[Coming Soon] New version notification system

[eddiez]

I am happy to disclose the router model, why not put it to a vote to put your mind at rest?

A vote? I think he can decide for himself. Like I said...this is an alternative firmware...love it or leave it.

 

[Clark Griswald]

I believe the recent Mirai Exploit discussed http://www.snbforums.com/ is an example of why some people need to have a notification of fw updates. I'm certainly not describing anyone here, but "some people" fail to update, when the need arises.
Obviously, I have no problem with RMerlin knowing which router, fw, etc.
(see signature below)

 

[RussellInCincinnati]

I looked at this again, once I had gone to the firmware upgrade page in the GUI and run the check from there the notification stopped.

Yes, thanks. AFTER going to the firmware upgrade page, and pushing the "check for firmware" button, am now able to CLEAR the check-for-beta checkbox option. Nice.

 

[RMerlin]

Clicking on the Download button will now take you directly to the appropriate model folder on Mediafire in a web browser - this is no different from if you had manually navigated to it in terms of "information disclosure", it's just more direct.

I'm not totally sure about the RT-AC1900 however. Can someone with this model (with or without P) run the following command and post the output?

nvram get productid

Thanks.

 

[extensi0n]

admin@ap2:/tmp/home/root# nvram get productid
RT-AC68U

 

[RussellInCincinnati]

admin@ap2:/tmp/home/root# nvram get productid
RT-AC68U

Well have changed my RT-AC1900 router to Merlin firmware, so not sure how meaningful this is, but here goes the SSH command:

admin@unit3:/tmp/home/root# nvram get productid
RT-AC68U

 

[hytekj]

Hi everyone,

I didn't have time to finalize it for 380.63, so it will finally appear in 380.64. An often requested feature: the addition of new version notification within the webui. The system will be mostly based on the same code Asus uses for their own notification system, with a few changes:

1) The check will be made against my own server, rather than against's Asus's server (obviously!)
2) It will notify you about new version, and will let you see the changelog (like with stock FW), however it will NOT allow you to automatically download and install. Instead, you will be pointed at the main download site. You will still need to download and flash like before. This is both for security and performance reasons (too many security variables involved in providing such a service, and I'm not willing to get into that kind of responsibility).
3) The option will be opt-out (while Asus's own is hardwired and cannot be disabled). I chose opt-out rather than opt-in because the goal is to help protect more casual users.
4) The ONLY information received on my server will be your IP address (which is for technical reasons - you will be connecting to a web server to download a manifest file, so the web server will know your IP, just as if you had visited with a web browser). I will have a privacy disclosure mumbo-jumbo published on the Wiki soon (it's written, just needs to be published), for people still worried about that sort of thing

Things that remain the same as with Asus:

1) Checks done automatically every 48 hours (with a few hours of variation to spread out the load)
2) Can manually initiate the check from the Firmware Upgrade page
3) Changelog will be shown after a check if a new FW is available
4) The notification area at the top of the page will show a flashing exclamation mark if an update is available
5) Both Release and Alpha/Beta versions will be looked for (you have to opt-in for Beta releases)


I will soon publish a few early alpha builds (like usual) with this new feature enabled, so to start doing load and reliability tests. I might publish a few "fake" new versions on the update server so to trigger notifications, to test out the whole system. I will start the usual [preview] thread at that time, however I'd like all feedback as well as discussions related to this specific feature to be located in this thread here, to better focus that specific area.

One feature I considered but decided against implementing at least for now was pointing you directly at the correct model on the download site. The reason I decided against this for now was for privacy reasons, as it would mean you would be disclosing your actual router model (currently, zero information is being sent) when connecting to the update server (which would redirect you to the download folder on Mediafire). I admit it might be a nice convenience however, and would also help me better figure out which models are most popular among users. Thoughts?

Note that the result of these tests and the gathered feedback will determine the final fate of this feature. If any major issue (such as server load) appears during that test, I might end up disabling that feature, and re-evaluate things out.

I'm posting this a bit early ahead of the release of the first test builds so people can begin discussing things (I already announced the new feature on Twitter a couple of days ago).

Thanks everyone!

I'd much rather be able to subscribe to an email list that emails me when there is a new version released. I like staying up-to-date on software for security reasons but rarely log-in to my router so a notice there wouldn't do much to get me to notice its time to upgrade. From a security standpoint, large scale hacks take advantage of automating an attack using an exploit, and keeping a list of routers' IPs on your server would more easily enable hackers to do bad things should an exploit be discovered in the router firmware and they somehow get your IP logs. Also, don't forget that not everyone will stay on top of firmware updates so eventually you may have some very old routers checking in and remain susceptible.

 

[RMerlin]

I'd much rather be able to subscribe to an email list that emails me when there is a new version released.

There's already plenty of opt-in methods of being notified, including RSS feeds, website change notifications, and Twitter. A mailing list wouldn't add anything new there beside increase my workload and resource requirements and yet just another opt-in method in which the majority of people wouldn't subscribe anyway.. The firmware notification system is complementary to RSS/Twitter, as it requires no interactions to be notified. And once Asus finalize the new notification center, I suspect that email notification might possibly be integrated into it (assuming they go in the direction I expect them to go).

