Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FCC updates covered list to include foreign-made consumer routers

fcc.gov

Post reply on HN
Print view View original

101–110 of 452 posts

Re: FCC updates covered list to include foreign-made consumer routers

#101

Post by bombcar »

clcaev wrote: post #25
WarOnPrivacy wrote: post #11

If we wanted secure products, we wouldn't ban devices. We'd mandate they open their firmware to audits.

It'd be great if open firmware could be commercially viable. Finding a business model is hard. The OpenWRT One [1] sponsored by the Software Conservancy [2] and manufactured by Banana Pi [3] works lovely. [1] https://openwrt.org/toh/openwrt/one [2] https://sfconservancy.org/activities/openwrt-one.html [3] https://docs.banana-pi.org/en/OpenWRT-One/BananaPi_OpenWRT-O...

Just declare that any router that can be flashed to OpenWRT without loss of functionality is allowed to be imported.

Re: FCC updates covered list to include foreign-made consumer routers

#102

Post by AnthonyMouse »

catlikesshrimp wrote: post #98
AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

Somebody has to pay for the support. There is no free meal. Enterprise must be able to pay for support for as long as they use devices. Solved. I can only think of requiring the devices to be serviceable, as you say. The absolute only way I can think of charging the consumers, ie the owners, is to charge a tax on internet connections. Then the government would pay somehow vulnerability hunters working along patchers,…

> Somebody has to pay for the support. There is no free meal.

The problem is not that people need a free meal. The problem is that people need the ability to eat some other food when the OEM's restaurant is closed or unsatisfactory.

Re: FCC updates covered list to include foreign-made consumer routers

#103

Post by malcolmgreaves »

Someone1234 wrote: post #10

Considering this is after Loper Bright Enterprises v. Raimondo (2024), it will be interesting to see if this holds up to judicial scrutiny. The FCC's power just got substantially nerfed, and "we've decided to slow lane all foreign-made routers" feels like that may have been beaten on the old, higher, standard. Let alone the new one that gives the FCC almost no power.

Nerfed to do their job. The corrupt republican Supreme Court judges are very happy to give more power to the executive to collect bribes, however.

Re: FCC updates covered list to include foreign-made consumer routers

#104

Post by sam345 »

danso wrote: post #30
sam345 wrote: post #19

If you actually read the notice, it exempts models that have been approved. So this just seems to require approvals by DOH or DHS ,": Routers^ produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS." I take this to mean it is just adding security approvals for this type of thing to DOw and DHS. It is not a ban of all future models. It's just saying explicitly that i…

Why shouldn’t people have a reaction to a policy that mandates a new approval process on a large class of consumer products?

It's fine to have a reaction. It just rhat a lot of the comments totally ignored this this caveat. So basically, as I read it by default, they're banned unless approved, which is pretty much what all regulation does anyway, isn't it.

Re: FCC updates covered list to include foreign-made consumer routers

#105

Post by ryandrake »

OneLeggedCat wrote: post #50
adrianmonk wrote: post #23

This part of the press release seems pretty crucial: > Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. In other words, foreign-made consumer routers are banned by default. But if you are a manufacturer, you can apply to get unbanned ("Conditional Approval"). In the FAQ ( https://www.fcc.gov/faqs-recent-updates-fcc-covered-list…

> foreign-made consumer routers can still be sold, but they are going to look at them with a fine-tooth comb, and they are going to use FCC approval as leverage to try to increase domestic manufacturing That is not what's going to happen. What's going to happen is that anyone coughing up payola to the current executive in chief's people will get approved, and anyone that doesn't will remain blocked. This practice is…

We're going to keep seeing this in all kinds of industries throughout the next three or so years: "Your products are banned or your country is tariffed, but if you pay enough in bribes, er I mean undergo our approval process, then you'll be exempt."

Re: FCC updates covered list to include foreign-made consumer routers

#106

Post by yjftsjthsd-h »

vetrom wrote: post #60
WarOnPrivacy wrote: post #11

If we wanted secure products, we wouldn't ban devices. We'd mandate they open their firmware to audits.

You will first probably need Congress to legislate away the long standing prohibitions against offering (easily) user-modifiable RF devices on the market. Self ownership and full 'right to repair' has carve-outs in the FCC's regulations in the name of limiting unintentional broadcasting/radiation. Maybe a challenge to those would survive in the post-Chevron environment. I wouldn't expect any Congress in the last 25 y…

I dunno, I'm pretty big on FOSS but I don't think you would need that to improve. Requiring that the firmware have its source code available to audit doesn't mean that users can replace it. AFAIK you could, today, with no legal changes, have a vendor release 100% of the code under eg. a MIT license while also making the device refuse to run firmware not signed with their keys. Researchers could poke at it to find bugs, and FCC regulations wouldn't be touched. (Note: IANAL, so feel free to point out if I'm wrong about that)

(To be clear, I don't think that's good enough; at a minimum I think there should be a wifi card that does refuse modifications and a main application processor that is 100% user controlled so that they can actually fix problems without needing the vendor to help, but I think it's useful to point out that auditing code doesn't require being able to install it)

Re: FCC updates covered list to include foreign-made consumer routers

#108

Post by rpcope1 »

What exactly does "produced" mean in this context? That the final assembly was done here, software was written here, PCB was assembled here, SoCs and ICs wwre manufactured here, or something else? Regardless, while consumer routers are 9 of 10 times insecure garbage, it's hard to think of any that aren't manufactured outside the US.
Post reply on HN