Chinese citizens have more computing freedom than American citizens at this point. What the fuck happened to the land of the free?
So much different than the piece of shit closed-source proprietary netgear chinesium.
Consumer routers are shit full stop.
the router sniffed plaintext http to grab HTTP User agents to put them into a curl bash command line string. Nice RCE from the browser.
Even if you have the source and build system to recreate the exact binary blob and can reload it with Jedec or whatever, there is another world below the firmware...called microcode. Some of the microcode comes from the FAB preloaded! Even if you can get the source code for the microcode and somehow read it out and verify it is the same, you guessed it...there is another world below that [1 https://www.researchgate.net/publication/380555600_Trustwort... ] [2 https://dl.acm.org/doi/fullHtml/10.1145/3579856.3582837 ] [3 https://ieeexplore.ieee.org/document/7546493 also https://www.semanticscholar.org/paper/A2%3A-Analog-Malicious... ]
So no, this does not pull all existing routers off the market. Anything that already got FCC approval remains approved and new stock may be imported and sold.
Effectively banning all consumer routers.
Manufacturers can support devices for long but it costs money which the consumers / businesses aren’t willing to pay or value. Cybersecurity is a joke and the general consensus is : we will pay for things as and when there is a fire. We don’t put a price on prevention because we can’t really show it to shareholders how we profited from not being attacked since we blocked those. So we create an arbitrary certification and pass things according to it. This certification doesn’t say anything about firmware. But if we do get attacked then we can convince the shareholders to spend money on better equipment this financial year and then not bother until the next time we have a problem.
Some of these certifications focus on what the devices allow you to do (like acls and firewalls) and see if they pass these tests. But actually looking at the firmware and finding vulnerabilities is not in scope.
I switched away from Omada to Ubiquiti, because of TP Link’s problems.
I can’t think of a complete start to finish, OS to mosfets, computer that is 100% manufactured in the United States.
Of course, getting a router SOC with firmware from the factory , soldering on the Ethernet ports and adding RAM and storage, installing an OS, throwing it in a case with a power supply into a box isn’t solving the problem of insecure foreign firmware but is meeting the “Made in US” demand.
So what counts and who gets exemptions will be telling.
If worried about supply chain and inside jobs, I worry more about the IoT widgets I have. They are already inside the LAN, can access the internet, etc.
Anyway, bribes aside, this is probably just a talking point and not much actually changes.
Thats what this is all about: government level blackmail.
This is for newly released models that still need to get FCC certification.
[0] https://mono.si/
The fact that they haven't updated that webpage with new information since October 1st 2025 seems to indicate bad news...
Shortly put, they're going through hardware startup woes but will probably make it out the other end just fine.
... at the same time, I don't think I'd send $100 to a site with no contact/ownership/company info to begin with.
One purpose for taxes is to shape behavior. If the behavior they wish for is to have more manufacturing in the US, you increase the taxes of outsourcing it. IOW, you make it more desirable to manufacture locally.
This is kind of a boneheaded way of handling whatever issues they're claiming.
Is this just another mass surveillance operation?
Very enlightened and useful comment, thank you for your participation.
If wireless security is the concern, maybe other people here know better but I don't believe anything convenient will be "secure" in the strongest sense of the word.
No.
And you have to accept living with / mitigating that e.g. that isolated wifi access point theoretically receives and will need to apply software updates. /s People seem to treat it as some kind of heresy if you simply deny such appliances internet access.
I keep recommending the free version of Sophos firewall for home users. It's still a bit of a bear to configure.
FCC maintains a list of equipment and services (Covered List) that have been determined to “pose an unacceptable risk to the national security.." FCC Updates Covered List to Include Foreign-Made Consumer Routers..Really, do they have a definition?
Yeah conceivably you could use this to ban any network device that is capable of routing between interfaces, so lots of switches with new firmware could do it, often terribly, as well as PCs with multiple interfaces. But its probably going to involve intention.
...which in turn refers to https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8425A.pdf
(edit: and RAM!)
(edit: and NOT multiple video outputs!!)
> Firmware updates for existing covered devices are allowed, but only through March 1, 2027.
Good luck enforcing that with libre firmware without being sued with some amendment until oblivion and the FCC -the irony- gets sued like crazy.
> For the purpose of this determination, the term “Routers” is defined by National Institute of Science and Technology’s Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems. ¹
> A “consumer-grade router” is a router intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems. Throughout this document, the term “router” is used as a shorthand for “consumer-grade router.” ²
There doesn't seem to be a general ban for foreign-made professional routers, just for some Chinese manufacturers, right³?
Oh, and what does "produced by foreign countries" even mean? I couldn't find any definition. Is this meant to be the country of final assembly? Would importing a Chinese router and the flashing the firmware in the USA be sufficient to be exempt? Where is the line drawn usually?
¹) https://www.fcc.gov/sites/default/files/NSD-Routers0326.pdf
²) https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8425A.pdf
Because it provides a pathway to full government control of the internet.
Content that demonizes the current administration's enemies will become easier to find. Evidence of their crimes will vanish.
When they murder someone in the street, fewer people will find out about it, and those that do will be more likely to hear the government's side of the story.
Mobile networks are already owned by the billionaires, and they've shown plenty of willingness to shape traffic for their interests.
Managing this kind of information at scale is an incredible challenge, but one that LLMs are very well suited for.
Even if you are confident the current administration doesn't have the competence or longevity to exploit this (as I mostly am,) we can easily predict future admins of either party will happily make use of these capabilities.
Bad for the US, but also very bad for the world, because it will make it much easier to manufacture consent for or hide future international crimes committed by the government.
We've excused the complete loss of traditional journalism with a reliance on the Internet instead. Not anymore.
Can savvy individuals work around it, of course. But the general public will treat them like conspiracy theorists, because all they will see is content that reinforces the administration.
The technical discussions in here sound like: "silly Caligula, his horse won't be able to sign his name to cast a vote in the Senate."
Bloomberg Editorial Board: The US Must Not Become a Nation of Emigrants - https://www.bloomberg.com/opinion/articles/2026-03-20/immigr... | https://archive.today/a9DbM - March 20th, 2026
> A recent analysis found that US emigration has reached unprecedented levels. Much of this exodus is due to the administration’s deportation efforts, but by no means all. Last year, at least 180,000 American citizens left the Land of Opportunity to find a better life elsewhere.
> During the recession of 2008, a Gallup poll found that about 1 in 10 Americans wanted to permanently leave the country. That figure is now 1 in 5. Among women ages 15 to 44, it’s a whopping 40%. Some of that sentiment is tied to politics, of course, but the emigration trend predates the current administration.
Combine that with a general inability to understand or empathize with what's going on outside what they can directly see. How many Trump supporters have we seen who loved him cracking down on illegal immigrants until the crackdown came for someone they cared about, then suddenly it was an outrage (but only an outrage in that specific case)? How many have cheered tariffs until they had to pay a bunch more money for something? How many said "no more wars!" and thought it was great how Trump didn't invade anyone in his first term, and now are saying that attacking Iran is great because they've been an existential threat for half a century? This will be the same way. It'll be, yeah, stick it to those foreign bastards. America First! Then in a few months or years, "The store doesn't have any routers, what the hell?"
> This law requires the U.S. Federal Communications Commission (FCC) to issue rules stating that it will no longer review or approve any authorization application for equipment that poses an unacceptable risk to national security.
The Secure Equipment Act itself was passed in 2021, but the law itself doesn't proscribe any particular equipment or manufacturers. Instead, tells the FCC to create a list and delegates listing duties to various parts of the executive branch (national security agencies, Commerce, the Federal Acquisition Security Council). That's what changed yesterday and it was in fact done by the current administration.
If Apple can make a Neo laptop out of phone parts, they could make a US Airport router out of US mini PC parts.
For example, my router/firewall, which also implements various other network services, e.g. hosting my own e-mail server, is an old Intel NUC with 5 Ethernet ports, 4 of which are made with USB Ethernet interfaces.
