Security isn't something you tack on after the fact, or build on with a few thousand more lines of code. Security is a mindset, and it's a design — it's something you build in from the foundation. Heightened security is actually the entire reason why this author built his own personal bare Linux router.
Proprietary router firmware often goes months or years between upgrades — and when it does upgrade, it's more frequently to add some shiny to the UI—more than likely introducing more bugs — than to fix security problems. Open source firmware isn't really in much better territory. DD-WRT is one of the most popular, and while it has a new (and incredibly bug-ridden) beta release every few weeks, the project hasn't had a stable release in eight years. Eight years! pfSense is pretty much the darling of the industry, and rightly so — but it's still a big, complex pile of moving parts with web interface and pretty graphs and bits and bobs to toggle and you're never going to truly know everything that it's doing — you click the boxes in the web UI and you assume it's doing what you told it to, which is already pretty far abstracted from the reality of the underlying configs. It also goes months (or longer) between firmware updates being made available, with (again) no real guarantee that an update won't change major parts of the UI and the capabilities, not just fix bugs.
A homebrew router (or company own built) is going to be barebones, but they will know every moving part, and it will get regular patches and updates. Maybe the typical home user is not going to want to do this but what if your company is serious about performance and security? Maybe designing this as a standard and rolling it out to a few routers in use is going to make a big difference. For a start your company won't be using a typical standard vendor X router with known vulnerabilities - you become an "unknown".
See opensource.com/life/16/6/why-i…
#security #router #homebrew
from Beiträge von Danie van der Merwe https://ift.tt/2TPy6GR
via IFTTT
Proprietary router firmware often goes months or years between upgrades — and when it does upgrade, it's more frequently to add some shiny to the UI—more than likely introducing more bugs — than to fix security problems. Open source firmware isn't really in much better territory. DD-WRT is one of the most popular, and while it has a new (and incredibly bug-ridden) beta release every few weeks, the project hasn't had a stable release in eight years. Eight years! pfSense is pretty much the darling of the industry, and rightly so — but it's still a big, complex pile of moving parts with web interface and pretty graphs and bits and bobs to toggle and you're never going to truly know everything that it's doing — you click the boxes in the web UI and you assume it's doing what you told it to, which is already pretty far abstracted from the reality of the underlying configs. It also goes months (or longer) between firmware updates being made available, with (again) no real guarantee that an update won't change major parts of the UI and the capabilities, not just fix bugs.
A homebrew router (or company own built) is going to be barebones, but they will know every moving part, and it will get regular patches and updates. Maybe the typical home user is not going to want to do this but what if your company is serious about performance and security? Maybe designing this as a standard and rolling it out to a few routers in use is going to make a big difference. For a start your company won't be using a typical standard vendor X router with known vulnerabilities - you become an "unknown".
See opensource.com/life/16/6/why-i…
#security #router #homebrew
from Beiträge von Danie van der Merwe https://ift.tt/2TPy6GR
via IFTTT
Comments