The EFF's open wireless router project

Support for secure upgrade of the entire firmware image is in the current EFF router software release. This security is against a threat model that will be described in the threat model document on the OpenWireless github repo (TODO).

The need to upgrade the entire image is a problem for people who customize the router by installing their own pkgs. Since we use the sysupgrade utility built into OpenWRT, such users will need to re-install their packages manually. So even if we wanted to just upgrade the linux kernel we would have to make available a full new image. Similar comment applies to upgrading a specific pkg currently if it is to be done by the EFF through the current automated update mechanism. Users are of course free to manually upgrade specific pkgs themselves with "opkg upgrade pkg1 pkg2 ...".

We would like to move to a system where kernel or individual packages are automatically upgraded. We don't currently have a design for this and will review the current activity in OpenWRT mentioned by Dave above and try to arrive at a solution down the road. Resolving this problem is not a high priority item for us currently.

More concerning is the possibility of routers getting "bricked" during an upgrade. We will be adding the ability to gather "bricking rate" to see whether the current upgrade mechanism is something we can live with. Ideally we would be able to have two copies of the image, with one being live and would only upgrade the backup copy. Then if an upgrade fails we would always be able to boot up into the functioning copy etc. Given the flash of 16MB on the Netgear 3800 we can't implement this yet. In a more modern platform we expect this will be possible.

Dave describes the relationship between the EFF router software release and CeroWRT well. We are focused on innovating in the security of SOHO routers and in making the sharing of the WiFi with guests worry free and easier, and in protecting the privacy of guests themselves. We look to CeroWRT to continue its innovation in the networking and queuing realms and to continue to improve performance and internet experience. Such a division of labor, we hope will result in a healthy exchange of code and ideas between the two projects.