However, the approvals appear to have not been based on any objective methodology, but sometimes nothing has been approved, while otherwise there may have been some approvals but their randomness was suspicious.
Now this new interdiction continues the trend, so it is normal for people to be wary that any approvals will be based on some kind of bribing and not on any serious security audit.
(edit: but it's not considered a consumer grade router, that's for sure!)
The FCC maintains a list of equipment and services (Covered List)
that have been determined to “pose an unacceptable risk to the
national security
Recently, malicious state and non-state sponsored cyber attackers
have increasingly leveraged the vulnerabilities in small and home
office routers produced abroad to carry out direct attacks against
American civilians in their homes.
Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. This includes the FCC which license their devices and the FTC who (until recently) had the direct mandate to protect consumers.
Our most recent step backward was to gut those agencies of any ability to provide consumer oversight. All they they can do now is craft protectionist policies that favor campaign donors.
The US has a bazillion devices with crap security because we set ourselves up for this.
The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one.
What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using the device for 15. And "require longer support" doesn't fix it because many of the vendors will go out of business.
What you need is the ability for consumers to replace the firmware.
That solves the problem in three ways. First, when the company goes out of business you can still put a supported third party firmware on the device. Second, you can do that immediately, because the open source firmwares have a better security record than the OEMs to begin with. And third, then the device is running a widely used open source firmware instead of a custom device-specific proprietary black box, which makes it easier for the government or anyone else who is so inclined to find vulnerabilities and patch them.
So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring.
And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month another kind soul finds more bad wiring. And we just have to hope there is an army of kind strangers out there checking every building built by every company. And hope in the meantime that the building doesn't burn down.
Meanwhile, people have to live with bad wiring for years, that could have been completely prevented to begin with, by an electrician following the electrical code we all already agree on.
I don't think that's enough. Most people aren't going to replace the firmware on their device with an open source replacement made by someone else. Now if the firmware was required to be open source, and automatic updates could be seamlessly switched over to a non-profit or government agency in the event of the company going out of business, you might have something. But there would be a lot of details to work out.
Which is not a real issue in practice. It's like arguing that warranty doesn't matter because the vendor might go out of business.
> That solves the problem in three ways.
That alleviates the problem, but definitely doesn't solve it. Updates are still required, and most people will never update devices they don't directly interact with.
Enterprise must be able to pay for support for as long as they use devices. Solved.
I can only think of requiring the devices to be serviceable, as you say. The absolute only way I can think of charging the consumers, ie the owners, is to charge a tax on internet connections. Then the government would pay somehow vulnerability hunters working along patchers, who can oversee each other.
Consumers are tricky: if you include support in the sale price, the company will grab the money and run in 3 or 5 years; and some companies will sell cheaper because they know they won't provide support.
Tough shit. You provide updates for the mandated amount of time, or you lose access to the market. No warnings, you're just done.
> And "require longer support" doesn't fix it because many of the vendors will go out of business.
Source code escrow plus a bond. The bond is set at a level where a third party can pay engineers to maintain the software and distribute updates for the remainder of the mandated support period. And as time passes with documented active support, the bond requirements for that device go down until the end of the support period.
Requiring that the customer be allowed to replace the firmware is essential, I agree, but not for this reason. That requirement, by itself, just externalizes the support costs onto open source communities. Companies that sell this sort of hardware need to put up the resources, up front, irrevocably, to ensure the cost of software maintenance is covered for the entire period.
Personally I don't buy consumer router hardware that I can't immediately flash OpenWRT on, but that option is not suitable for the general public.
How does one ensure the support for the devices is funded?
You managed to say that with a straight face!
Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out.
How on earth is embedded creds in any way: "no known bugs"?
I think we are on the same side (absolutely) but please don't allow the buggers any credibility!
Do you mean 'out of business so they cannot provide updates'?
Because, if you mean cheap companies won't be able to provide updates and stay in business, surely that's the point. Companies would have to shim to a standardised firmware that was robust, or something, to keep costs down.
Isn't this all to protect USA business interests and ensure the Trump regime can install their own backdoor though?
No it isn't, software formally verified to EAL7 is guaranteed to be secure.
Plenty of consumer-grade devices have had very lax security settings or backdoors baked in for purposes of “troubleshooting” and recovery assistance. It’s never been limited to foreign-made devices.
Security has never been part of the review process. The only time any agency has really cared is when encryption is involved, and that’s just been the FBI wanting it to be neutered so they can have their own backdoors.
The FCC licenses devices to the extent that devices can cause spurious transmissions in the radio spectrum. It’s not a general consumer protection agency. Computer security also is outside the mandate of the FTC, which exists to protect consumers from anticompetitive conduct and unfair business practices, not crappy products.
Sounds like it does to me. Also you're forgetting the part where the FTC under a prior administration either banned DLINK from selling in the US or heavily fined them for selling routers in the US that they knew were running insecure, buggy firmware.
(both quotes were taken verbatim from first, Netgear's US website, and secondly the Bureau of Consumer Protections' section of the FTC's website)
Interestingly, Europe is about to try this: the Cyber Resilience Act is going to become obligatory for all sold digital products (hardware & software) by the end of 2027, with a bunch of strict minimum requirements: no hardcoded default passwords, must check for known vulnerabilities in components/dependencies, encryption for data at rest, automatic security updates by default (which must be separate from functionality updates), etc.
Remains to be seen whether this'll help, but good to see somebody have a go at fixing this.
Not that any consumer router is super nice and safe, honestly, you're better off making your own these days.
Sorry but this is merely a convenient excuse. Source: I have hard evidence of a Chinese IoT device where crap security practices were later leveraged by the same company to inject exploit code. It's called plausible deniability and it's foolish to tell me it's a coincidence.
You're not going to convince me that a foreign state actor pressuring a company to include a backdoor wouldn't disguise it as a "whoopsie, our crap code lol" as opposed to adding in the open with a disclaimer on it.
It's all closed source firmware. Even the GPL packages from most consumer router vendors are loaded with binary blobs. Tell me I should trust it.
Banning foreign-made devices will not stop any of that.
True, but the country of manufacture is related to the risk of back doors.
There is a huge security problem (everywhere, not just the US) with insecure consumer devices (not just routers, everything from Wi-fi enabled lightbulbs to cars). AT least someone seems to be waking up to the problem even if their solution is half-baked.
That depends on how you define "Vulnerability", doesn't it?
For instance, from some standpoints, the absence rather than presence of a backdoor in consumer routers could be considered a "vulnerability", no?
> Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations.
In other words, foreign-made consumer routers are banned by default. But if you are a manufacturer, you can apply to get unbanned ("Conditional Approval").
In the FAQ (https://www.fcc.gov/faqs-recent-updates-fcc-covered-list-reg...), they even include guidance on how to apply: https://www.fcc.gov/sites/default/files/Guidance-for-Conditi...
If you (a manufacturer) apply, they want information regarding corporate location, jursidiction, and ownership. They want a bill of materials with country of origin and a justification for why any foreign-sourced components can't be domestic. They want information about who provides software and updates. And they want to hear your plan to increase US domestic manufacturing and progress toward that goal.
So, foreign-made consumer routers can still be sold, but they are going to look at them with a fine-tooth comb, and they are going to use FCC approval as leverage to try to increase domestic manufacturing.
Yes china routers are a liability, but free trade and open market ensure at least one thing that's essential : no single state has surveillance capability on its entire population
I took a screenshot to share if anyone is interested
This is about full domestic control of the internet. For both ingress and egress.
Remember how Iran likely murdered thousands of protestors a few months ago, but we don't actually know? They want to be able to do that here.
https://www.washingtonpost.com/graphics/2020/world/national-...
You can get an old desktop or laptop that's more than good enough to be a router for basically nothing (or sometimes literally nothing) on Craigslist or Ebay. I suspect pretty much anyone who frequents this forum could probably figure out how to do it with a YouTube tutorial. Routers are pretty dumb computers, so you don't need something top of the line.