 

[KroetKroet]

Hello RMerlin - greetings from an old friend from your wdlxtv past
I rolled into ASUS technology, and I am happy to see you around here, doing great stuff.
Regarding your poll: I would prefer automatic suggestion of the "good" firmware for the platform, and for the following two reasons: 1) people tend to "accidentially" download for the wrong device and 2) if for any reason, there is a "dead end bug" in a particular type of device's firmware, you could cut the link short.

Just my thoughts!
Keep up the good work!
KK

 

[Lazarus56]

Well have changed my RT-AC1900 router to Merlin firmware, so not sure how meaningful this is, but here goes the SSH command:

admin@unit3:/tmp/home/root# nvram get productid
RT-AC68U

Mine is a RT-AC1900P, and I get the same result - does that productid come from a protected area of NVRAM?

 

[RMerlin]

Mine is a RT-AC1900P, and I get the same result - does that productid come from a protected area of NVRAM?

This result is actually expected. It's hardcoded in the bootloader. The RT-AC1900P uses the same firmware as the RT-AC68U, it's a variant of that model. based_modelid is the "parent" model family, if you'd like.

 

[Clark Griswald]

I'll remove the two fake new firmware over the next few hours. Next time it occurs, it should be due to a genuine new beta (unless I need something specifically tested, in which case I will post it here first).

I just installed in the 64.alpha2 and all is working well (88U).
Glad I went through forum to read why I failed to see upgrade available.

 

[Robjffrggxarhh]

Will it be possible to run a script, so I can send (with the script) an email when a new firmware is found ?

 

[RMerlin]

Will it be possible to run a script, so I can send (with the script) an email when a new firmware is found ?

You could poll nvram through a cron job to monitor the state of webs_state_flag, and act accordingly. webs_state_info will contain additional information.

 

[Clark Griswald]

I use the asus router app, and did the Fw Upgrade (FU button), and received "router already running the latest firmware", which is much nicer than prior to this alpha_2 fw, the Fw Upgrade would start downloading (?).
Nice feature, Thank You

 

[RMerlin]

Alpha 3 builds are now available (the new build notification can take a few hours to appear, as I'm testing with a long time-to-live cache at the moment). The main change related to the new update notification is now, when clicking on "Visit download site" on the Changelog popup you will be automatically sent to the download folder of your specific router model.

Sometime this weekend I will push a fake alpha 4 release so people can test this functionality after they've upgraded to alpha 3.

 

[st3v3n]

Have grown old and gray since the time I worked on mainframes in the early 80's, I never mistakenly downloaded or applied the wrong firmware, OS etc. I know it's possible to click on the wrong link, I just haven't ever done it. My 2 cents, since you asked M, is to anonymisze the model number, if you must haveit, or if not, then the users should be able to meet the devs halfway (is there a halfway Merlin?) so you have the feedback you wish. We've all enjoyed boundless freedom for many years to download and apply whatever build of 3rd party FW to whichever model/unit of router we own, which is a basic freedom (or right) that no one should take/assume too lightly, or give up too quickly. It's unfortunate that the govt is forcing the manufacturers to become nannies, but sometimes, in cases when security is ignored by those who are responsible for the upkeep, it takes more than a complaint to customer service to get their attention, as with routers. As it's my personal router that I bought, I'd rather choose to remain responsible enough as an admin/enthusiast on my system, to take care of it myself. For those who don't care or don't want to be bothered, then opting in or out of information sharing is also your right/choice; if that's what you truly believe is what's the right thing for you to do. I'd be willing to work directly in some fashion with the dev, to cut down on his headache, than to give up the keys to my kingdom (so to speak), but I decline to opt in for convenience sake. Merlin has a vested interest to learn what models are worth his work and time, if the download counters aren't sufficient. I certainly can't pay what you gents deserve, and doubt anyone here can contribute sufficiently either. M and J's work/service to us, who purchase and use these toys is admirable and invaluable, and many of the features added are more than what security concerns dictates. In the end, if and when it comes to the point where I must give yet more information not previously required (and in the past 15 years, no one knows if the demand for more info will ever stop), then I'll have to seriously consider putting my pretty black (and white) Asus boxes on the shelf, and once again build a bulky computer-based router box. It wouldn't be as convenient as downloading M or J's FW, but many are building very small and very powerful routers out of Pi's and Pfsense, which are incredible compared to what we paid thousands for only 10-20 years ago. I wouldn't want to give my Asus router or M & J's FW, but I can still secure my system otherwise. People still believe you are required to fill out and mail in the warranty card or register on a web site, but it's not required; not that I've ever experienced a warranty on any unit that was worth beans when I attempted to have it honored, and there were a lot of them. Sorry to go on, but a defacto pre-registration of router information to update it in order to keep it secure is unsettling; the process seems insecure. Again my thanks M & J.

 

[interconnect]

I'm all about checking the router model number and point to the correct page on the download site!

 

[MarkRH]

5) Both Release and Alpha/Beta versions will be looked for (you have to opt-in for Beta releases)

Just installed the Alpha 3. I am guessing the Beta box needs to be checked to get notices of newer alpha and the beta version, right?

 

[GoNz0]

A vote? I think he can decide for himself. Like I said...this is an alternative firmware...love it or leave it.

I wasn't the one doubting the opinion of others, Merlin was so it makes sense.