TP-Link begins router firmware lockdown due to FCC proposed regulation
ml.ninux.org
ml.ninux.org
The FCC publishes a 90-page document on an extremely technical subject and required any comments to be submitted within 7 weeks. It would take the average aficionado several weeks just to find out about it.
The real issue here is that government agencies like the FCC are willfully excluding all but the best organized (read: best funded) groups from participating. And just like with Net Neutrality, no matter how many comments are submitted by poor people, only when the rich (the companies) and the powerful (President Obama) say something do they even bother to listen.
Increasingly over time these rules are becoming more and more draconian and including things that most people oppose.
For instance, there was an outcry about CISPA and COPA that killed those bills... so the FCC made an 800 page ruling on "net neutrality" and people accepted it, because they wanted net neutrality. (And who has time to read 800 pages?)
What? Sure they do; there's nothing in the constitution that forbids congress from making a law delegating its authority to the executive (the idea that all of administrative law is unconstitutional isn't supported by anyone in the legal community to my knowledge). Agencies can't just make up rules that say whatever they want, though; they're limited to being able to regulate the things Congress has empowered them to regulate, and they have to say what their authorizing legislation is in the text of the rule.
In general, this is what we want. Congress should be deciding what gets regulated, and experts in the subject area should be deciding the specifics of the regulation. Example: Congress decides that not every quack snakeoil salesman should be able to put whatever he wants in a bottle and sell it as medicine, so medications should be regulated. But members of Congress, by and large, are not doctors or otherwise medical experts, so they should defer the business of deciding which medicines should be allowed, how they should safely be produced, etc., to experts. Hence, the FDA.
In the case of the FCC, Congress decided that, spectrum being a precious commodity, somebody needed to regulate how it should be parceled out so there was enough to go around and people didn't step on each other's toes. But again: they're not radio engineers, so they're not equipped to decide what the right power levels are, which parts of the spectrum should be used for what, and what the best enforcement mechanisms are to make sure people play by the rules. Hence, the FCC. In this case, they proposed a rule requiring manufacturers to put software safeguards in place that prevented end users from being able to make otherwise-compliant equipment exceed its legally-allowed broadcast power levels. You can think that's a bad idea (I do, too), but it's pretty clearly within their regulatory purview.
Still, to play devil's advocate, the agencies do have a purpose. They are able to regulate industries that move faster than real legislation. They can employ experts (as opposed to congressmen) to write the rules. Industries like tech and pharmaceuticals are governed by extremely complex market dynamics. The federal agencies that oversee them, such as the FCC (tech) and FDA (pharmaceuticals) employ dozens of experts who are familiar with how the industry actually works. They write the regulations because no other branch of government possibly could.
Federal agencies make it possible for congress to write laws with stipulations like "all matters pertaining to <EXTREMELY GENERAL DESCRIPTION OF INDUSTRY SUBTOPIC> shall be subject to the regulations of the <FEDERAL AGENCY> responsible for overseeing <INDUSTRY>." The agencies provide a way for congress to defer the details of lawmaking to a more flexible, adaptable agency that is actually familiar with the complex dynamics of the system being regulated.
..... in theory, of course. Whether this works in practice is another question. One could make the argument that no sufficiently complex market should be subject to any regulation other than the natural market rules. One could also argue that the ability of congress to defer lawmaking to agencies is tremendously unconstitutional and enables them to enact laws with greater breadth than should be possible.
Some reading I dug up on the subject:
http://heritageaction.com/2011/11/issue-profile-unconstituti...
http://www.jpands.org/hacienda/comm19.html
tl;dr "Thanks, Roosevelt!"
That's almost exactly the opposite of the point of the legislative branch, since the other branches have very little power not explicitly granted by the legislature, and the legislative branch principally acts by defining and granting functions to the executive and judicial branches.
> Theoretically the legislative branch has the ability to restrict the capabilities of federal agencies
More to the point, federal agencies only exist because they are created by Congress, and only have powers because they are given them by Congress.
Its not a theoretical power that Congress has over them, but a practical one whose exercise is the only reasons the agencies exist and have any power at all.
If Congress doesn't take action that you think it should against a federal agency, that's because a sufficiently large portion of Congress doesn't want to take that action, not because Congress has only a theoretical but not practical power over the agency.
> but it's extremely unlikely we will ever see a heavy ruling against them.
Congress doesn't make rulings, that's the judicial branch. Congress has substantially restricted the powers of commissions and even abolished them. (A notable example being the one that served as a structural model for pretty much all other "independent" regulatory agencies, the Interstate Commerce Commission, whose powers were stripped in a series of deregulation movements culminating in the abolition of the Commission in 1995.)
Won't all of those existing TP-Link routers continue to work and be unlocked to flash whatever you like on them ?
Further, aren't there sufficient TP-Link parts in the supply chain from the last 4-5 years that you'll continue to be able to source them ?
Genuinely curious...
But eventually the supply will dry up and all that'll be available will be these locked-down routers, unless you're happy to use 10-20 year old hardware, which (if it even still works) will leave you out of whatever modern, advanced features routers have in 5-15 years. If some other frequency band becomes popular with mobile devices, or some new 802.11* standard comes about that's a big improvement somehow, then you won't be able to use that. Open-source projects like dd-wrt and OpenWrt will die out; who wants to keep working on a project that only works on ancient hardware?