Even if you want higher speed than the ethernet port built into the computer, you can buy old dual-port 10GbE PCIe cards for less than $50 on eBay as well.
I've been running my own custom thing with NixOS for a couple years now, and it's been working great, and before that I ran ClearOS for a couple years, and before that I ran OpnSense for a couple years. They all work fine, and they're not too hard to set up. I recommend it to anyone who can figure out how to do it.
The FCC's power just got substantially nerfed, and "we've decided to slow lane all foreign-made routers" feels like that may have been beaten on the old, higher, standard. Let alone the new one that gives the FCC almost no power.
Are there even consumer-grade routers that are produced in the USA...?
A little rich coming from the administration that supports a strict view of the major questions doctrine. They have no problem kneecapping the EPA. But the communications commission has the right to ban all drones (and not the FAA for example).
I'd say I'm shocked but I am not. Their next order forcing backdoors will be secret.
If companies market the devices as something other than "routers" then consumers will not buy them for routing duty.
(Meanwhile, the non-average people who want to use general-purpose computers as homespun router/NAS/do-all boxes are already aware of how this all works...and many of us have been doing it this way for decades. (Often, this happens alongside dedicated access points that do have good wifi radios.))
I have roommates who are engineers and I had to explain to them the difference between Wi-fi access point and LAN when I replaces our wireless router with a router + 3 APs.
So start your own company called usa router co, and sell some random arm board with a preinstalled router image... the end user won't know the difference.
I've already done everything the article says to do years ago, but what happens when this equipment dies? Can I get a replacement, and is it flashable? I currently use "routers" as access points because it's the cheapest way to get an AP for OpenWRT.
Personally, I don't make the distinction between foreign and domestically produced routers in America. In fact, I trust foreign produced routers more because the likelihood that they can act upon their surveillance is significantly lower than the current American regime's oppressive and malicious tactics. Therefore, open source routers provides enough transparency to effectively eliminate spyware threats from all angles while being compliant.
I'm especially excited about the Banana Pi because of the transparency and potential of modular upgrades. Whenever there's a network issue, I have to consider whether the manufacturer (American or not) is doing something nefarious. With a Pi based router, I have much more peace of mind with network debugging issues.
The only thing I'm missing right now that would be a nice to have is a wifi card so I can ditch my access point. My hardware isn't open source by any means, but my reliance on non-free networking code is minimal.
Thanks to whistleblowers like Mark Klein and Ed Snowden we know that we're all being monitored by the government. If there are "lists" at all at this point it's the few people that aren't being watched 24/7.
I'm guessing the rest of this looks like drones, too: FCC approval is given only to American companies that bribe members of the administration, and they raise prices through the roof. The routers are still manufactured overseas and there's no improvement in security.
It's all a bunch of very expensive kind of dodgy Compex cards, used for industrial or prototype purposes. Be prepared to spend $300+ for a single 4x4 MIMO card. And then you want to go dual band right?
Thankfully the MediaTek offerings are somewhat available and much much much cheaper, but reports are that driver quality is just absymal.
Meanwhile the openwrt table of hardware for wifi 6 and wifi 7 is a bare trickle already, and inceasingly not consumer routers but SBC. Thanks for the FCC messing things up brutally already, back in 2015, with requirements to make sure users couldn't possibly do anything out of spec, requiring these systems to be locked down. They almost banned open source outright, but in practice it feels like the requirements are high enough that they practically did. https://toh.openwrt.org/?features=wifi_be https://arstechnica.com/information-technology/2016/03/tp-li...
Frelling FCC! What dastardly deeds done against civilization! We would be so much more secure & protected, the bar would be so much higher if open source / openwrt was allowed to compete. You messed everything up already!!
Previous example: https://news.ycombinator.com/item?id=37392676
Numerous papers showing the ability to easily map indoors areas with WiFi (including occupancy) it’s a liability.
There will be excuses “tariffs” etc but I heard a few have gotten calls from three letter agencies coyly telling you to improve your systems.
It’s a chance to refresh the product line! (of course at the worst time when mem prices are bleed you dry high)
They're not likely to go to war against people with long-range missiles though. Even they are not demented enough for that.
The US didn’t make a space force to please the ego, it was likely to occur eventually. They aren’t spending all their time wargaming a moon invasion lol
Logistically, hacking tons of different model routers is not feasible. It would be more useful to yank the power grid.. which can be accomplished with missiles or software.
But largely thanks to FCC demands, the list of router hardware that can run open source operating systems such as OpenWRT has dwindled to a trickle. There's very precious few wifi 7 / BE systems available, and only a few wifi 6! it's ghastly. https://toh.openwrt.org/?features=wifi_be https://toh.openwrt.org/?features=wifi_ax
To me, this is a deeply dangerous situation for the state & for the population, where it is nearly impossible for consumers and businesses to purchase gear that they can secure. Where we are at the mercy of what is on the market, and no actual securing of our own can occur.
The FCC claimed in 2015 they were not trying to forbid open source systems, but the additional compliance demands they have made unsupportable unsecurable devices the default state: the FCC mandated companies make sure the users dont have freedom, make sure the wifi performance is locked down, and the most obvious path to that end is to just lock out the user entirely. Open source isn't outlawed, but the FCC turned a good working amazing open source movement into something that is incredibly rare and hard to do. The FCC assurances (https://www.eff.org/deeplinks/2015/11/free-router-software-n...) have not proven true (https://news.ycombinator.com/item?id=11122966): everything has gotten worse for security & availability (https://news.ycombinator.com/item?id=11122966).
From one side, that sure... does have some point. Well, I mean, one could potentially install some kind of a backdoor on the networking hardware they produce, and if it's state-controlled, then it could potentially be a threat.
From the other side, though...
That's crazy. Maybe I'm missing something obvious, or maybe I'm just stupid, I don't know; but at this point, with almost no manufacturing in the USA, this feels like shooting yourself in the foot. Or rather, it's like shooting yourself straight up in the head if manufacturing will not be efficiently (so it can satisfy the demand) moved to the USA (which is a big challenge).
There are more than a half dozen fabs in the US which can produce networking chips like ethernet controllers, line drivers, SOC, etc: Intel, TI, Samsung, et al. If US wanted to onshore routers, we could make it happen.
> If US wanted to onshore routers, we could make it happen
https://www.fcc.gov/sites/default/files/NSD-Routers0326.pdf
a router produced in the US from foreign-made parts - like controllers, drivers etc. - is not in the "covered list". Although I admit the wording is vague: "produced in the US".
Now, that's not even the main problem. Imagine if someone did something like this with RAM or NAND. Again, maybe I'm stupid, but this sets a precedent. It's not currently possible to move RAM manufacturing (fully satisfying the demand) to the USA, though, so I doubt anyone sane would try to do so.
It's also a quasi inevitable side effect of the push to encrypt all communication back to the cloud, since now it's too easy for malicious devices to hide what they're sending back.
Back to wearing the tin foil hat in my faraday cage.
That is not what's going to happen. What's going to happen is that anyone coughing up payola to the current executive in chief's people will get approved, and anyone that doesn't will remain blocked. This practice is currently widespread, in the form of tariffs.
Also, the biggest benefactors of payola aren't the politicians, it's the rent seekers, that is the businesses already in place that want to prevent competition. Because of this, they usually directly contribute to the politicians that promise to restrict the path to doing business.
For example, if you want a newest-generation extremely-efficient air conditioner in the US, you won't be able to buy it and even if you could, you wouldn't be able to get anyone to install it. Any given model of air conditioners needs to be on an approved list to be sold in the US, and the installer needs to be on an approved list, too. This means that by the time an air conditioner makes it onto the list, it's already old. Also, installers can require you buy it from them, and almost all do, so by the time time an installer on the list has it for sale, it's even older than that. Ironically this is all enabled by the EPA, on the auspices that they are ensuring that it's energy inefficient, when in reality they are preserving the market for the older, more expensive, and inefficient models.
Wow NGL this sounds great if you ignore the reality that it'll be used as a partisan backdoor to enriching the administration.
