FCC updates covered list to include foreign-made consumer routers • Hacker News Board

Re: FCC updates covered list to include foreign-made consumer routers

#201

Post by 0xbadcafebee » Tue, Mar 24, 2026, 7:16 AM UTC

pocksuppet wrote: post #113

clcaev wrote: post #25

Earlier quoted context omitted.

It'd be great if open firmware could be commercially viable. Finding a business model is hard. The OpenWRT One [1] sponsored by the Software Conservancy [2] and manufactured by Banana Pi [3] works lovely. [1] https://openwrt.org/toh/openwrt/one [2] https://sfconservancy.org/activities/openwrt-one.html [3] https://docs.banana-pi.org/en/OpenWRT-One/BananaPi_OpenWRT-O...

Open to audits doesn't mean free software, it just means visible source. The business model for selling routers with auditable firmware is selling routers.

And the public doesn't have to audit it. The govt already audits/inspects/validates plenty of sensitive physical products, typically through 3rd party industry associations. You don't get to peek inside, but people signing NDAs do.

Even if this wasn't done, at the very least they must publish their software testing procedures, the way UL, ETL, and CSA require to certify devices for the US power grid. (https://www.komaspec.com/about-us/blog/ul-etl-csa-certificat...) They can also do black box testing.

But ideally they would actually inspect the software to ensure its design is correct. Otherwise vibe-coded apps with swiss cheese code will be running critical infrastructure and nobody will know until it's too late.

Re: FCC updates covered list to include foreign-made consumer routers

#202

Post by pabs3 » Tue, Mar 24, 2026, 7:20 AM UTC

kogepathic wrote: post #190

yjftsjthsd-h wrote: post #106

Earlier quoted context omitted.

I dunno, I'm pretty big on FOSS but I don't think you would need that to improve. Requiring that the firmware have its source code available to audit doesn't mean that users can replace it. AFAIK you could, today, with no legal changes, have a vendor release 100% of the code under eg. a MIT license while also making the device refuse to run firmware not signed with their keys. Researchers could poke at it to find bug…

> AFAIK you could, today, with no legal changes, have a vendor release 100% of the code under eg. a MIT license while also making the device refuse to run firmware not signed with their keys. This is already the case today with many embedded devices. They have secure boot enabled so even if the vendor releases the GPL source code (big if), you can't do anything because the device will only boot the vendor's signed fi…

> the device will only boot the vendor's signed firmware

That sounds like what Software Freedom Conservancy would call a GPL violation:

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...

Re: FCC updates covered list to include foreign-made consumer routers

#203

Post by steve_gh » Tue, Mar 24, 2026, 7:27 AM UTC

kelnos wrote: post #184

AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

> But then vendors want to stop issuing them after 3 years Tough shit. You provide updates for the mandated amount of time, or you lose access to the market. No warnings, you're just done. > And "require longer support" doesn't fix it because many of the vendors will go out of business. Source code escrow plus a bond. The bond is set at a level where a third party can pay engineers to maintain the software and distri…

How does this help? 99% of the population aren't technically minded enough. Most people just buy a wifi router, plug it in (maybe having read the instructions) and that's it. They have neither the skills nor the inclination to update firmware.

The real problem is: assuming that firmware can be updated, how do you run a nationwide update programme overcoming a population that doesn't really care or have the skills to do it.

Vehicle safety standards (mandated annual safety checks like the UK MoT test) is the closest analogy I can think of - in the UK you can't insure your car without a valid MoT. If you were serious, then maybe tying ISP access to updated router firmware would be the way to go.

Re: FCC updates covered list to include foreign-made consumer routers

#204

Post by m01 » Tue, Mar 24, 2026, 7:27 AM UTC

clcaev wrote: post #25

WarOnPrivacy wrote: post #11

If we wanted secure products, we wouldn't ban devices. We'd mandate they open their firmware to audits.

It'd be great if open firmware could be commercially viable. Finding a business model is hard. The OpenWRT One [1] sponsored by the Software Conservancy [2] and manufactured by Banana Pi [3] works lovely. [1] https://openwrt.org/toh/openwrt/one [2] https://sfconservancy.org/activities/openwrt-one.html [3] https://docs.banana-pi.org/en/OpenWRT-One/BananaPi_OpenWRT-O...

There's also Turris from cz.nic [1]. Technically they use a fork of OpenWRT with some convenience features like auto-updates, although it looks like you can run OpenWRT on (some of their routers?) if you wanted to [2].

[1] https://www.turris.com

[2] https://openwrt.org/toh/turris/turris_omnia

Re: FCC updates covered list to include foreign-made consumer routers

#205

Post by kogepathic » Tue, Mar 24, 2026, 7:31 AM UTC

pabs3 wrote: post #202

kogepathic wrote: post #190

Earlier quoted context omitted.

