Hacker News Reader

Comment by pkaye | Hacker News Reader

I've been researching a new Wi-Fi router and heard lots of complaints that TP-Link doesn't provide many firmware updates? Is that not true? ASUS is not that much better but I do have an option of using the AsusWRT-Merlin open source alternative on their router.

Another thing I've noticed is companies tend to still sell their models which are close to EOL on their website. Something needs to be done about that.

View on HN

It's absolutely true, I have a graveyard of fairly high-end consumer routers that were thrown in the pile as soon as they stopped getting updates, they range from Asus, TP-Link to Belkin.

I switched to Ubiquiti EdgeRouters for a while but they went the way of the dodo too, so now I use a Protectcli box running Coreboot and OPNSense; it's essentially just a PC with nice Intel NICs that play nice for networking in a small fanless form-factor that you can install a routerOS on (pfSense, OPNSense etc) and always be up to date.

Curious. A layman here.

I own one dlink router I bought in 2014. Has been running since then. 0 updates.

What "update" should I give my router ?

Forgive my ignorance

The manufacturers should release "firmware" updates; they update the software in the router and fix vulnerabilities or add features.

Your D-Link router from 2014 likely stopped receiving updates within 2-4 years of its manufacture so updating now will still leave you quite outdated, if the manufacturer released any updates at all (and if they did, they may even have pulled them offline as we're now 10 years after the fact).

If you're concerned about the security, you can check if your router is supported by an open-source OS like OpenWRT and flash that over the factory software, or upgrade to a newer model (bearing in mind another consumer router will only get you a few short more years of updates).

If you're really cautious (like I am) you buy something that you can install a router OS on that you know will always be updated; pfSense, OPNSense, OpenWRT, Vy etc.

There are always new security vulnerabilities found on these network devices and they directly face the internet. Most of these companies tend to EOL them after a few years and often continue to sell that close to or after the EOL date.

This link is from a quick query on dlink routers.

https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabili...

Your router is a computer much like any other in your dwelling. It's probably running GNU/Linux.

Just like any other computer, it can be exploited if vulnerabilities are found and in 10 years it's likely some have been found.

Unfortunately, it's likely that dlink stopped providing updates for your product which leaves you with three options:

1. Ignore the problem

2. Install something like OpenWRT if your hardware is supported

3. Purchase new hardware

That's true, TP-Link isn't great about keeping their consumer product firmware secured or updated. ASUS isn't much better but when it comes to network gear, you kind of do get what you pay for.

Selling models close to EOL or trying to hold hardware makers responsible for firmware security has been an issue for decades.

Are there manufacturers that are consumer focused that are good about security and updates? Some of the ASUS models are not particularly cheap, raising the question of why not go with business oriented models.

> That's true, TP-Link isn't great about keeping their consumer product firmware secured or updated. ASUS isn't much better but when it comes to network gear, you kind of do get what you pay for.

If this is actually the case then you should contact the FTC because Asus under an order to pay attention to security:

* https://www.ftc.gov/news-events/news/press-releases/2016/07/...

I have an Asus RT-AC68U that I bought ages ago that's still getting regular first-party firmware updates (plus the ones from Merlin). Currently using ISP-provided hardware, but given my past experience I'd definitely look at Asus as an option if I needed a new router.

I have an Asus RT-AC1200, released in 2019 that hasn't had a firmware update since 2021/05 which is the reason why I bought the TP-Link. I do see Asus has a Nov 2024 firmware for that RT-AC68U on their site.

As far as my TP-Link router, I think I remember it being stuck on a 2022/09 firmware until at least 2023/09, and I wound up flashing it with OpenWRT earlier this year.

The AC1200 series was originally released in 2015:

* https://wikidevi.wi-cat.ru/ASUS_RT-AC1200_series

The V2 seems to be exactly the same except for some minor chip revisions (e.g., -DAN vs -AN), perhaps due to OEM part availability.

OpenWRT also supports (supported?) the V2:

* https://openwrt.org/toh/asus/rt-ac1200_v2

The RT-AC68U was released in 2013, but I realized that the AC1200 is the consumer tier below the AC68 and related series, so that explains the closer importance on better hardware, easier updating of firmware and development.

I think it was argued that the reason TP-Link was singled out is because of their pattern of vulnerabilities across their entire product lines going back perhaps a decade(?). The same could probably be said of other brands as well though, if not, more.

* https://youtu.be/ZCdZaSu68Kk?si=C7qumnao_bfvGvUo&t=138

* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=tp-link

What is a good brand today? TP Link is abysmal and my NetGear Orbi is feature light without their subscription. Even then, their app is very buggy.

Google and Amazon are full of spyware. I feel I have nowhere to run!

It depends on your use, but generally anything that runs OpenWRT should be good. Fairly inexpensive GL.iNet GL-MT6000(Flint 2) seems pretty good for a decent price. Comes with a Chinese fork of OpenWRT but you should be able to easily flash upstream.

Another option is the recently released official OpenWRT One.

https://openwrt.org/toh/openwrt/one

Mikrotik maybe? I don't know if they're any good but they have a statement on the bottom of the page indicating software updates to either end of product life or minimum of 5 years after purchase date.

I'm happy with my Mikrotik, but do expect to be reading their wiki/googling a fair bit while setting it up. It does come with quick set defaults to get a basic secure config up n running.

I do like that I can export my config as a script. Haven't had to reboot it yet, excluding firmware updates of course.

I can't upgrade my Mikrotik because new firmware breaks wifi. Known issue, ignored. So updates are not always useful.

Can you link to this known issue?

https://forum.mikrotik.com/viewtopic.php?t=208199

Old version works fine.

Reply on news.ycombinator.com