This comb likely is designed to extract loose $1M checks from the foreign manufacturers.
You're assuming a non-partisan technocratic process, which this administration has amply shown is neither capable nor willing to provide. This requirement becomes another opportunity for Pay-to-Play, either in cash or quid pro quo, to the government directly (see, e.g., NVidia and AMD export allowances) or to Trump's inner circle (see, e.g., crypto venture regulation, merger approvals).
No, of course I'm not assuming that. That's not the administration's pattern of behavior, so it would be a crazy assumption.
I agree it'll be abused. I just didn't feel it necessary to state the obvious.
by giving daddy trump his taste, no doubt.
The OpenWRT One [1] sponsored by the Software Conservancy [2] and manufactured by Banana Pi [3] works lovely.
[1] https://openwrt.org/toh/openwrt/one
[2] https://sfconservancy.org/activities/openwrt-one.html
[3] https://docs.banana-pi.org/en/OpenWRT-One/BananaPi_OpenWRT-O...
If the software is an important differentiator (arguably, it is for things like Ubiquiti, but clearly it is not for most consumer routers), then release the patches under the Business Source License with a 3-5 year sunset back to BSD / Apache / GPL.
If it was required they would do it.
Self ownership and full 'right to repair' has carve-outs in the FCC's regulations in the name of limiting unintentional broadcasting/radiation. Maybe a challenge to those would survive in the post-Chevron environment. I wouldn't expect any Congress in the last 25 years to pass a law which would go against the incumbent telecom lobbyist interests though, and I'd expect such a hole if it did hit case law, to get 'patched' fairly quickly.
About the only way to really solve that would be to embarrass vendors enough to open their moats.
(To be clear, I don't think that's good enough; at a minimum I think there should be a wifi card that does refuse modifications and a main application processor that is 100% user controlled so that they can actually fix problems without needing the vendor to help, but I think it's useful to point out that auditing code doesn't require being able to install it)
It's very difficult to inspect a laid out chip for nefarious elements - there's too much of it to do manually. Having a secure supply chain is probably the best way to prevent that happening.
Which is not to say that I support this rule - it sounds like another import weapon trump can swing against people who aren't his friends.
Very few companies make the chips too. It'd be very easy for the government to force them to add backdoors.
Trusted, qualified independent experts: Ala Underwriters Laboratories.
Maybe trusted community of people could do it for everyone, but there's currently all kinds of potential legal trouble brewing in that approach. Complete and public reverse engineering of every aspect of any device would have to be made completely legal, so that people could freely publish all artifacts extracted from a device and produced during reverse engineering and collaborate on them without any fear of repercussions. Also HW manufacturers would have to be prohibited from NDAing documentation for SoCs, etc.
Side benefit would be that this would also serve as a documentation for freeing the device and developing alternative firmwares with modernized sw/reduced attack surface.
Though that said, even with a regular old desktop, which is what I used before, the power consumption actually didn't get that high. Even with a lot of torrent traffic FROM LINUX ISOS, it generally hovered around 35W of power, and considerably less when it wasn't busy. Maybe I just had a decent power supply in there, not sure, it was literally a desktop that I got for free from a neighbor that was moving.
ETA:
I should clarify, even though the computer itself hovers around 10-15 watts, I do have an external switch and an external access point. The switch hovers between 25-30W, and the access point hovers around 15 watts. This is definitely a fair bit more than you'd get with a consumer router, so adjust for your pain tolerance. You might be able to find lower-power switches if nothing else.
Maybe "whitebox" stuff will have a moment here. Buy a ARM based "computer" that just happens to have a built in switch and 802.11 radio, and separately purchase an SD card with the OS on it.
Or, perhaps this will be VyOS's time to shine... https://vyos.io/
Can't really see anything really happening in the consumer space, but maybe business/enterprise will move in one direction or another.
I love my NixOS thing, because I am part of the cult of NixOS, but it's probably something I wouldn't recommend for most people because it was kind of a pain in the ass to get working. The reason I do it now is because it lives on the same box that is my server.
I've looked into Vyos, it sort of reminds me of the Cisco stuff and it looks interesting, but it never seemed sufficiently better than my NixOS thing.
As far as network routing is concerned, I haven't been able to see much of a difference. iperf3 shows that two wired connections I'm getting about 9.4Gbps, which is well within any tolerance I need. The router that Verizon gave me only had 2.5Gbps ports so I can't quite compare apples to apples, but the latency was generally pretty similar.
I mostly just like the level of customization I'm allowed to have. There's no arbitrary limits to port forwards and I can install extensions or write my own if I want.
[1] https://www.heise.de/en/news/USA-bans-all-new-routers-for-co...
> As outlined below, today’s action does not impact a consumer’s continued use of routers they previously acquired. Nor does it prevent retailers from continuing to sell, import, or market router models approved previously through the FCC’s equipment authorization process. By operation of the FCC’s Covered List rules, the restrictions imposed today apply to new device models.
I’m sure plenty of US factories are capable of importing boxes that look like routers but are actually just switches (because the router firmware is missing) and re-flashing them here…
(Which is why it's a bit ironic I saw the Google Fiber guy post on X about how they always had TPM^TM "security" in their routers; thats cool, but the drivers you used still made them "general purpose computing over the air" devices)
> In conjunction with original software development, Island is designed and assembled in the USA to improve security and enable tighter quality control throughout the entire production process. The code for Island routers has only been loaded internally at Island HQ in the U.S; customer support is also managed directly in our U.S. Headquarters.
Starlink?
Besides BananaPi, there are e.g. ODROID (Hardkernel from South Korea), FriendlyElec, Radxa.
Source: My company manages logistics for dozens of US manufacturing companies.
Between "age verification" - ID - laws being rolled out across many countries, rocketing transport costs, ICE at airports, incredible inflation of RAM prices, and now catastrophic restrictions on routers, none of this is making Rest of World easier to access.
Let's not forget Russia and Iran both clamped down hard on general Internet access, and Israel and some of the Gulf states have set up aggressive restrictions on live reporting.
I think we're heading to a balkanised Internet at the absolute best.
There's no router industry here because there's (mostly) no electronics industry, and to make one you'd need to build all the supply chains and subsidiary industries from scratch.
And I don't mean to suggest, in any way, that this means that most people are stupid or anything like that. They can have ridiculously high intelligence while the nuts and bolts of networking remain completely beyond the scope of their thought processes.
But yet: Every-day consumer-oriented stores (including Wal-Mart) have routers (and mesh systems and...) in stock on the shelf for purchase in Anytown, USA right now. So while they may not be the majority, people are buying them.
I'm assuming you really meant "detect human motion", which I don't think is a solvable problem at this point in time, at least with high accuracy.
And superficially, it sounds like a straight-forward thing for me or anyone else to do here in the states, but things get murky quickly: What differentiates a foreign-made router from a US-made router?
Can I get some flunky push the button in his studio apartment in Idaho to flash open (but globally-sourced!) firmware onto some boxes from Alibaba (in exchange for startup promises) and call that good enough?
Do I have to spin up the boards here in the States? And the ICs, too? How about the passive jelly-bean parts like the capacitors and resistors and the antennas?
What of the rest of the device? Like, things such as the housing, the packaging, the power supply, and the included ethernet cable: Do I need to source those from domestic US production or is it OK if they're foreign-made components?
Do I have to produce the software in the States? (If so, Linux is right out.)
Where is the line drawn? How is the line shaped?
The old payola model. This new model encompasses the old one and adds a neat layer of outright politician bribery on top.
According to SCOTUS in Snyder v. United States, if the payment occurs after the official act, it's a perfectly legal "gratuity."
Dario (CEO of Anthropic) said the DoW contract violations and threats were direct retaliation for not paying Trump "campaign" money. Later, he was forced to apologize for speaking the truth.
Even if this wasn't done, at the very least they must publish their software testing procedures, the way UL, ETL, and CSA require to certify devices for the US power grid. (https://www.komaspec.com/about-us/blog/ul-etl-csa-certificat...) They can also do black box testing.
