Hacker News Reader

Comment by kubov | Hacker News Reader

Think of all OpenWrt/dd-wrt devices - and possibly countless router-boxes around the world that use some proprietary firmware along with dnsmasq.

Just verified that my home OpenWrt WDR4300 is affected.

View on HN

OpenWrt 15.05.1 "Chaos Calmer" was released more than a year ago. I haven't seen many updates. I wonder if there's an update channel that I'm missing.

Specifically, here is where all updates are coming from: https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/ge...

No updates since March 2016.

EDIT: Has development has moved to the LEDE project? I don't understand what's happening in the OpenWRT/LEDE split. There appears to be a fairly clean upgrade path, though: https://forum.lede-project.org/t/upgrade-from-openwrt-to-led...

Yes, you probably want Lede, not OpenWRT or dd-wrt. I used lede to flash some old routers last year, and on the whole the experience was similar to my last interaction with OpenWRT only better (more evolved).

https://lede-project.org/start

I would like to add that you can usually in place upgrade from OpenWRT to LEDE. Though making a config backup and a backup of the list of additional packages you installed is highly recommended. Beside of that just flash and reinstall all additional packages.

Upgrading to LEDE worked flawlessly. Thanks guys!

Might be interesting for some of you, Hauke from LEDE posted a few insides over at LWN: https://lwn.net/Articles/735316/ https://lwn.net/Articles/735317/

tl;dr updated packages of dnsmasq are currently building and should be available soon

Similar to the OpenOffice/LibreOffice and ownCloud/NextCloud split it seems.

Although LEDE and OpenWRT expressed interest to re-merge.

Also the devs of ddwrt do not take security seriously. Requests to include sane defaults for cipher list, dropbear etc. have been met by derision and an outright refusal to do anything about it.

For example, the Kong variant updates for http and checksum despite repeated requests to deliver over https. I’ve got quite a few other examples but sadly on mobile right now.

OpenWRT is dead. Long Live LEDE.... until they fork LEDE back into the OpenWRT codebase..

Edgerouter Lite also uses dnsmasq.

How can we verify that?

Using the PoCs that Google provided?

I simply checked the version of dnsmasq running on my router, it's 2.71 so according to the article the build is affected.

I'll try to launch one of the POC later in the day, but for now I assume worst case.

Reply on news.ycombinator.com