I'm not saying this "report" isn't accurate... I'd just rather hear this from someone other than a random CS chat.
"Recent US firmware (e.g. Archer C7 v2 151014 US) do not install unsigned firmware, including earlier versions of firmware and international versions. Thank you, FCC. You need to use TFTP Recovery method to install OpenWRT until somebody replicates what DD-WRT’s KrypteX is doing."
So, it certainly seems like this has been known for at least a month.
Afiu tp-link has no obligations to manage two devices trees for a niche community. Stubborn minority effect at play here. [1] http://fooledbyrandomness.com/minority.pdf
IIRC, the first thing my stock WDR3600 firmware asked me about was which country I am in, which means that frequency locking can be easily bypassed (not power levels, though).
To make this as bulletproof as FCC wants they would have to make separate firmware image for the US and prevent US firmwares from being "upgraded" to non-US.
edit:
And this is exactly what they did:
Recent US firmware (e.g. Archer C7 v2 151014 US) do not install unsigned firmware, including earlier versions of firmware and international versions. Thank you, FCC.
Source: http://wiki.openwrt.org/toh/tp-link/archer-c5-c7-wdr7500
Would there be a gray market for international versions of routers because they're the exact same hardware and not as locked? If I'm a manufacturer I certainly don't want a whole new BOM variation just for US devices if I can solve the problem with software.
TP-Link may well be locking down firmware, but it is NOT because the FCC is forcing them to.
As your link says, they intend to prohibit selling hardware which can be modified to violate FCC regs. Since 3rd party firmware allows such violations, devices get locked down.
How else are you going to explain the existence of separate US firmware which refuses to upgrade to international firmwares?
So why is TP-Link locking down their firmware even though they aren't required to? You have to ask them.
If you read TFA you'll learn that somebody did just that.
Adam Longwill 09:26:19 pm Wow. Thank you. I'm impressed with your digging
And this limitation is due to FCC rule clarifications in 2015?
And not some other reason
Camille 09:28:15 pm Right, due to FCCRight now there is no issue for TP-link to "preenmptively" block their hardware. If there was, they would think twice about it.
Unfortunately, given the number of developers that would have to agree, the fact that early contributions weren't attributed and the can of worms that defining what a derivative work is opens, makes relicensing very unlikely.
Linus has in fact done this to quite a bit of MIT licensed code.
Of course it only applies to future versions, and you could conceivably make versions that have those patches removed.
This support went away because people were abusing it running their routers on forbidden bands at higher than allow transmission levels.
The vendors are doing what they can easily do now and it's block the firmware modification since they can't replace the baseband/wifi cards as easily.
If the FCC wasn't planning to stomp on router manufacturers, they wouldn't be doing this. Make no mistake, it is the government killing innovation here.
Also, amateur radio operators are legally allowed to operate these devices with modified firmware (including baseband). So why am I no longer allowed to buy these?
It's a trap-door upgrade.
Doesn't necessarily mean you can't load your own firmware in, but it would raise the difficulty of doing so. Finding a serial console on the board, vulnerabilities in the software, things like that - more akin to jailbreaking/rooting your phone.
I think it’s a bit extreme to say the C7 is the best. It never was the best performer, and already 802.11ac Wave 2 devices with MU-MIMO are on the market, potentially outperforming the C7. Maybe it’s coincidentally the best value for the money, but that will not last.
Every generation, I wearily observe the large number of router models. I thought the Buffalo WZR-600DHP was a pretty good value late in the 802.11n generation, but now it’s retailing for more than I paid for it. WiFi routers are a lemon market.
I suppose people will start rooting these devices. It's not like consumer routers have particularly impressive security track record.
Perhaps that's the way it should be, they come insecure by default and you're supposed to exploit that to enable installing your own, more secure, software...
When these die or get obsolete I think I'll finally just move up to the entry level business products a la Ubiquiti or the like.
I setup OpenVPN as a bridge and configured an SSID on it so when I connect to it, it'll be as if I were still at home. (Same subnet so I have access to all my printers, tv tuners, etc).
This is disappointing news. What I just did would not have been possible for $15. I've been using OpenWRT for over 10 years and can't imagine ever using a router without some sort of customizable Linux on it. I've learned so much about Linux, networking, VPNs, etc from OpenWRT.
Anyway, this was expected: it's the cheapest way to comply with the regulations.
If you can't buy them that cheap the TP-Link Archer C7 has been a better value... well, up until now.
http://wiki.openwrt.org/toh/asus/rt-ac56u
The BCM4352 (AC/AN chip) is not supported, which is part of the reason to get one of these routers. Broadcom router chips are usually MIPS based, and also heavy on the binary blobs (which may allow for dd-wrt support).
Edit: In fact, I can't find any image that supports this BCM4352 on dd-wrt either:
Unless you really need the throughput of 802.11ac or a more powerful processor to keep up with faster WAN speeds, ath9k 802.11n devices are still a pretty good choice.
It does make a good excuse for them, though, I guess.