But ideally they would actually inspect the software to ensure its design is correct. Otherwise vibe-coded apps with swiss cheese code will be running critical infrastructure and nobody will know until it's too late.
People who care about the problems of digital security are not going to lean into the idea of simply banning devices based on where they were manufactured. Rather they would work at general standards and solutions to actually solve the problems - things like untying the markets for hardware/firmware/services, requiring firmware source escrow, mandating LAN protocols and controllers so every single IoT device isn't backhauling to its own mothership, and so on.
Likewise people who care about domestic manufacturing first and foremost are not going to champion applying steep blanket tariffs two decades after all of that industry has already left, or using regulatory agencies to shake down manufacturers for unrelated concessions.
if there's really one thing that destroys countries is corruption. being originally from a 3rd world country - I have seen it. now the US is heading towards the same path.
having worked in the IOT industry before - I can tell even domestic manufactures will be forced to pay bribes soon cloaked in 'state secrets' - there's already export laws etc - but now they will be forced to pay for compliance e.g maybe donating the president's vanity project.
You misunderstand how organizational knowledge works. You see, it doesn't.
Some embeds the credentials, someone else ships the product. The first person doesn't even necessarily still work there at that point.
Remember that time NASA sent a Mars orbiter to Mars and then immediately crashed it because some of them were using pounds and the others newtons? Literally rocket scientists.
The best we know how to do here is to keep the incentives aligned so the people who suffer the consequences of something can do something about it. And in this case the people who suffer the consequences are the consumers, not the company that may have already ceased to exist, so we need to give the consumers a good way to fix it.
"As reconstructed by Spectrum, ground controllers ignored a string of indications that something was seriously wrong with the craft's trajectory, over a period of weeks if not months. But managers demanded that worriers and doubters "prove something was wrong," even though classic and fundamental principles of mission safety should have demanded that they themselves, in the presence of significant doubts, properly "prove all is right" with the flight.
Quoting https://web.archive.org/web/20210730150049/https://spectrum.... linked to from https://en.wikipedia.org/wiki/Mars_Climate_Orbiter .
Plus, navigators, had concerns about the trajectory,which were dismissed because they "did not follow the rules about filling out [the incident surprise and analysis procedure] form to document their concerns" - from a trajectory team which was understaffed and overworked.
It doesn't matter. When you are building software, you build a security process, not security individuals or stuff like this happens.
>orbiter to Mars and then immediately crashed
Right, and it cost NASA 1.4 billion+ is direct losses to them. With software writers the losses occur to the end user.
You can't solve an incentive problem with process because then they lack the incentive to follow the process.
To enforce a law you need to be able to identify a violation at a point in time when you can still impose a penalty for it. When a device is first released, you don't yet know if anyone will find a vulnerability in it or if the company will stay around to update it if they do. By the time you find out if it will happen, you can't punish them for the same reason they can't provide updates: they've ceased operations and no longer exist. So that doesn't work.
> With software writers the losses occur to the end user.
Which is why the end user needs to be empowered to efficiently prevent the losses, since they're the one with the strongest incentive to do it.
The problem is not that people need a free meal. The problem is that people need the ability to eat some other food when the OEM's restaurant is closed or unsatisfactory.
Who ensures the maintainers for these routers are incentivized to do this competently and in a timely fashion?
You haven’t answered these key questions, which are equally or more important than whether a community firmware can be applied.
99% of the firmware is not actually device specific, and more to the point no one has to create it because it already exists and is already maintained. You don't have to write the Linux kernel from scratch for every different device.
The problem looks like this: The vendor creates an opaque blob that runs on part of the device. This is only 1% of the code that runs on the device but it's the device-specific part. Moreover, that code interacts with the kernel, but was written to assume a specific older version of the kernel which is now out of date.
Updating it to use a newer kernel requires very little work if you have the source code -- in that case much of it is just automated refactoring -- but without the code it becomes a much more arduous reverse engineering effort. Likewise, if the device-specific code has a bug and you have the source code, the cause of the problem is easier to identify and the fix is to change two lines and recompile it. But without the code just identifying the problem becomes an intensive reverse engineering task again.
So you have a community which is willing and able to do a finite amount of work. Some subset of the device owners are programmers and if they can spend two hours fixing a problem that they themselves have, it gets fixed for everyone. But if fixing the same problem takes them two months, they don't. Therefore, the solution is to do the thing that allows it to take the shorter amount of time so that it actually happens.
Businesses aren't incentivized to maintain it and hoping that the community can support it by opening it is perhaps necessary, but it's far from sufficient.
Either the business or maintainers need to be sufficiently incentivized--whether it's through funding, reputation, or something else (graduate-student torture).
What they're actually trying to do is obsolete the devices faster because then they won't add new protocols or other software-only features to older devices so you have to buy a new one, or only expose features in more expensive models that the less expensive hardware would also be capable of doing. Which is all the more reason for us to not have that.
And if they were required to allow anyone to replace the firmware then you would get companies reflashing and selling them that way from the store because the free firmware has more advertisable features. There's a reason you can go to major PC OEMs and pick between Windows, Linux and "don't even install one" and the reason is that if you give customers a choice, they generally don't want their software to be made by the OEM.
This is exactly why. Obsoleting older devices keeps (in their eyes) the purchase treadmill running. Making a device that could be updated forever means never making another sale to that user (unless some physical failure happens, or the user wants a second one).
Anyhow, this is a common enough practice. Many companies that provide infrastructure type software and sell to Fortune 500 companies often have a clause whereby they deliver their software to their customers if the shut down.
And you can't wait until after they're dead to have them do something. By then they're gone or judgment proof because they're already bankrupt. Especially when you're talking about companies that aren't in the jurisdiction because you can't even make them do anything when they're already not shipping products to you anymore. It has to be from Day 1.
There was a promising design from Azure Sphere for 10 years of IoT device Linux security updates from Microsoft, even if the IoT vendor went out of business. This required a hardware design to isolate vendor userspace code from device security code, so they could be updated independently. Could be resurrected as open standard with FRAND licensing.
Why? You'd need to get someone electorally useful involved. That, unfortunately, elimiates a lot of the nihilistic, holier-than-thou tech types. But that's pretty doable nowadays. You just need an electorally-relevant group of people on your side.
The real problem is: assuming that firmware can be updated, how do you run a nationwide update programme overcoming a population that doesn't really care or have the skills to do it.
Vehicle safety standards (mandated annual safety checks like the UK MoT test) is the closest analogy I can think of - in the UK you can't insure your car without a valid MoT. If you were serious, then maybe tying ISP access to updated router firmware would be the way to go.
Then if you're a five person shop making routers and you publish the firmware source under a license that allows anyone to make and distribute modifications you're all set. And if you're Apple or Microsoft and you want to make a router without publishing the source code, you post the enormous bond which you have no trouble doing because you're an enormous company and you're all set.
Are you serious? The number of IoT companies that make a product for a couple years and then go bust is enormous.
> It's like arguing that warranty doesn't matter because the vendor might go out of business.
How are you going to use a warranty from a company that no longer exists to get a security update for a product a million consumers still have?
> How are you going to use a warranty from a company that no longer exists to get a security update for a product a million consumers still have?
I was not talking about using warranty for this.
But then many consumers value cost or other things over security, which is why you need all the devices to be able to be updated even after the vendor is gone.
> I was not talking about using warranty for this.
Then why are you talking about a warranty to begin with?
Then what's KPTI etc.?
> which also needs to be formally verified for a secure system.
Now we just need a correct and complete theory of quantum mechanics and to do something about that Heisenberg thing.
In general formal proofs tell you if something is true given a stipulated set of assumptions. They don't tell you if one of the stipulated assumptions is wrong or can be caused to be wrong on purpose by doing something nobody had previously known to be possible.
Even EAL7 can't guarantee anything. It can only say that the tools used for verification didn't find anything wrong. I'm not saying the tools are garbage, but the tools were made by humans, and humans are fallible.
