mushufasa
Joined 8 years ago
Joined 8 years ago
Honestly it really shouldn't matter if most attackers can't find the exploit; it only takes one bad actor to wreak havoc. And I have seen already several sec YouTubers post live exploit walkthroughs so....
FWIW Asus is Taiwanese, so they have a unique national security incentive to sell clean routers; too small a country to have offensive national security like the NSA/China, yet a big target where defense against both of those is important.
1. they automatically enrolled me in a 'support' subscription I didn't want and I didn't realize until it renewed once, then I cancelled. it's apparently not easy selling flashed routers.
I don't begrudge them for this, though: I'm guessing they actually do have a lot of users contact support, and this business practice was a rock and a hard place situation: you don't want users to fail to install the device nor to have a bad experience because you can't afford a skilled support team. I'm not sure if they have since changed their policies.
2. I learned that, all along, ASUS has built their routers on a company-maintained downstream flavor of WRT.
So I just bought an ASUS router and haven't looked back. When I first set it up I was able to go into the admin ui and configure it similarly to how I had configured DD-WRT.
While I'm sure he doesn't catch all corruption and the CCP overall has selective enforcement, the reason they do have measures like this is in large part because of Xi Jinping's specific reputation and positioning.
I looked for this in the past. This is the main reason we bothered with mailchimp/hubspot -- simply the ability for nontechnical marketing people to put together nice emails, and the trust that we won't need an engineer to troubleshoot email formatting on their behalf. I remember trying some OSS tools at the time (8 years ago?) and there were some templates we used but then when we wanted to modify them, the broken-ness of email html/css standards made it really hard to test.
I know the standards and practice around this are a moving target, though, so I hope you can find a model to sustain and expand this, without charging for delivery/contact list numbers like MailChimp or other incumbents.
ALL of that goes through cpanel, for every shared hosting provider I can ever remember using. Even if the stuff happening on those servers didn't use perl, cpanel itself -- the admin of everything provided for that domain by the hosting provider -- it's a huge surface area.