Hacker News Reader

Comment by heavyset_go | Hacker News Reader

You aren't thinking low enough for firmware.

All modern WiFi APs require closed firmware blobs that run below or parallel to OpenWRT.

You replacing the router OS with OpenWRT does nothing when the radio has full DMA access and runs its own OS on its own processor. The OpenWRT layer will have no idea what it's running/infiltrating/exfiltrating.

I say this as someone who has been running and building OpenWRT forever. It's great but it isn't a panacea.

View on HN

That's why I bought a PCEngines box (one of the last of their inventory before they went out of business) with completely transparent hardware and no Chinese manufacturer in the supply chain.

Neat.

If it dies tomorrow, what’s next, out of curiosity?

For anyone asking this question I might suggest Protectli. They've got x86 systems with coreboot. That's about as good as you can get these days for open source-ness without going really obscure or outdated. I've got a VP2440 as my router and firewall. You can neuter the intel management engine with coreboot, but there's still going to be firmware blobs somewhere in it, especially if you're trying to build a wifi ap.

One of my 2 pcengines APUs has developed an issue with its solder joints I suspect. It hangs at the bootloader unless the unit is already warm. Can't complain at all, it lasted ages and problems like this are just life for things that thermally cycle, it was in a pretty extreme climate for most of its life. Doesn't help with me needing a replacement now pcengines is out of business though, hence getting a protectli box.

Thank you! Been liking for replacements like this.

> I might suggest Protectli

This is the route I went. After a decade plus of shite consumer routers and finally an EdgeRouter which died (along with Ubiquiti's quality) I bought a Protectli box, build and flashed Coreboot and run OPNSense.

It's been going strong with regular updates (and by regular I mean as regular as your Linux workstation) for over half a decade now.

It wasn't cheap, somewhere in the region of £700 after adding SSD and RAM but it's a way, way overkill model and never exceeds 10% RAM usage and 15% CPU with an IDS running and a bunch of VLANs and Gigabit symmetric WAN.

My original goal for overspeccing it was longevity, but I regret it now, I want to upgrade to 10G+ networking and I can't justify replacing it when it runs so well and wasn't cheap.

Sure, but if you run OpenWRT you can pick the radio firmware image. And you can trust Qualcomm cause they're from San Diego and made Eudora; their firmware won't have intentional security issues.

And yet American products are the only ones we've ever had hard evidence on wrt intentional security issues in collaboration with US Intelligence.

Source for this claim?

snowden-cisco-nsa-tao-interdiction.jpg

Sometimes it's Swiss companies run by the CIA: https://www.npr.org/2020/03/05/812499752/uncovering-the-cias...

Comparing US intelligence to the other bad actor intelligence is wild - like comparing a paper cut to AIDS.

For now, at least.

The US intelligence apparatus is the GOAT of overthrowing foreign governments. They love it so much they even sometimes come back and overthrow the puppet regime they put in place a few years earlier (or just bomb the shit out of the civilians).

If it isnt AIDS then it is certainly a Cancer.

I run OpenWRT on my TP-Link and have been happy with it.

The radio sounds much like Intel's ME.

I think we all know there's a problem, but we don't have the power to do anything about it because what alternative is there? Ancient hardware?

Do you trust the seller on AliExpress selling the OpenWRT One router? OpenWRT links directly to it (from https://openwrt.org/start): https://www.aliexpress.com/item/1005007795779282.html

I would first worry about Intel ME on my computer, and then about my router's firmware blob.

Reply on news.ycombinator.com