Ask HN: Why does it seem hard to buy an ONT for fiber?

I'm in Poland. When I had fiber installed I asked the provider if they could install an ONT. They balked a bit but eventually relented. They provided their own ONT at no extra cost. Orange is the provider, in case anyone is interested.

It's up to the discretion of the installer. I think being able to speak in technical terms and provide a decent argument convinced the installer. I got a feeling that they don't generally do it because for most people, the Orange FunBox is a good enough solution.

> I don't trust my ISP to handle my personal information with discretion

I'll start off by saying I'm not a fan of being forced to use their gateway. It's essentially just superfluous equipment in my network closet and another point of failure in the chain. I'd rather just be able to reliably patch directly in, but such is life.

That said, there's no loss of privacy with the gateway in bridge mode and me patching directly in. In the end they see whatever I expose on my router and they see all my packets. There's no functional difference privacy-wise here, unless they've got microphones or something on the gateway. Maybe they're sniffing wifi, but so can a car driving by.

FWIW, AT&T does this because AT&T does what AT&T does. They were doing it back in the day with their DSL service as well. There's a little more compatibility challenges when it comes to PONs versus DOCSIS modems, but theoretically one could buy an ONT and have it participate on the network. The actual ONT is just a media converter though, and without AT&T's gateway to auth you properly you're not going to be able to send any traffic.

As mentioned elsewhere though, I've been using AT&T's service for a long time. I've never had a modem rental line item in my bill.

The ONT's job is to translate from (typically) Ethernet to the optical fibre, and nothing else. In networking terms its "Level 1"; concerned only with moving bits from one end to the other. Most ISPs will provide an ONT which does that and nothing else, and then a regular router/firewall that plugs in to the ONT via Ethernet.

Your security barrier is the firewall in the router, plus whatever encryption you apply to comms outside it. As long as you get that right your ISP can't see what you are doing apart from the to/from addresses on your packets (which can't be hidden, obviously).

ISPs generally push their own managed router/firewall at you because that way when something isn't working you don't wind up with arguments about who's fault it is, and the ISP can troubleshoot your router. But in my experience they have no problem with you unplugging their device and plugging your own in instead.

I haven't seen an ISP which does the ONT and the router in a single box. Its theoretically possible, but would be a bad idea for several reasons. One is security, as you say. Another is that the fibre can't be extended with more wire, unlike a copper phone line. So the ONT tends to be a small wall-mounted box with an Ethernet jack in it. That way your Wifi access point isn't stuck low down next to your front door or something.

The same can be said of cellular networks where in most part of the world connecting your own equipment is accepted and expected.

If their ONT and gateway are a single device it's not the BGW210. AT&T has been rolling out a newer gateway for over a year now.