They regulate broadcast TV. Those rules leak into cable TV because the originators generally want content that can be sold for broadcast in the future and is advertiser friendly. Cable operators are also often beholden to community standards imposed by municipalities they serve. The FCC isn't responsible for content restrictions on cable.
The FCC also regulates interstate wire transmissions.
But ultimately, you're not quite getting it right. It's all RF, it's just that we sometimes choose a really shitty wire called "the atmosphere".
In its defense, there's some practicality to it; we wouldn't say that a "get out of debt" plan that involved spending all available money on lottery tickets is worthwhile because "its not gonna happen". But defeatism is just a shortcut to say "I don't want to talk/think about it" in many cases.
And in this one, if the US Gov't required that all routers purchased by any agency they could influence had the ability to run open source code it would certainly shake up the market.
I really don't think that the Nix language is nearly as bad as people say it is once you get used to it, and I've been using NixOS since before ChatGPT was released so I've gotten pretty ok with it. Plus, there are niceties like being able to use variables for things like interface names which makes it pretty nice.
Also, something kind of nice about NixOS is that once you get it working, it kind of stays working. I have my config file backed up to Sourcehut, and I'm relatively confident that the configuration file is an accurate representation of reality.
Continue your chain of reasoning: DNS name becomes unmaintained, gets grabbed by open source / foundation / gov agency, pushes open source firmware update.
Same thing happens today with botnet C&C servers.
This is only possible if the firmware is replaceable. Along with a practical update mechanism it also requires the possibility to create an update package. That can be achieved by using open source components, but there might be other mechanisms. For example making provisions in case of bankruptcy.
> Then why are you talking about a warranty to begin with?
I was making a comparison with warranty law, which exists to ensure a certain minimum bar for quality and longevity of products. Which is usually desired, therefore legal provisions for updateability of hardware should also be required. Note that a firmware update might well become required within the warranty period.
This is by no means a new concern. IP cams, home routers, robot vacuums, and internet-enabled fridges exist for a long time already. The warranty period was never intended to cover "smart" devices. Maybe forcing an extension of the warranty period for such devices is enough to take care of the problem.
For an analogy to work, its underlying elements should have a relation to the target. Your analogy is not in the same universe. For electrical work, there is a baseline of materials and practices which is known to produce acceptable results if adhered to. For software, there isn't. (Don't tell me about the Space Shuttle. Consumer software doesn't cost tens of millions and isn't written with dedicated teams over the decades.)
Software absolutely has baseline materials, have you never written software before? Never used a library? Programming language? API? Protocol? Data format or specification? CPU instruction? Sorting algorithm? A standard material is just a material tested to meet a standard. A 10d nail is a 10d nail if it meets the testing specs for 10d nails (ASTM F1667). Software can be tested against a spec. It's not rocket surgery.
No known practices with acceptable results?? Ever heard of OWASP? SBOMs? Artifact management? OIDC? RBAC? Automated security scanning? Version control? Code signing? Provenance? Profiling? Static code analysis? Strict types? Formal proofs? Automated testing? Fuzzing? Strict programming guidelines (ex. NASA/DOD/MISRA/AUTOSAR)? These are things professionals know about and use when they want standard acceptable results.
What are you talking about re: space shuttle and tens of millions? Have you actually read the coding standards for Air Force or NASA? They're simple, common-sense guidelines that any seasoned programmer would agree are good to follow if you want reliability.
I think the problem here is there's too many armchair experts saying "Can't be done" when they don't know what they're talking about, or jaded old fogeys who were on some horrible government project and decided anything done with rigor will be terrible. That's not the way it is in the trades, in medicine, in law, and those folks actually have more to think about than software engineers, and more restrictions. I think SWEs are just trying to get out of doing work and claiming it's too difficult, and the industry doesn't want to stop the free ride of lack of accountability it's had for decades.
AI is going to introduce 100x more security holes than before, so something will have to be done to improve security and reliability. We need to stop screwing around and create the software building code, before the government does it for us.
GP was almost certainly referring to "They Write the Right Stuff," an old article that is pretty well known in spaces like this. It discusses a process that (a) works extremely well (the engine control software was ~420 kLoC with a total of 17 bugs found in a window of 11 versions) and (b) is extremely expensive (the on-board shuttle software group had a budget of ~35 million per year in mid-90s dollars).
Even before we start, you immediately have a problem. When a house is built, the thing to be inspected is built in the jurisdiction requiring the inspection.
If you have some code being written in China or India and some US jurisdiction wants to require the sort of programming practices you're suggesting, is the US going to send inspectors to other countries? How do they even validate that the processes are being followed either way? And what are you proposing to do with all the existing code that was written in the past? Requiring the company to have a checklist included in their book of procedures that nobody is actually following doesn't solve anything.
The way this nominally works for building inspections is that the inspector waits until after the work is done and then inspects the work, but that's a validation of the result rather than the procedures. The equivalent for code is an audit, which is dramatically more labor intensive for the government than sending someone to have a quick look to see if the wires appear to be hooked up right, if you expect it to actually do anything.
> I think the problem here is there's too many armchair experts saying "Can't be done" when they don't know what they're talking about
There are too many armchair experts saying "if they can land a man on the moon then surely they can land a man on the sun."
> That's not the way it is in the trades, in medicine, in law, and those folks actually have more to think about than software engineers, and more restrictions
First notice that you're listing all the professions where costs are out of control and the incumbents have captured the regulators to limit supply.
On top of that, those regulations are not even effective in solving the analogous problem. For example, the ethical requirements for lawyers nominally require them to do the thing public defenders aren't provided with the ability to do, i.e. spend enough time on the case to give the client adequate representation. Public defenders are given more clients by the state than they have the resources to actually represent. Quite unsurprisingly, this utterly fails to solve the problem of indigent defendants not having adequate representation.
But that's the thing most analogous to what you're proposing. If you nominally require companies to do something they otherwise have no real incentive to do, which you have no efficient way of verifying that they've done, and provide them no additional resources to do it, you can't expect "they will now do it well" to be the result.
> I think SWEs are just trying to get out of doing work and claiming it's too difficult, and the industry doesn't want to stop the free ride of lack of accountability it's had for decades.
What makes you think the software developers are the ones objecting to it? They, and the incumbent companies trying to raise costs on smaller upstarts, are the ones trying to establish a new racket and exclude newcomers from the industry. The ones objecting are the customers, and anyone who values efficiency and efficacy.
> We need to stop screwing around and create the software building code, before the government does it for us.
"We need to stop screwing around and create the Torment Nexus, before the government does it for us."
The Space Shuttle sure blew up a lot for something with that much process applied.
Many of these devices have security flaws that are horrific and out of best practices by over a decade.
Just having something like "Have a bonded 3rd party security team review the source code and running router software" would solve around 95% of the stupid things they do.
It would certainly help, but no economically feasible amount of auditing and best practices could lead to having a warranty on that software. My thesis is that our current understanding of software is fundamentally weaker than that of practical applications of electricity, so it makes no sense to present analogies between the two.
Are you familiar with how the actual electrical code works? It's a racket. The code is quite long and most of the inspectors don't know most of it so only a small subset is ever actually checked, and that only in the places where the person doing the work is actually pulling permits and the local inspector isn't corrupt or lax in areas the local tradespeople have learned that they're lax. Then we purposely limit the supply of licensed electricians so that they're expensive enough that ordinary people can't afford one, so that handyman from Craigslist or whatever, who isn't even allowed to pull permits, is the one who ends up doing the work.
It only basically works because no one has the incentive to purposely burn down your house and then it only happens in the cases where the numerous violations turned out to actually matter, which is rare enough for people to not get too upset about it.
But the thing that makes it a racket is the making the official process expensive on purpose to milk wealthy homeowners and corporations who actually use the official process, which is the same thing that drives common people to someone who charges a price they can afford even knowing that then there no inspection.
> Then that kind person can inform the company of the bad wiring.
