Re:OpenWRT turns 20; wants to launch their "first upstream s...
by zekica on Wednesday January 10, 2024 @05:22AM
(#38938564)
> so they're far from the only group guilty of benefitting from openwrt without contributing
This is certainly true. SoC vendors often base their SDK on a fixed version of OpenWrt and then add proprietary patches on top. Then sell the SoC + SDK to a device vendor that adds additional proprietary patches and sells the device.
The issue with this is that the only way to fix security issues is to back-port them to the exact kernel version the SoC used as a base, and after a year or two, they completely drop support and you're left with a device that has known security vulnerabilities you can do nothing about.
How many old routers are still in use that are used as part of a botnet?
This is certainly true. SoC vendors often base their SDK on a fixed version of OpenWrt and then add proprietary patches on top. Then sell the SoC + SDK to a device vendor that adds additional proprietary patches and sells the device.
The issue with this is that the only way to fix security issues is to back-port them to the exact kernel version the SoC used as a base, and after a year or two, they completely drop support and you're left with a device that has known security vulnerabilities you can do nothing about.
How many old routers are still in use that are used as part of a botnet?