31 Aug
2015
31 Aug
'15
10:35 a.m.
Hi!
For me it seems that lack of HTTPS support in OpenWrt is really
problematic. So all packages installation from official repositories go
over HTTP, if I am not mistaken. Does anyone know why this is not
something which bothers more people? :-)
Mitar
--
http://mitar.tnode.com/
https://twitter.com/mitar_m
31 Aug
31 Aug
10:38 a.m.
Hello!
I think that with Chaos Calmer they introduced package signing via
usign. But firmware images still need to be downloaded via HTTP if you
want to download them directly on the node without SCPing.
Jernej
On 31. 08. 2015 19:35, Mitar wrote:
Hi!
For me it seems that lack of HTTPS support in OpenWrt is really
problematic. So all packages installation from official repositories go
over HTTP, if I am not mistaken. Does anyone know why this is not
something which bothers more people? :-)
Mitar
11:17 a.m.
Our excellent colleague Deekoo once went through the buildroot process
horrified at the amount of arbitrary code that was pulled in over
insecure/unauthenticated channels and started building a proxy which would
at least allow for some auditing before incorporation into our firmware. We
have yet to incorporate that into our actual build process :)
I've been looking into buildbot.net a lot lately (it's what the openwrt
folks use) and would love to use it in our development process. In that
case, it would be trivial to copy the final product to an https secured
site for authenticated download.
It is a good question why openwrt is serving all of their firmware
downloads over http. It seems like most of these sorts of issues are just a
lack of developer hours/resources? I'd imagine that sudomesh would sign on
to a request (and maybe even pitch in some $$) if we thought it could get
that fixed....
On Mon, Aug 31, 2015 at 10:35 AM, Mitar <mitar(a)tnode.com> wrote:
Hi!
For me it seems that lack of HTTPS support in OpenWrt is really
problematic. So all packages installation from official repositories go
over HTTP, if I am not mistaken. Does anyone know why this is not
something which bothers more people? :-)
Mitar
--
http://mitar.tnode.com/
https://twitter.com/mitar_m
_______________________________________________
mesh-dev mailing list
mesh-dev(a)lists.sudoroom.org
https://sudoroom.org/lists/listinfo/mesh-dev
11:27 a.m.
Ah - Alex just pointed out to me that the downloads pages do support https,
but that they're just not set to default.
On Mon, Aug 31, 2015 at 11:17 AM, max b <maxb.personal(a)gmail.com> wrote:
Our excellent colleague Deekoo once went through the
buildroot process
horrified at the amount of arbitrary code that was pulled in over
insecure/unauthenticated channels and started building a proxy which would
at least allow for some auditing before incorporation into our firmware. We
have yet to incorporate that into our actual build process :)
I've been looking into buildbot.net a lot lately (it's what the openwrt
folks use) and would love to use it in our development process. In that
case, it would be trivial to copy the final product to an https secured
site for authenticated download.
It is a good question why openwrt is serving all of their firmware
downloads over http. It seems like most of these sorts of issues are just a
lack of developer hours/resources? I'd imagine that sudomesh would sign on
to a request (and maybe even pitch in some $$) if we thought it could get
that fixed....
On Mon, Aug 31, 2015 at 10:35 AM, Mitar <mitar(a)tnode.com> wrote:
Hi!
For me it seems that lack of HTTPS support in OpenWrt is really
problematic. So all packages installation from official repositories go
over HTTP, if I am not mistaken. Does anyone know why this is not
something which bothers more people? :-)
Mitar
--
http://mitar.tnode.com/
https://twitter.com/mitar_m
_______________________________________________
mesh-dev mailing list
mesh-dev(a)lists.sudoroom.org
https://sudoroom.org/lists/listinfo/mesh-dev
11:30 a.m.
Hello!
Yes, but the issue is downloading to routers via HTTPS as you need much
more flash to enable SSL on routers for wget/curl.
Jernej
On 31. 08. 2015 20:27, max b wrote:
Ah - Alex just pointed out to me that the downloads
pages do support https,
but that they're just not set to default.
On Mon, Aug 31, 2015 at 11:17 AM, max b <maxb.personal(a)gmail.com> wrote:
Our excellent colleague Deekoo once went through
the buildroot process
horrified at the amount of arbitrary code that was pulled in over
insecure/unauthenticated channels and started building a proxy which would
at least allow for some auditing before incorporation into our firmware. We
have yet to incorporate that into our actual build process :)
I've been looking into buildbot.net a lot lately (it's what the openwrt
folks use) and would love to use it in our development process. In that
case, it would be trivial to copy the final product to an https secured
site for authenticated download.
It is a good question why openwrt is serving all of their firmware
downloads over http. It seems like most of these sorts of issues are just a
lack of developer hours/resources? I'd imagine that sudomesh would sign on
to a request (and maybe even pitch in some $$) if we thought it could get
that fixed....
On Mon, Aug 31, 2015 at 10:35 AM, Mitar <mitar(a)tnode.com> wrote:
_______________________________________________
mesh-dev mailing list
mesh-dev(a)lists.sudoroom.org
https://sudoroom.org/lists/listinfo/mesh-dev
Hi!
For me it seems that lack of HTTPS support in OpenWrt is really
problematic. So all packages installation from official repositories go
over HTTP, if I am not mistaken. Does anyone know why this is not
something which bothers more people? :-)
Mitar
--
http://mitar.tnode.com/
https://twitter.com/mitar_m
_______________________________________________
mesh-dev mailing list
mesh-dev(a)lists.sudoroom.org
https://sudoroom.org/lists/listinfo/mesh-dev
3:33 p.m.
Hi!
In that case, it would be trivial to copy the final
product to an
https secured site for authenticated download.
But you cannot download an image to your running OpenWrt installation
over HTTPS. At least not with default packages. There is no small/thin
wget with HTTPS support. You can get I think curl with HTTPS, but it
adds quite a bit of dependencies.
Mitar
It is a good question why openwrt is serving all of their firmware
downloads over http. It seems like most of these sorts of issues are just a
lack of developer hours/resources? I'd imagine that sudomesh would sign on
to a request (and maybe even pitch in some $$) if we thought it could get
that fixed....
On Mon, Aug 31, 2015 at 10:35 AM, Mitar <mitar(a)tnode.com> wrote:
--
http://mitar.tnode.com/
https://twitter.com/mitar_m
Hi!
For me it seems that lack of HTTPS support in OpenWrt is really
problematic. So all packages installation from official repositories go
over HTTP, if I am not mistaken. Does anyone know why this is not
something which bothers more people? :-)
Mitar
--
http://mitar.tnode.com/
https://twitter.com/mitar_m
_______________________________________________
mesh-dev mailing list
mesh-dev(a)lists.sudoroom.org
https://sudoroom.org/lists/listinfo/mesh-dev
3168
days inactive
3168
days old
5 comments
3 participants
participants (3)
-
Jernej Kos -
max b -
Mitar