The point is rather that when the homeowner discovers that their microwave outlet is heating up, they can fix it themselves or hire an independent professional to do it instead of the company that built the house (which may or may not even still exist) being the only one who can feasibly cause it to not stay like that until the house is on fire.
Trying to make analogies from software to hardware will always fall down on that point. If you want to argue that there should be stricter security & correctness requirements for routers, maybe look more toward "here is how people actually treat them in practice" with regard to ignoring updates...?
As in my example, some random stranger needs to first find out your "house" (the vendor's software) is wired wrong. And this needs to happen for every "house" (every piece of software). While waiting for this to be discovered, your house burns down (hackers penetrate millions of devices, or perhaps just Microsoft Sharepoint that the govt is uses).
Those standards aren’t related to the functionality or security of the router.
Jokes aside, there's so much low-hanging fruit in IoT it's utterly ridiculous. Having any standards at all would be an improvement.
Maybe I'm being an idiot but it seems like a lot of extra complexity to protect against really only physical attacks where someone directly steals the data storage.
Yes, physical access poses a significant risk to data security, it should not be ignored.
(That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)
[1]: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
Here, we're discussing product as shipped, not product intercepted and modified. We're discussing if products are shipped secure or not.
The Snowden disclosures are important, but not relevant in this case.
Maybe in theory. I think the practical chance of enforcing anything meaningful through those legal avenues against a US manufacturer is not meaningfully higher than the chance of doing so against a Chinese manufacturer, so it doesn't make sense to treat them differently on these grounds.
Literally your own Congress is not even allowed to review their budget! Not that any US politician even WANTS to know.
Oh, sweet summer child. Disclaiming these possible avenues of liability is the main goal of clickwrap "terms of service".
No, I don't have it but you may check with Santa Claus.
I'm also saying that because in reality there is no funding for it, American routers will end up like the US shipbuilding industry, using protectionist policies as an excuse to stay decades behind the times and produce nothing.
I don’t think that’s true.
> American routers will end up like the US shipbuilding industry, using protectionist policies as an excuse to stay decades behind the times
I agree.
This is already the case today with many embedded devices. They have secure boot enabled so even if the vendor releases the GPL source code (big if), you can't do anything because the device will only boot the vendor's signed firmware.
> at a minimum I think there should be a wifi card that does refuse modifications and a main application processor that is 100% user controlled so that they can actually fix problems without needing the vendor to help
This is already possible. The RF components frequently have a signed firmware blob that is verified on load. There is no reason but planned obsolescence and greed keeping the application processor locked to running the vendor's signed code.
That sounds like what Software Freedom Conservancy would call a GPL violation:
https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...
Sure, it is. So what? Have you got 200k for lawyers and years of your life to spend in court fighting over it?
I have personally contacted the SFC with ample evidence of deliberate and wilful GPL violations, such as providing a written offer for source code and then ignoring or flat out refusing requests for the source code. The SFC has acknowledged the vendors are violating the spirit and letter of the GPL.
Nothing happens. The SFC is one organisation with limited resources, FOSS developers don't want to spend their time in court, they'd rather develop software. Vendors know 9 times out of 10 they will get away with the GPL violation scot-free.
It's fine to put on your rose colored glasses and pretend GPL forces companies to release source code. Reality is, the vendors have a larger marketing budget than the entire SFC endowment and the vendor's legal team is happy to tar-pit requests ad infinitum.
I get the desire to not have to trust a third party, but realistically, there isn't a way to function without doing so, outside of going out and living in the forest in a cabin you've built yourself, either doing without electricity, or with solar panels you've built yourself from raw materials.
Human processes aren't like computers. They're messy. They fail sometimes. They need checks and balances. Sometimes those checks and balances don't work. Sometimes the checks only work well after the fact, and the people who were harmed aren't all made whole.
That's life. We probably can't do much better.
Detection of the car being on a rolling road, special button combos that trigger the emissions testing map, etc
That "genericness" is what's missing in the router space. Literally every consumer router that comes out has some super proprietary design that's meant to be replaced in its entirety in 3-4 years. Many can run Linux, sure, but how many have a replaceable/upgradable board? How many are like a PC where you can install whatever OS you want?
Sure, you can forcibly flash a new OS (e.g. OpenWRT) but that is a hack. The company lets you do that because they figure they'll get a bit more market share out of their products if they don't lock the firmware so much. They key point remains, however: They're not just hardware—even though they should be!
The world of consumer routers needs a PC-like architecture change. You can buy routers from companies like Banana Pi and Microtik like this but they're not marketed towards every-day consumers. Mostly because they're considered "too premium" and require too much expertise to setup.
I think there's a huge hole in the market for consumer-minded routers that run hardware like the Banana Pi R4 (which I have). When you buy it, you get the board and nothing else. It's up to you to get a case and install an OS on it (with OpenWRT, Debian, and Ubuntu being the normal options).
We need something like the Framework laptop for routers. Not from a, "it has interchangeable parts" perspective but from a marketing perspective. Normal people are buying Framework laptops because geeky friends and colleagues recommend them and they're not that much more expensive/troublesome than say, a cheap Acer/Asus laptop.
This is the most thoughtful comment I've seen on this topic. I hadn't even considered this approach, but you're right. The hardware needs to be commoditized in a way that makes the software a layer that can be replaced. Someone else said this but in a way that described flashing a third-party package as HN nerds would. That's too much effort and it won't work.
It should be as generic as PC hardware. Every router manufacturer should build devices that can run the OSes of all their competitors' devices and vice versa. Maybe some features won't work with the other company's OS cause it isn't designed for that, but overall it ought to be replaceable. "Normal people" still wouldn't flash a new OS, but making it an option is a step towards making devices more secure.
If every router could get a new OS as easily as your techy friend could install Firefox or an ad-blocker or whatever else, we'd start the long march to a real longterm solution.
Or they could just run an existing open source OS, like openwrt.
i will allow sunsetting and removing ipv4 after 2020 (that is more that 5 years ago)
Usually the argument is that X can't be made in the US because China's so good at it that the US could never compete, so we shouldn't even try. But if a company with 367 employees in a country with the population of a medium-size metro area can do it, it proves that argument is bunk.
A decade of security updates for routers would require stable isolation between low-level device security and IoT vendor userspace. In Sphere, the business model for 10 years of paid updates was backed by hardware isolation. Anyone know why it didn't get market traction? There was a dev board, but no products shipped.
Oh gee. Maybe because no one sane looks at an industrial product adversarially built to confine and prevent the end user from doing anything to it and wants anything to do with it? It isn't rocket science. If I can't buy it and get a damn manual and programming tools to twiddle all the bits, I'm not adopting. Not even at gunpoint, or if you're the last supplier on Earth. I won't be held voluntarily hostage because a bunch of corporate types, and bureaucrats decided to work together to normalize adversarial silicon. Multiply by everyone I know, and anyone with enough braincells to rub together to pattern match "regulatory capture" and "capitalist rent seeking". You can call me a bore if you want. The incentives are completely unaligned, as this place is so fond of saying. End user adoption is built on faith in product. End user capacity to have faith in the product is based on the capability of the technically savvy purchaser to keep the thing running, repair, understand, and explain it to the non-technically savvy. I look at adversarial silicon isolating me from the hardware; I have to sound off-my-rocker to my non tech-savvy friends family to actually explain that yes, there are industrial cabals out to keep you from doing things with the thing you bought.
It doesn't make any business sense, or practical sense whatsoever. Don't bother quoting regulations that demand the isolation (baseband processors and radio emission regulations) at me. Yeah. I know. I've read those too.
Get over business models that require normalized game theory, and we can talk. Until then, enjoy never having nice things catch on. Hint: your definition of "nice" (where I can't control how it works after purchase) is mutually exclusive with things I'm willing to syndicate as "nice". Nice people don't manipulate others.
