Hacker News Reader

Comment by wtallis | Hacker News Reader

> The majority of differences between routers is just firmware and packaging, the guts are all the same.

The firmware is the part you really have to worry about, though. But the proper solution is to simply never run the vendor's firmware on a consumer grade router, because none of them are any good at assembling and securing a Linux distribution.

View on HN

  > > The majority of differences between routers is just firmware and packaging, the guts are all the same.
  > 
  > The firmware is the part you really have to worry about, though

Professional quality routers often use ASICs to handle most of the processing, which is quite a bit faster, engineered to perform at specific workloads, and is more reliable. [1] Big iron gear are often specialized versions of blade servers. [2] And tons of software controls go into the CPU and software design to protect against firmware hacks, reverse-engineering, data exfiltration, counterfeit parts, insecure connections, license tampering, and hardening against internal compromise. [3] Aside from the CPUs and other guts inside the router, newer Cisco gear supports network adapters from Broadcom, Intel and QLogic.

[1] https://blogs.cisco.com/wireless/not-all-802-11ac-aps-are-cr... [2] https://www.cisco.com/c/en/us/products/servers-unified-compu... [3] https://www.design-reuse.com/articles/20671/security-embedde...

You can see an open source version of "big iron" networking gear, both hardware [1] and software [2]. They also use ASICs for most of the work and run Linux on the host CPU (so they can be managed like normal servers).

[1] https://code.facebook.com/posts/843620439027582/facebook-ope... [2] https://github.com/facebook/fboss

> Our Wedge top-of-rack switch follows this basic design and uses a single Broadcom Trident II ASIC

The chassis may be open-source but the guts of that thing is a (high-end Broadcom chip, just like everyone else.

I don't think Belkin/Linksys operates in those market segments. It doesn't appear that they have any rackmount routers at the moment, just a tiny VPN router and some rackmount Ethernet switches. The rest is WiFi routers that are unlikely to have any significant hardware acceleration beyond a built-in Ethernet switch with basic NAT capability. There's not much separation between data plane and control plane in those products.

Just check if they are compatible with dd-wrt or openwrt and flash it with opensource build.

Much easier than flashing cell phone and the open source version normally has more features also.

It's such a shame that when using OpenWRT everything runs as root...

OpenWRT is still trying to support devices with 8MB of storage, so they can't go overboard and start incorporating Docker or anything like that. But some services do run as separate users: on my routers, dnsmasq and avahi aren't running as root. What other services would you like to see isolated?

I didn't know that. Sounds like they are moving in the right direction. One important component that should not run as root is the web server.

Generally speaking, I agree that a web server shouldn't be running as root. But when the sole purpose of that web server is to provide root-level control over the system, is there really much security to be gained by running that process as a different user? That "unprivileged" process is still going to have some mechanism for causing arbitrary commands to run as root.

I can imagine that you might have an unprivileged server presenting just the log-in page, then proxying to a privileged server that is started once the administrator is authenticated. But that doesn't get you much more security, and it probably does strain the resources of low-end routers. A small, auditable server may be better than a more complicated system, especially since it is trivial for more paranoid users to disable/uninstall the web server and just use SSH (which nobody seems to mind running as root).

Reply on news.ycombinator.com