News for hackers. Stuff that matters.

A comment on OpenWrt 24.10.0 – First Stable Release. Parent comment

Re:OpenWrt 24.10.0 – First Stable Release by patrakov on Thursday February 06, 2025 @06:28AM (#42961354)
> OpenWRT is pretty great at offering features and security for consumer devices

That's a misconception. Nobody actually cares about security for packages that are not in the default install. For example, the initscript for sstp-client disables certificate validation unconditionally, see https://github.com/openwrt/packages/issues/25212

[ Parent | on HN ]
Re:OpenWrt 24.10.0 – First Stable Release by TheDong on Thursday February 06, 2025 @07:51AM (#42961847)
It at least offers more security than the usual alternative on a consumer router of the manufacturer's OS (i.e. something updated once a decade running linux 2.6 with GPL-violating unreleased patches so you can't update it yourself, all written in C by the contractor that bid the lowest).
[ Parent | on HN ]
Re:OpenWrt 24.10.0 – First Stable Release by FeistySkink on Thursday February 06, 2025 @08:31AM (#42962108)
If others think this is in jest, there are recent TP-Link routers with 2.6 kernel and Broadcom.
[ Parent | on HN ]
Re:OpenWrt 24.10.0 – First Stable Release by choobacker on Thursday February 06, 2025 @07:18AM (#42961657)
Good job on raising that issue. TIL SSTP.

> Nobody actually cares about security for packages that are not in the default install.

Probably an exaggeration, but it's clear there are some packages that are insecure out-the-box.

[ Parent | on HN ]