> AFAIK you could, today, with no legal changes, have a vendor release 100% of the code under eg. a MIT license while also making the device refuse to run firmware not signed with their keys. This is already the case today with many embedded devices. They have secure boot enabled so even if the vendor releases the GPL source code (big if), you can't do anything because the device will only boot the vendor's signed fi…

> the device will only boot the vendor's signed firmware That sounds like what Software Freedom Conservancy would call a GPL violation: https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...

> That sounds like what Software Freedom Conservancy would call a GPL violation

Sure, it is. So what? Have you got 200k for lawyers and years of your life to spend in court fighting over it?

I have personally contacted the SFC with ample evidence of deliberate and wilful GPL violations, such as providing a written offer for source code and then ignoring or flat out refusing requests for the source code. The SFC has acknowledged the vendors are violating the spirit and letter of the GPL.

Nothing happens. The SFC is one organisation with limited resources, FOSS developers don't want to spend their time in court, they'd rather develop software. Vendors know 9 times out of 10 they will get away with the GPL violation scot-free.

It's fine to put on your rose colored glasses and pretend GPL forces companies to release source code. Reality is, the vendors have a larger marketing budget than the entire SFC endowment and the vendor's legal team is happy to tar-pit requests ad infinitum.

Re: FCC updates covered list to include foreign-made consumer routers

#206

Post by danaris » Tue, Mar 24, 2026, 7:39 AM UTC

0xbadcafebee wrote: post #199

AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

> What you need is not a government mandate for infallibility, it's updates So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring. And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month ano…

I mean, if you could download an update that would fix the wiring in your house, it would be much less critical that the initial installer got it right. (Still much more important than your router, though; it doesn't stop being an electrocution hazard during the un-updated period.)

Trying to make analogies from software to hardware will always fall down on that point. If you want to argue that there should be stricter security & correctness requirements for routers, maybe look more toward "here is how people actually treat them in practice" with regard to ignoring updates...?

Re: FCC updates covered list to include foreign-made consumer routers

#207

Post by inejge » Tue, Mar 24, 2026, 7:39 AM UTC

0xbadcafebee wrote: post #199

AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

> What you need is not a government mandate for infallibility, it's updates So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring. And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month ano…

> So, we don't need an electrical code to enforce correct wiring.

For an analogy to work, its underlying elements should have a relation to the target. Your analogy is not in the same universe. For electrical work, there is a baseline of materials and practices which is known to produce acceptable results if adhered to. For software, there isn't. (Don't tell me about the Space Shuttle. Consumer software doesn't cost tens of millions and isn't written with dedicated teams over the decades.)

Re: FCC updates covered list to include foreign-made consumer routers

#208

Post by lmm » Tue, Mar 24, 2026, 7:48 AM UTC

cjk wrote: post #51

gobins wrote: post #38

Earlier quoted context omitted.

Are you saying that other manufacturers don't do this?

If US manufacturers (or manufacturers in allied countries) do this, legal avenues exist to hold those manufacturers accountable. Not so with China. (That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)

> legal avenues exist to hold those manufacturers accountable

Maybe in theory. I think the practical chance of enforcing anything meaningful through those legal avenues against a US manufacturer is not meaningfully higher than the chance of doing so against a Chinese manufacturer, so it doesn't make sense to treat them differently on these grounds.

Re: FCC updates covered list to include foreign-made consumer routers

#209

Post by lmm » Tue, Mar 24, 2026, 7:50 AM UTC

palmotea wrote: post #197

1over137 wrote: post #157

Earlier quoted context omitted.

Which is still foreign from the USA's perspective. Remember, this new rule is not just against China, but against all foreign-made.

But the fact that a company can manufacture consumer(ish) routers in Latvia means it's very practical that another company could manufacture consumer routers in the US. Usually the argument is that X can't be made in the US because China's so good at it that the US could never compete, so we shouldn't even try. But if a company with 367 employees in a country with the population of a medium-size metro area can do it,…

> But the fact that a company can manufacture consumer(ish) routers in Latvia means it's very practical that another company could manufacture consumer routers in the US.

Assembling them in Latvia, or the US, from internationally sourced components isn't a solution to anything.

> Usually the argument is that X can't be made in the US because China's so good at it that the US could never compete, so we shouldn't even try. But if a company with 367 employees in a country with the population of a medium-size metro area can do it, it proves that argument is bunk.

Unless Latvia is a much better environment for this kind of industry than the US is.

Re: FCC updates covered list to include foreign-made consumer routers

#210

Post by consp » Tue, Mar 24, 2026, 8:00 AM UTC

samus wrote: post #180

AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

> And "require longer support" doesn't fix it because many of the vendors will go out of business. Which is not a real issue in practice. It's like arguing that warranty doesn't matter because the vendor might go out of business.

It might also be illegal. Don't know about the US but forcing a bankruptcy to avoid regulations is usually frowned upon by the court system here. So putting a product in a child-dummycorp to go poof when you want and let the parent stay afloat usually puts the parent in the line of fire directly and you are screwed either way.