[gentoo-user] Re: Foss hardened router?

[James]

lee <lee <at> yagibdah.de> writes:


> https://www.ubnt.com/edgemax/edgerouter-lite/
>
> It lacks good documentation; otherwise it's a great product.

Huh?  I have one. It SUCKS. It arrived Borked right out of the box. Could
not use menus. It would not update the firmware (many attempts) and the
Vendor refused to RMA the box when it was new and had problems. I've setup
thousands of routers over a lifetime, from dozens of vendors. Never seen
shitty_er documentation in my life. Poor quality control on the low end
products The entire Vyatta code tree, that they use is a mystery, Poor user
documentation and they point you (their tech support) to open forums
and a variety of un-maintained vyatta documentation. Furthermore,
they have deviated from the vyatta tree and refuse to even qualify
how they have deviated. I'm not so sure any robust penetration
testing has occured on their products. Here's one 'gaping hole'::




"Ubiquiti Networks tried to do a good thing and bring Internet connection to
Third World regions this year. Unfortunately, it's just been discovered that
their routers are being actively exploited by hackers to field massive DDoS
attacks, due to an overlooked exploit." 

Google, there are tons of problems with ubnt


no thanks on ERL3. Besides, some gentoo devs, after months of work,
discovered that some of the hardware is unacessible, once your
install embedded linux and the processors is way under-powered, and thus
susceptible to a wide variety of DDoS attacks.


> It's surprising that there are so few routers to choose from, even when
> you don't limit your selection to FOSS.

> On a side note, never buy Cisco, not even used: They won't let you
> download or otherwise obtain a replacement for the damaged firmware
> image (not to mention an update) that came which the device, unless you
> have a support contract with them.  Without the firmware, the device is,
> of course, useless.

Cisco sucks for the small companies, as you have articulated. For large
projects @companies with deep pockets, Cisco cuts prices below 60%, will
write your configs, or tell you ha\ow to replace IOS with carrier grade
linux from a variety of sources. 2 faces of Cisco. Money talks and bulls---
walks as the cisco internal slogan goes.....

> No other, not even a cheap manufacturer like TP-Link --- who also makes
> great products and has a responsive support --- doesn't give you any
> issues like that while Cisco simply does not stand behind their
> products and lets their customers down.

Cisco does not write most of their code anymore. Silicon vendors write
much of the code, in a thousand different methodologies based on the
personal prefferences of the overworked engineer that wrote the code.
It the good-old-days of cisco (when they have legions of excellent coders
they re-wrote most all vendor code to internal cisco standards; but that
mantra has vanished, and most of their older-excellent asm/C coders are 
long gone..... Yep cisco is a well-spring of buggy/shitty codes written
mostly by hardware EEs. Dont believe me? Find a disgruntled cisco
coder and get them drunk at the Bar (and promise them a better job).


Yes there is an opportunity here for gentoo-hardened images, including
stage-4 for a default router setup and the user can just add a few
packages. It's a dam shame, the state of router affairs. I have quite a few
personal friends that code. Offense is where the money is....
Defense sucks in the coding world, and the attrophy is getting worse.
Kids learn on defense and switch to offense, to make the big bucks.
YMMV.

James