Backdoor found: should I still buy this Juniper SRX100 router?

[Kursah]

True it's older, but I wouldn't think for a second that there's absolutely no backdoors exploitable or conveniently hidden in any appliance OS, PF Sense included. That kind of assumption is dangerous. With that said, PF Sense is probably one of the better bets for users.

 

[qubit]

again as much as the people in this thread like controversy and tin foil hats the backdoor had nothing todo with the NSA
think about it if the nsa wanted to have a backdoor they would certainly do a better job of hiding it there are far more secure approaches to putting in a back door then what is shown here

It's actually the first article that I linked to citing the NSA putting it in there, not us. Also, the article is giving reasons why it's actually likely not the NSA, despite rumours that it is.

Whether they'd do a better job of it than this I have no idea.

 

[taz420nj]

True it's older, but I wouldn't think for a second that there's absolutely no backdoors exploitable or conveniently hidden in any appliance OS, PF Sense included. That kind of assumption is dangerous. With that said, PF Sense is probably one of the better bets for users.

Bugs are one thing, but pfSense is open source - whether it is on a PC or an appliance it's still the same program. It's pretty tough to "hide" a back door in something with so many eyes that can look at it...

 

[Rhyseh]

From a networking perspective is a very inelegant solution. Your better off having something embedded in the device (read hardware) to upload logging data.

Chances are this is a backdoor that the dev team use and neglected to remove.

 

[Kursah]

Bugs are one thing, but pfSense is open source - whether it is on a PC or an appliance it's still the same program. It's pretty tough to "hide" a back door in something with so many eyes that can look at it...

True, bugs are one thing and yes pfSense is open source...but that doesn't mean it's impossible, just far less likely to be seen if someone really wanted to hide it. Regardless doesn't mean it will not and cannot happen, and it's simply unsafe to assume it cannot. Less likely, absolutely...impossible..not even close.

 

[taz420nj]

True, bugs are one thing and yes pfSense is open source...but that doesn't mean it's impossible, just far less likely to be seen if someone really wanted to hide it. Regardless doesn't mean it will not and cannot happen, and it's simply unsafe to assume it cannot. Less likely, absolutely...impossible..not even close.

Not saying it can't, but the odds that it would are astronomical. If they tried it do you realize what that would do to their credibility once it was found - since it IS impossible to hide something surreptitious in open source code? It would become non existent instantly. They'd never be trusted again, they'd lose the vast majority of their userbase overnight and it would be the end of ESF.

 

[Kursah]

Not saying it can't, but the odds that it would are astronomical. If they tried it do you realize what that would do to their credibility once it was found - since it IS impossible to hide something surreptitious in open source code? It would become non existent instantly. They'd never be trusted again, they'd lose the vast majority of their userbase overnight and it would be the end of ESF.

It would be far far worse than what Juniper is facing to say the least. Let's hope that day never comes...

 

[qubit]

Not saying it can't, but the odds that it would are astronomical. If they tried it do you realize what that would do to their credibility once it was found - since it IS impossible to hide something surreptitious in open source code? It would become non existent instantly. They'd never be trusted again, they'd lose the vast majority of their userbase overnight and it would be the end of ESF.

This is one of the reasons why I like IPCop so much, which I've been using for about a decade, now. As you say, any funny business like this and they'd be dead in the water.

Confession: the old Compaq D510 PC it was running on developed a very noisy CPU or PSU fan a few months ago. I then turned it off and returned to my old ISP supplied router temporarily. The shame of it is that I never got round to fixing the PC and I'm still on it! That Juniper doesn't look like it's got a fan so at least an annoying fault like this won't be a problem, lol.

 

[Rhyseh]

Nope. No fan. It's really very low power draw overall.

 

[qubit]

Ok, I've had the router for a couple of days now and have just gotten around to playing around with it this insomniac night.

Turns out I won't be keeping it, unfortunately. While it's very nice, it doesn't actually log intrusion attempts the way that IPCop does. With that, I can see a daily record in the web interface of every single attempt on every single day that it's running. In particular, it's the number of attempts I get each day that I like to see, so I can't see the point in spending significant money just to get something that loses me a critical feature. The SRX100 does have a lot of advanced features though and I can see why companies would want to use it, it's just not for me.

I'm just gonna have to get off my ass and fix/replace the fan in that old PC now.
Thanks for all your help though, especially @Rhyseh.