This article is a good example: https://archive.is/RAZMJ
Apple, with all their resources, couldn’t even get American screws. Now, if they really wanted to, they could have spun up their own screw manufacturing, eventually. But for a router, you need a lot more than screws. Resistors, capacitors, PCBs, plastics, all the secondary and tertiary industries for the materials behind those--it would probably take decades and trillions of dollars.
I had to verify that OpenWRT was compatible when I bought it _to be a backup_. Re-read what I said about everything being commodity hardware that can run any other device firmware / OS.
The difficulty of installing OpenWRT or Linux in general on hardware comes from that hardware not being documented, or not having straightforward APIs like BIOS/EFI.
Or for some devices, community distributions that dubiously remix manufacturer-supplied binaries are available. But we generally see that as soon as the manufacturer stops their updates, the community versions start lagging behind as well.
Oh, no, not this again!
> But we generally see that as soon as the manufacturer stops their updates, the community versions start lagging behind as well.
Care to demonstrate that?
The reason OpenWrt abandoned most routers was
1) insufficient flash space in the kernel partition, or insufficient total flash space in no-USB, no-SPI routers,
2) unwillingness to repartition flash because it breaks compatibility with official firmware (as if anyone installing OpenWrt would care),
3) insufficient RAM to run newer kernels
and, most importantly,
4) unwillingness to support older kernels like DD-WRT does.
What are you referring to? Would you not say there is a difference between OpenWRT having to make a list of supported whole systems, whereas an amd64 Linux distribution making a list of chipsets? I can go buy an off the shelf laptop, stick a generic "Linux install" USB in it, and be reasonably certain most things are going to work. Whereas OpenWrt I have to look at their list of supported machines, and buy exactly that one, even down to the hardware rev. Some of this is due to embedded constraints, but a good chunk is also due to the lack of hardware discoverability.
>> community distributions that dubiously remix manufacturer-supplied binaries are available
> The reason OpenWrt abandoned most routers was
I didn't mean things like OpenWrt, which I'd say is a general Linux distribution that does contortions to fit on specific devices. Rather I was talking about things like Valetudo which are closer to rooting the stock distribution with some tweaks, or the countless "custom ROMs" you see (saw?) in the phone world which are effectively remixing the manufacturer images. I thought DD-WRT was in that camp, especially for many devices (eg where do these "older kernels" come from?), but I'm hazy on that.
(personally I gave on up OpenWrt some 10 years back, and just use generic Linux (NixOS) on amd64. A VM on my server for the router, and lower-power amd64 boards for the additional APs (most of which double as Kodi terminals))
Hence the isolated device security hardware should be an open standard with FRAND licensing. If devices ship with a prepaid commercial license for 10 years of device security updates from BIG_CO, the default commercial baseline would be raised independent of IoT vendors. Tech-savvy users could then have the option to replace the device security layer with the OSS _or_ competing commercial stack of their choice.
Assembling them in Latvia, or the US, from internationally sourced components isn't a solution to anything.
> Usually the argument is that X can't be made in the US because China's so good at it that the US could never compete, so we shouldn't even try. But if a company with 367 employees in a country with the population of a medium-size metro area can do it, it proves that argument is bunk.
Unless Latvia is a much better environment for this kind of industry than the US is.
I disagree. It's the first step. I mean, how did China do it? They started with assembly and low-value manufacturing and worked their way up the value chain. The US still had fabs. Once you get assembly reshored, start pushing to to reshore components (which are mostly chips, and pretty soon the equipment is mostly domestic.
> Unless Latvia is a much better environment for this kind of industry than the US is.
In what way?
Even if the US is utterly terrible for this kind of industry, we're talking about a small-medium sized tech company. It seems extremely doable.
If the SFC lawsuit against Vizio succeeds, then there will be another option; since yourself and others are third-party beneficiaries of the contract embodied in the GPL between Linux kernel developers and hardware vendors that ship Linux; start a class action with other users of the hardware where GPL violations are present, and sue for GPL compliance instead of money. The lawyers will get their legal costs presumably and the users should get source code. Probably some law firms would take this on just for the legal costs, especially if the Vizio precedent makes it easy to win future cases.
https://sfconservancy.org/copyleft-compliance/vizio.html
PS: I don't think SFC have an endowment, they are just directly funded by people who support their goals.
Oh, God, I have to repeat it again.
That's because of x86 standards for APICs, keyboard controllers, USB controllers, framebuffer addresses, PnP buses, storage controllers, etc. It has nothing to do with the BIOS, and has even less to do with UEFI, since it removed standard BIOS real mode interrupts (UEFI CSM).
ARM's only standard is CPU instructions. Each chip has different peripherals and each one needs a different driver. ARMv7 didn't even have a standardized timer! How can you expect to run anything without knowing where's the timer? UEFI and ACPI tries to patch it up with software, but the device tree is a better alternative because it can be updated, bug fixed and extended by the end users.
Let me give you a real example, something I did last week:
I have a Radxa Rock 5 ITX. The M.2 E-key slot has PCIe lines but no separate line for eSATA (the E-key doesn't have those). But the CPU has a mux that can switch those PCIe lines into SATA lines. It's in the device tree. Radxa makes a passive SATA adapter for the E-key slot (I bought it), but it doesn't switch the mux by itself.
Rockchip uses device tree. The mux is in there. Radxa didn't write an overlay for the device tree to switch the mux into SATA mode. I wrote that myself. It's a simple PCIe status="disabled" / SATA status="okay".
If Rockchip used UEFI instead of device tree, there would be absolutely nothing I could do if Radxa didn't explicitly add a setting for this mode change. And if they didn't write an overlay as simple as that, I very much doubt they would implement in UEFI.
I couldn't make sense of the second portion of your reply. What are you saying? That is preferable to be able to update a crap OEM distro instead of completely replacing it with something that is derived from mainline Linux kernel and ordinary Linux userspace?
OpenWrt only does "contortions" because routers have various ethernet and wifi configurations. Some have an oboard switch, some don't, some have WAN / LAN ethernet ports, some only have WAN and wifi. They're going very much towards standardization, not "contortions".
DD-WRT doesn't take anything from the original firmware, well... maybe some blobs. AFAIK (I didn't use it much), the old kernels are official Linux kernels. They're just older versions that still work with drivers and blobs that were abandoned and no longer updated by the OEM.
Having state actors redirecting products after shipping, without telling the company or the client it's happening, and installing backdoors, has nothing at all to do with backdoors from manufacturers.
>a foreign nation state would pressure a manufacturer in their jurisdiction to include a backdoor
That absolutely is about jurisdiction and is a much bigger, more scalable attack than intercepting and installing implants. More to the point, it can be done at _any time_ not just the initial ship.
> If US manufacturers (or manufacturers in allied countries) do this, legal avenues exist to hold those manufacturers accountable.
With that context added, my point is that the US judicial system would never litigate against e.g. Cisco if they were involved. The issue is not the relation between the state and Cisco, it's the relation between the US justice system and the US national security apparatus that prevents any such litigation to happen.
Some trust has to be created through testing standards and the law, but generally we do believe what the label says in day to day life.
I'd suggest neither matter in the face of how the problem is solved in the consumer cards the OP was talking about. They solve it by locking down the firmware that controls the radios.
The reality is most routers do that too. You can replace the firmware in most of them with OpenWRT or something similar. You still can't exceed regulatory limits because of the signed blobs of firmware in the radios.
Nonetheless, here we are getting comments like yours, which imply all firmware in the device must be behind a proprietary wall because a relatively small blob of firmware in them must be protected. It has its own protections. It doesn't need to be protected by the OS or the application that runs on top of it.
Yet it's in those applications where most of the vulnerabilities show up. Making them consumer replaceable would help in solving the problem. Protecting the firmware is not a good reason to not do it.
We don't have to look far. The embedded space with Arduinos, ESP32s and even RPis is a hacker's paradise. Yet the radio stack is restricted in all of them. For instance, it's not possible to take an ESP32 board and turn it's single antenna into a MIMO configuration, even if you make a custom PCB with trace antennas.
sure, but again, why would the RF transceiver on my desktop PC or in my laptop be any different than the one in my router?