Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FCC updates covered list to include foreign-made consumer routers

fcc.gov

Post reply on HN
Print view View original

191–200 of 452 posts

Re: FCC updates covered list to include foreign-made consumer routers

#191

Post by dmonitor »

protocolture wrote: post #61
mrsssnake wrote: post #56

What is a router? Really, do they have a definition?

Device that connects multiple networks? Layer 3 of the OSI model? Consumer ones tend to have more than that, but the more specific definition would work fine. Yeah conceivably you could use this to ban any network device that is capable of routing between interfaces, so lots of switches with new firmware could do it, often terribly, as well as PCs with multiple interfaces. But its probably going to involve intention.

Any PC with a NIC is one VLAN and masquerade rule away from being a router

Re: FCC updates covered list to include foreign-made consumer routers

#192

Post by kelnos »

dmitrygr wrote: post #124
Snafuh wrote: post #58

Earlier quoted context omitted.

Do you apply the same scrutiny to the food you eat? Some trust has to be created through testing standards and the law, but generally we do believe what the label says in day to day life.

In so far as I cook myself? Yes

So you personally test your produce to ensure it's safe to eat, has no pesticides embedded in it that could harm you, etc.? You do that after every single trip to the grocery store or farmer's market? Every trip? You don't spot check, and assume/hope/trust that the ones you don't test are safe?

Re: FCC updates covered list to include foreign-made consumer routers

#193

Post by dmonitor »

walterbell wrote: post #173
reverius42 wrote: post #171

Earlier quoted context omitted.

All routers ship with software. (edit: and RAM!) (edit: and NOT multiple video outputs!!)

x86 multi NIC barebone fanless PC is not for routing, nope.

Who said anything about multiple NICs? Ethernet port and Wifi modem in AP mode are more than enough

Re: FCC updates covered list to include foreign-made consumer routers

#194

Post by kelnos »

dmitrygr wrote: post #27
WarOnPrivacy wrote: post #15

Earlier quoted context omitted.

> how do you prove the firmware in the flash chip matches source? Trusted, qualified independent experts: Ala Underwriters Laboratories.

One word for you: dieselgate https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal

A process not working on occasion doesn't mean the entire verification method is garbage.

I get the desire to not have to trust a third party, but realistically, there isn't a way to function without doing so, outside of going out and living in the forest in a cabin you've built yourself, either doing without electricity, or with solar panels you've built yourself from raw materials.

Human processes aren't like computers. They're messy. They fail sometimes. They need checks and balances. Sometimes those checks and balances don't work. Sometimes the checks only work well after the fact, and the people who were harmed aren't all made whole.

That's life. We probably can't do much better.

Re: FCC updates covered list to include foreign-made consumer routers

#195

Post by crote »

RobotToaster wrote: post #116
AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

>The problem is that "secure firmware" is a relativistic statement. No it isn't, software formally verified to EAL7 is guaranteed to be secure.

Sure, you formally verified that the software confirms to the specification, but how are you going to prove that the specification is correct?

Re: FCC updates covered list to include foreign-made consumer routers

#196

Post by compounding_it »

As someone who works with networking (consumer prosumer enterprise everything) the problem is far more complex than : make it open.

Manufacturers can support devices for long but it costs money which the consumers / businesses aren’t willing to pay or value. Cybersecurity is a joke and the general consensus is : we will pay for things as and when there is a fire. We don’t put a price on prevention because we can’t really show it to shareholders how we profited from not being attacked since we blocked those. So we create an arbitrary certification and pass things according to it. This certification doesn’t say anything about firmware. But if we do get attacked then we can convince the shareholders to spend money on better equipment this financial year and then not bother until the next time we have a problem.

Some of these certifications focus on what the devices allow you to do (like acls and firewalls) and see if they pass these tests. But actually looking at the firmware and finding vulnerabilities is not in scope.

Re: FCC updates covered list to include foreign-made consumer routers

#197

Post by palmotea »

1over137 wrote: post #157
longislandguido wrote: post #34

Earlier quoted context omitted.

But most are still made in Latvia.

Which is still foreign from the USA's perspective. Remember, this new rule is not just against China, but against all foreign-made.

But the fact that a company can manufacture consumer(ish) routers in Latvia means it's very practical that another company could manufacture consumer routers in the US.

Usually the argument is that X can't be made in the US because China's so good at it that the US could never compete, so we shouldn't even try. But if a company with 367 employees in a country with the population of a medium-size metro area can do it, it proves that argument is bunk.

Re: FCC updates covered list to include foreign-made consumer routers

#198

Post by flowerthoughts »

The escalation path is probably: have some relationship to an entity that doesn't care about you -> make sure that entity becomes your enemy -> the enemy now has an incentive to see you as an enemy -> you must now be afraid of your new enemy.

Re: FCC updates covered list to include foreign-made consumer routers

#199

Post by 0xbadcafebee »

AnthonyMouse wrote: post #70
WarOnPrivacy wrote: post #7

The FCC maintains a list of equipment and services (Covered List) that have been determined to “pose an unacceptable risk to the national security Recently, malicious state and non-state sponsored cyber attackers have increasingly leveraged the vulnerabilities in small and home office routers produced abroad to carry out direct attacks against American civilians in their homes. Vulnerabilities have nothing to do with…

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

> What you need is not a government mandate for infallibility, it's updates

So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring.

And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month another kind soul finds more bad wiring. And we just have to hope there is an army of kind strangers out there checking every building built by every company. And hope in the meantime that the building doesn't burn down.

Meanwhile, people have to live with bad wiring for years, that could have been completely prevented to begin with, by an electrician following the electrical code we all already agree on.

Re: FCC updates covered list to include foreign-made consumer routers

#200

Post by blemasle »

Does it occurs to someone that in this time of encryption backdoor and such, this is also a good starting point to another mass surveillance system ? Mandate US manufacturers to embed remote access for the use of the government, then as you've made those routers the only ones authorized on the us soil (let's not be foolish about that approval process, it will be a smoke screen) you basically have a backdoor to every citizen home.

Yes china routers are a liability, but free trade and open market ensure at least one thing that's essential : no single state has surveillance capability on its entire population

Post reply on HN