> - Web panel allows root code execution on the device (every XSS is full RCE!)
Mostly, but not absolutely true, and being addressed.
> - Everything runs as root
Basically true.
> - No ASLR or other hardening flags because FreeBSD
And because SafeStack CPI is a much better solution, and our focus.
> - Lots of XSS and CSRF opportunities (probably got better with the new UI)
Work going into 2.4 to basically quash XSS / CARF.
> - Did not replace SSL certificate after Heartbleed (on packages.pfsense.org!)
I recall differently, but we were more focused on fixing pfSense and the four releases in that month.
> - No package signing, either (not sure if this is still true with pkgng)
2.3 got pkgng, and yes, we sign packages.
> - Did not even have SSL on packages.pfsense.org until one or two years ago
I finally had to take these parts over from the previous admin.
If you have more suggestions, I'm listening.
The Font Awesome icons used in 2.3 and forward are located in /usr/local/www/vendor/font-awesome
we can (and do) use the GUI when there is no WAN connection
Edit: any chance you're running a browser plugin that is blocking the font-awesome fonts?
FA started adding logos and stuff to the fonts and there are 3rd party lists you can use that are more aggressive and font-awesome is in some. https://github.com/FortAwesome/Font-Awesome/wiki/Troubleshoo...
> - Web panel allows root code execution on the device (every XSS is full RCE!)
Mostly, but not absolutely true, and being addressed.
> - Everything runs as root
Basically true.
> - No ASLR or other hardening flags because FreeBSD
And because SafeStack CPI is a much better solution, and our focus.
> - Lots of XSS and CSRF opportunities (probably got better with the new UI)
Work going into 2.4 to basically quash XSS / CARF.
> - Did not replace SSL certificate after Heartbleed (on packages.pfsense.org!)
I recall differently, but we were more focused on fixing pfSense and the four releases in that month.
> - No package signing, either (not sure if this is still true with pkgng)
2.3 got pkgng, and yes, we sign packages.
> - Did not even have SSL on packages.pfsense.org until one or two years ago
I finally had to take these parts over from the previous admin.
If you have more suggestions, I'm listening.