing mechanisms for forwarding packets between the two. 3. Access control for wifi portion, which (depending on how much flexibility is needed) may involve keeping track of individual user accounts and permissions. 4. Some way to administer this complexity. Currently the only thing that seems to fly with users is a web administration interface. 5. All the "usual" OS stuff to manage this: process scheduler, filesystem layer, memory management, etc. Sure, you could design a special purpose OS that's simpler than Linux, but the development effort required would be much higher, and it's not clear to me that you'd end up with something much more bug-free.
na85 12y ago
Couldn't agree more. All these are symptoms of lazy designers/managers essentially saying "fuck it, just throw a micro in there and do it in software". A router doesn't need to be a full-stack linux system waiting to get pwned. A memory stick doesn't need to have a full computer embedded in there waiting to be exploited by BadUSB.