OpenWrt Security Advisories | Hacker News Reader

OpenWrt Security Advisories

openwrt.org

40 pointsfulafel14 comments

What's the significance of this? The most recent advisory listed is almost a year old.

OpenWrt is generally the best option for keeping old hardware fresh, but it would be really nice to have a Debian-like automatic update mechanism.

I often delay updating my router because it takes ~20 minutes of work to reinstall packages, manually merge config files, and make SSH stop complaining about the host key.

There is an incentive to use as few features as possible, because every divergence from the base config is a perpetual maintenance burden.

Great news - what you're wishing for mostly already exists[1]. The relatively new sysupgrade server and attended-sysupgrade clients automate the process of creating custom images matching already installed packages. After the breaking network config change a few years ago, it's now pretty safe to keep config files and ssh keys while flashing an upgrade image. The end result now is that I can seamlessly and painlessly update my OpenWRT boxes with just a few clicks or commands, despite loads of installed packages and config files. [1] https://sysupgrade.openwrt.org/

Thanks, I just used luci-app-attendedsysupgrade to upgrade from 23.05.0-rc2 to -rc3 with minimal pain. The only problem is that it lost my scripts in /root.

I hate to tap the "news" part of the domain, but what is new here? Is there a recent significant advisory (doesn't look like it)?

The page is currently not up-to-date. There have been a few advisories during 2023.

That's concerning. Do you have a link/source for that ?

https://openwrt.org/releases/23.05/notes-23.05.0-rc3

Thanks for the heads up OP

  https://openwrt.org/releases/22.03/notes-22.03.X

...where "X" is 0 to 5.

The OpenWrt team is highly active and responsive, all vulnerabilites are patched. Someone has just forgotten to update the wiki.

That still seems like a major issue, because I and probably quite a few other people rely on the security page to decide when to look into upgrading.

I hope there is some rationale for why the security fixes in later releases were not serious enough to warrant an advisory on the security page, rather than it just being an oversight.

> "... because I and probably quite a few other people rely on the security page to decide when to look into upgrading."

Then you should definitely take the task upon yourself in order to help everyone. A great chance to contribute. It's a wiki after all.

Are you giving them money?

It seems to be a mostly volunteer driven project.

Proprietary SoC vendors use an fork of a very old version of the software so they're not invested.

Why not try engaging and see if you can help them automate advisories based on their issue tracker / got activity?

Because your attitude comes off as entitlement.

Your attitude comes off as dismissive and condescending while gaslighting a perfectly valid criticism. Why not recognize that the commentor is providing feedback, even if not directly, and is delivering it in a forum context which we (HN visitors) actually read? The notion that every bit of feedback like this shoud be replaced with a FOSS contribution is profoundly entitled on your part.

The feedback is asking for a free service to be provided to them.

This isn't a project with massive corporate funding.

If the project isn't updating this page but they're actively making patch releases, what's the benefit?

There's this attitude when it comes to FOSS software where free users seem more entitled than paying users.

Isn't it significantly more entitled to ask volunteers provide a service?

Reply on news.ycombinator.com