Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FCC updates covered list to include foreign-made consumer routers

fcc.gov

Post reply on HN
Print view View original

251–260 of 452 posts

Re: FCC updates covered list to include foreign-made consumer routers

#251

Post by anonym29 »

wao0uuno wrote: post #235
anonym29 wrote: post #31

What the fuck?! I did not sign up to live in some third world shithole where I can't get first-world networking equipment. I do not want some piece of shit closed-source proprietary netgear ameritrash. FUCK! Give me back my god damn chinese routers! Chinese citizens have more computing freedom than American citizens at this point. What the fuck happened to the land of the free?

Lmao you're an IT guy, right? Get yourself a Raspberry Pi 5, PCIe adapter and a second hand gigabit Intel NIC. Slap a case on that, put OpenWRT on it and bam! High performance, high quality router built from trustworthy parts running open source operating system. Not the prettiest and simplest solution but at least that way you don't have to depend on Realtek chips and Chinese firmware.

Pi 5 can't come close to handling gigabit wireguard tunnels. I can do an x86 build that will, but still, incredibly aggravating.

Re: FCC updates covered list to include foreign-made consumer routers

#252

Post by ozlikethewizard »

pimterry wrote: post #232
WarOnPrivacy wrote: post #7

The FCC maintains a list of equipment and services (Covered List) that have been determined to “pose an unacceptable risk to the national security Recently, malicious state and non-state sponsored cyber attackers have increasingly leveraged the vulnerabilities in small and home office routers produced abroad to carry out direct attacks against American civilians in their homes. Vulnerabilities have nothing to do with…

> no Gov agency would ever mandate secure firmware Interestingly, Europe is about to try this: the Cyber Resilience Act is going to become obligatory for all sold digital products (hardware & software) by the end of 2027, with a bunch of strict minimum requirements: no hardcoded default passwords, must check for known vulnerabilities in components/dependencies, encryption for data at rest, automatic security updates…

Encrypting data at rest is security theatre right? Unless consumers control the keys (which they generally dont want to), the keys will have to be accessible by the system storing the data. So if the system is compromised so are the keys? Like I cannot see the security benefits from encrypting data at rest in a non E2E system.

Re: FCC updates covered list to include foreign-made consumer routers

#253

Post by anonym29 »

ReptileMan wrote: post #218
anonym29 wrote: post #31

What the fuck?! I did not sign up to live in some third world shithole where I can't get first-world networking equipment. I do not want some piece of shit closed-source proprietary netgear ameritrash. FUCK! Give me back my god damn chinese routers! Chinese citizens have more computing freedom than American citizens at this point. What the fuck happened to the land of the free?

> I do not want some piece of shit closed-source proprietary netgear ameritrash. So much different than the piece of shit closed-source proprietary netgear chinesium. Consumer routers are shit full stop.

Plenty of Chinese routers offer better performance at lower prices with factory support for OpenWRT, unlike Ameritrash.

Re: FCC updates covered list to include foreign-made consumer routers

#255

Post by ReptileMan »

anonym29 wrote: post #253
ReptileMan wrote: post #218

Earlier quoted context omitted.

> I do not want some piece of shit closed-source proprietary netgear ameritrash. So much different than the piece of shit closed-source proprietary netgear chinesium. Consumer routers are shit full stop.

Plenty of Chinese routers offer better performance at lower prices with factory support for OpenWRT, unlike Ameritrash.

Only Glinet. With all the rest is hit and miss and some are with locked bootloaders.

Re: FCC updates covered list to include foreign-made consumer routers

#256

Post by riskable »

thayne wrote: post #154
AnthonyMouse wrote: post #70

Earlier quoted context omitted.

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using t…

> What you need is the ability for consumers to replace the firmware. I don't think that's enough. Most people aren't going to replace the firmware on their device with an open source replacement made by someone else. Now if the firmware was required to be open source, and automatic updates could be seamlessly switched over to a non-profit or government agency in the event of the company going out of business, you mi…

I have a PC hooked up to my TV in my living room that has been running the latest version of Kubuntu for over 18 years now. It has had many upgrades in that time but it's still the same basic hardware: A CPU, some memory, USB ports, a video card, and an ethernet port on the back.

