zlacker

>>ementa+(OP)
A lot of the complaints here don't make a lot of sense and read like the author has never used an embedded linux device. The previously reported bugs are more substantial - hardcoded secrets for JWT access and firmware encryption, everything running as root, etc.

However, "Chinese product uses Chinese DNS servers and it's hard to change them" or "no systemd nor apt installed" are totally expected and hardly make it "riddled with security flaws". Same with tcpdump and aircrack being installed - these hardly compromise the security more than having everything run as root.

I would expect most users of this device will not be exposing the web interface externally, and the fact that they ship with Tailscale installed is actually impressive. I can't imagine the lack of CSRF protection will be a vulnerability for 99% of users.

I am curious what the "weird" version of wireguard the author refers to but based on their apparent lack of knowledge on embedded systems in general I would not be shocked to find that it's totally innocuous.

>>ghostp+Tq
I think you haven't gone far enough. Most of this thread is rampant ignorance and propaganda influenced bandwagoning.

1) It's from a company known for dev boards and SoCs- not consumer products.

2) The code is available on GitHub (nice!)

3) SiSpeed actively contributes to the mainline linux kernel for RISC-V in general as well as their SoCs.

4) Security in Embedded Applications is just... Bad. Amercian, Chinese, European, Russian, Indian- it doesn't matter.