[Announcement] Changes of download sites

[RMerlin]

Hi everyone,

Following various Tweeter exchange this weekend (thanks everyone that contributed!), I wanted to let everyone know that I have made some changes regarding the distribution of Asuswrt-Merlin. The following changes are now in place:

1) Sourceforge is now the primary download site. I know some people were worried by the fact that Sourceforge has, in the past, inserted adware into software releases. This won't be a problem anymore, as Sourceforge changed owners last year, and the current president of Sourceforge even got involved in our recent Tweet exchanges about this to reassure everyone that they have no intention of going down that road.

2) Onedrive is now the new secondary download site / mirror. It will also host the various files that used to be on Mediafire, such as the Test Builds folder, miscellaneous files, etc... Once again, it will make releasing new firmwares much easier for me, as I can put it in a script. Just copying the files to my NAS, where the Onedrive applet will take care of uploading files in the appropriate folders.

3) Mediafire will be retired. Mediafire has been giving me a lot of trouble over the years, as their web interface would constantly error out when trying to upload or delete multiple files. I was able to work around most of their quirks using AirExplorer (very nice tool BTW), but another outage right as I was trying to upload a recent beta release finally convinced me it was time to move on. Add to that that over the years they have been reducing their service: they dropped their desktop sync application, and they also stopped providing advanced statistics, which was originally part of their Pro package. My Mediafire Pro account will not be renewed once it expires in December.

4) I have removed Softpedia from the list of official mirrors. Not that I have any problem with them (they basically handle everything themselves, I was merely linking to their site), just that they can be hard to navigate when someone is looking for a specific firmware. I also feel more comfortable referring people to mirrors which I actively control. If anyone was using them to download new releases, you should still be able to do so (as long they keep mirroring releases).


These changes will ensure better reliability, and will also greatly simplify my work when issuing new releases. Both Onedrive and Sourceforge will allow me to automate the process of uploading new firmwares through scripting, rather than making it a manual affair using two different programs. Onedrive is only slightly more expensive than Mediafire (and thanks to the generosity of a Microsoft employee, will actually end up costing less than Mediafire for the first year).


As usual, I advise people always use the following URL when referring anyone to the download sites:

https://asuswrt.lostrealm.ca/download

The following aliases have also been added, for convenience (especially in the Test Builds case):

https://asuswrt.lostrealm.ca/test-builds - points you to the Test Builds folder
https://asuswrt.lostrealm.ca/onedrive - points you to the Asuswrt-Merlin folder (firmware releases are in the Releases folder).

 

[MacG32]

I use Sourceforge for downloading because they have RSS feeds for every folder. I'm subscribed and notified in Thunderbird of any new release very quickly. @RMerlin Thank you for keeping Sourceforge.

 

[RMerlin]

Interesting story about Sourceforge: while discussing with their president on Twitter, I mentioned that my main issue with the website was how it automatically generated a "Download Latest Version" button that would end up pointing to whichever was the last firmware model I uploaded, confusing some users. He said he'd have a feature request added to their new website redesign to make it configurable.

Next day, he sends me a message indicating that he might be able to have the Download button on my project page point to the full file list instead as a temporary solution. I found that a good alternative and gave him the green light. Not long after, the change was made to my SF.net project page.

That's impressive support right there, especially since Asuswrt-Merlin ain't a major project like eMule or 7-zip (which generates millions of downloads on SF.net).

 

[Authority]

Why can’t you build in an auto-update feature where the router is always current... like pretty much all the new mesh routers being released today?


Sent from my iPhone using Tapatalk

 

[RMerlin]

Why can’t you build in an auto-update feature where the router is always current... like pretty much all the new mesh routers being released today?

First reason being Asus's routers (outside of the RT-AC86U) only have one single firmware partition. Flashing a firmware has to be done on top of a live firmware, which means high chances that the router will fail to reboot automatically, and require a manual power cycle. That makes any kind of automated firmware upgrade suicidal as it might leave your whole network down until you actually notice it. It also means a failed firmware update leaves your whole network down. If you don't have a valid firmware images to recover, then it'd be a nightmare to recover.

Second reason is it requires a secure authentication mechanism to protect against someone hijacking the process and pushing compromised firmware images to tens of thousands of routers. That means developing a firmware signing process that requires firmware images to be authenticated before being flashed. I refuse to accept the responsibility of this kind of risk.

Third reason is the infrastructure required, as I'd have to host the firmware images on my own server, with all the bandwidth, lots of time spent ensuring the security of the whole infrastructure and the server itself. Asuswrt-Merlin generates many hundreds of gigabytes of traffic per month in downloads, and a centralized download server becomes a target for hackers wishing to infect tens of thousands of devices just by compromising one single server.

Fourth is, I don't want my router to randomly cut a large download or online backup at 3 am because it just decided to update itself. I already despise Microsoft's decisions in that regard with Windows 10 (having corrupted my development VM not once, but twice - and one time it caused me to lose a whole evening of work).

So, never gonna happen with Asuswrt-Merlin for many reasons. When it comes to critical devices such as a router that is central to your whole network, any kind of automated firmware update is a really bad idea.

 

[jerry6]

That makes sense , hate automated updates .

 

[Authority]

First reason being Asus's routers (outside of the RT-AC86U) only have one single firmware partition. Flashing a firmware has to be done on top of a live firmware, which means high chances that the router will fail to reboot automatically, and require a manual power cycle. That makes any kind of automated firmware upgrade suicidal as it might leave your whole network down until you actually notice it. It also means a failed firmware update leaves your whole network down. If you don't have a valid firmware images to recover, then it'd be a nightmare to recover.

Second reason is it requires a secure authentication mechanism to protect against someone hijacking the process and pushing compromised firmware images to tens of thousands of routers. That means developing a firmware signing process that requires firmware images to be authenticated before being flashed. I refuse to accept the responsibility of this kind of risk.

Third reason is the infrastructure required, as I'd have to host the firmware images on my own server, with all the bandwidth, lots of time spent ensuring the security of the whole infrastructure and the server itself. Asuswrt-Merlin generates many hundreds of gigabytes of traffic per month in downloads, and a centralized download server becomes a target for hackers wishing to infect tens of thousands of devices just by compromising one single server.

Fourth is, I don't want my router to randomly cut a large download or online backup at 3 am because it just decided to update itself. I already despise Microsoft's decisions in that regard with Windows 10 (having corrupted my development VM not once, but twice - and one time it caused me to lose a whole evening of work).

So, never gonna happen with Asuswrt-Merlin for many reasons. When it comes to critical devices such as a router that is central to your whole network, any kind of automated firmware update is a really bad idea.

I guess it’s the potential inconvenience of security vs. security? I’d take security. What’s wrong with making it opt in or $$?


Sent from my iPhone using Tapatalk

 

[AndreiV]

I guess it’s the potential inconvenience of security vs. security? I’d take security. What’s wrong with making it opt in or $$?


Sent from my iPhone using Tapatalk

It isn't going to happen .........

It would be a pointless exercise even if Merlin had the time, money and resources, the people that use Merlin and SNB forums are generally those that like to control their routers and network environment.

I would guess 99.99% of Merlin users wouldn't want automatic updates , I think you will find yourself in a very small minority , probably a minority of one.

 

[RMerlin]

I guess it’s the potential inconvenience of security vs. security? I’d take security. What’s wrong with making it opt in or $$?

No, it's the potential of crashing tens of thousands of networks versus people taking their responsibilities of maintaining their equipment. You don't need an automated update to secure your network, you just need to take care of it yourself. And there are plenty of ways available to be notified of the availability of a new release.

Not gonna happen, period.