On the topic of this post – it doesn’t appear dnsmasq is vulnerable to this, but given the lack of details the author isn’t sure. There is a slightly improved version available that we will be making available as an update once we can properly test it.

I recall 1.3 gets us back the online updating mechanism – if that can preserve a config file, whether there’s anything fancier is almost immaterial – I don’t store any data on the box other than what’s in my config.xml. Sure, on a server I need yum, because there’s a heck of a lot of data that can’t get wiped out for a small update and the OS is gigabytes big. But a 40MB download for a pfSense update I can do in a couple clicks? – no problem.

I don’t think this will be on the road map for 1.3 because there are so many other great things we’re adding and we only have so much time. This wouldn’t have much of an impact on the user vs. the same amount of time spent on some other functionality that a lot of people can benefit from. Personally, wearing my end user hat, I don’t care if the update is 40 MB or 2 MB. I would much rather that significant amount of time to provide differential updates be spent on improving functionality. It may change at some point in the future but likely not for 1.3.

using a package manager we could easily update minor stuff without a full “image” install.