That "genericness" is what's missing in the router space. Literally every consumer router that comes out has some super proprietary design that's meant to be replaced in its entirety in 3-4 years. Many can run Linux, sure, but how many have a replaceable/upgradable board? How many are like a PC where you can install whatever OS you want?

Sure, you can forcibly flash a new OS (e.g. OpenWRT) but that is a hack. The company lets you do that because they figure they'll get a bit more market share out of their products if they don't lock the firmware so much. They key point remains, however: They're not just hardware—even though they should be!

The world of consumer routers needs a PC-like architecture change. You can buy routers from companies like Banana Pi and Microtik like this but they're not marketed towards every-day consumers. Mostly because they're considered "too premium" and require too much expertise to setup.

I think there's a huge hole in the market for consumer-minded routers that run hardware like the Banana Pi R4 (which I have). When you buy it, you get the board and nothing else. It's up to you to get a case and install an OS on it (with OpenWRT, Debian, and Ubuntu being the normal options).

We need something like the Framework laptop for routers. Not from a, "it has interchangeable parts" perspective but from a marketing perspective. Normal people are buying Framework laptops because geeky friends and colleagues recommend them and they're not that much more expensive/troublesome than say, a cheap Acer/Asus laptop.

Re: FCC updates covered list to include foreign-made consumer routers

#257

Post by sedawkgrep »

M95D wrote: post #213
JumpCrisscross wrote: post #126

Earlier quoted context omitted.

Requiring a one-click option to configure to open source would be a sensible across-the-board law.

I think we all know that's never going to happen.

I don't understand why people with this opinion think it's worth the effort to post it.

Re: FCC updates covered list to include foreign-made consumer routers

#258

Post by rkangel »

ozlikethewizard wrote: post #252
pimterry wrote: post #232

Earlier quoted context omitted.

> no Gov agency would ever mandate secure firmware Interestingly, Europe is about to try this: the Cyber Resilience Act is going to become obligatory for all sold digital products (hardware & software) by the end of 2027, with a bunch of strict minimum requirements: no hardcoded default passwords, must check for known vulnerabilities in components/dependencies, encryption for data at rest, automatic security updates…

Encrypting data at rest is security theatre right? Unless consumers control the keys (which they generally dont want to), the keys will have to be accessible by the system storing the data. So if the system is compromised so are the keys? Like I cannot see the security benefits from encrypting data at rest in a non E2E system.

It's a whole lot easier to store the keys in a special hardened location than it is to store your whole storage.

Re: FCC updates covered list to include foreign-made consumer routers

#259

Post by iAMkenough »

stefan_ wrote: post #231
buzer wrote: post #3

> all consumer-grade routers produced in foreign countries Are there even consumer-grade routers that are produced in the USA...?

Qualcomm is a US company right? I've worked on a few WiFi router devices and their chips are pretty popular in that segment. But WiFi is not a priority for Qualcomm (in fact they actively sabotage it for their more profitable 5G segment), and software is even less of a priority. So you had "parsing 802.11 TLVs in the kernel with obvious stack overflows" quality code drops. (Which is why it's a bit ironic I saw the Go…

Doesn't matter where they're headquartered if they use foreign-made components. I don't think there's a robust enough supply chain of domestic materials available (nor cheap enough labor) to feasibly stop using foreign-made components.

Re: FCC updates covered list to include foreign-made consumer routers

#260

Post by rkangel »

WarOnPrivacy wrote: post #11

If we wanted secure products, we wouldn't ban devices. We'd mandate they open their firmware to audits.

Not all of the functionality is in the firmware though. You can put stuff in the silicon itself that allows backdoors.

It's very difficult to inspect a laid out chip for nefarious elements - there's too much of it to do manually. Having a secure supply chain is probably the best way to prevent that happening.

Which is not to say that I support this rule - it sounds like another import weapon trump can swing against people who aren't his friends.

Post reply on HN