Hacker News Reader

Hacker News

Comment by h2odragon | Hacker News Reader

Full thread

h2odragon

fix them with: https://openwrt.org/

View on HN

Of the affected models for CVE-2024-3080 and CVE-2024-3079, OpenWRT supports only the RT-AC68U.

None of the models affected by CVE-2024-3912 are supported by OpenWRT.

Funnily, router vulnerabilities are what open the way to install OpenWRT.

Is there a reason that router manufacturers don't just ship some kind of open source software like this? Power users will prefer something like openwrt, and non power users won't care either way.

It seems like going closed/bespoke accomplishes absolutely nothing except opening the company up to these kinds of problems.

GL-inet does exactly that.

Except depending on model, you get to choose between being stuck on an ancient version with unpatched security vulnerabilities, or having not-properly-working drivers. I own 4 different models from them and currently don't use any of them due to inability to get builds stable or even working. I have poured through their patches and have very low confidence in security of their official firmware. There's some patches that would need backporting for hardware compat with upstream.

I would happily sponsor and help out with dev and infra for whomever sets out for a community upstream OpenWRT build for Glinet E750, FWIW.

  - adding special (useless) features to make their product stand out
  - private code means competitors can't read it and gain your "hard earned" knowledge
  - "trade secrets"
  - newer super fancy wireless tricks are presumably patented and require proprietary libraries / subscription fees etc

> Power users will prefer

Power users are the extremely small market.

Most people don't care, it should just work and OpenWRT doesn't have a (built-in) webui at all by default.[0]

If want to see a proper router webui for a prosumer router - look at ZyXel Keenetic, but take a note what they are honing it for more than a decade.

[0] at least as I understand it, didn't touch it for the deacde

They have a default web ui at least for the last 8 years.

Upgrading with non custom builds is a pain point as is removes the installed packages, which can lead to issues such as your remote router suddenly having no vpn connection.

That being said, I now prefer openwrt compatible routers as debugging and customization is soooo much easier.

> They have a default web ui at least for the last 8 years.

That's why I added that caveat - I didn't toouch it in a long time nor the quick suface search helped me

> That being said, I now prefer openwrt compatible routers

Well, if I would be in a market for a new one I would, of course, prefer one with such support, but I'm definetly in, at least, a prosumer market.

From Wikipedia:

>OpenWrt can be configured through either a command-line interface or a web interface called LuCI

It's been a long time since I used it myself, but I recall it having a web interface, and I didn't have to do anything special in the command line to set it up, it just had it.

From what I recall, it wasn't that different from the software that my router had before hand, other than that it had more features.

The quick start docs seem to support this:

https://openwrt.org/docs/guide-quick-start/walkthrough_login

Quite a few router OEMs do this these days. Its often a bespoke fork of openwrt so they can add their own features (OTA upgrades, web ui customization, etc), but still openwrt under the hood.

Reply on news.ycombinator.com