Hacker News Reader

Comment by AndyMcConachie | Hacker News Reader

Read the actual rule here: https://apps.fcc.gov/kdb/GetAttachment.html?id=1UiSJRK869Rsy...

Look at item #2 under "Third-Party Access Control" which states a home router manufacturer must answer this question: "What prevents third parties from loading non-US versions of the software/firmware on the device? Describe in detail how the device is protected from “flashing” and the installation of third-party firmware such as DD-WRT."

What they're doing is requiring home router manufacturers to claim their device cannot be flashed to gain FCC approval. Theoretically, the FCC could penalize router manufacturers that allow their routers to be flashed. These manufacturers would then no longer be allowed to sell their devices in the USA.

View on HN

Unbelievable that it actually calls out community firmware as a threat, and DD-WRT by name. There has to be a story behind the genesis of this rule. I mean, these ROMs have been around for well over a decade now with no ill effects I'm aware of. That's not something that the FCC is going to be inclined to spontaneously regulate if someone weren't pushing for it.

So who pushed?

What you're seeing here is a policy that came into full flower in World War II but has been a part of radio since the beginning. It's the idea that all paths must be pursued to maintain absolute mastery of signals intelligence on communications channels used by the public. It's as full an example of imperial military doctrine as you will encounter anywhere. This unfortunately puts the military interests of the United States directly against the civil rights of United States Citizens.

Oh yeah, also. It's pretty settled case law that your first amendment rights do not apply to broadcast radio signals.

Is that the military, or is that just the fact that we only have so much radio spectrum (it's basically a public good) and everybody wants a piece of it? Have you taken a look at the U.S. Frequency Allocations map recently?

I have heard that the current system woefully misallocates bandwidth and that Full Frequency Spread Spectrum transmission would help with that. Of course the current system of government granted monopolies on spectrum allocation would have to go away. And that is a political event of low probability of occurence. At least this week.

Probably somebody who has the spectrum right above the 2.4GHz ISM band complained.

Given the overcrowding of the 2.4GHz spectrum, I suspect that people were starting to use DD-WRT to run on Channel 14, which is a no-no in North America.

That would probably be XM Sirius satellite radio (spectrum right below). They have perviously tried to have the FCC go after 2.4 GHz Wifi [1]

[1] http://www.geek.com/news/satellite-radio-worried-about-wi-fi...

Below isn't as big a deal as above.

I don't know of any WiFi chips that explicitly allow you to go below channel 1 (I know of a few that would let you go below if you twizzled the PLL directly, but generally that was very hackish) and they certainly never test there.

Whereas, nobody designs a WiFi chip that doesn't actually go to Channel 14.

I don't know if there are no ill effects! I have heard countless admissions of "I jacked up the power" and "I enabled channel 14."

If I am not mistaken these are some of the "features" of DD!

Is there evidence that people are causing actual problems by doing either of those things? I know they could be bad in theory, but if there have been no problems or only mild problems, a wait and see approach seems more appropriate than trying to get in front of it with regulation.

Does that really say DD-WRT in particular is a threat? I take it simply as saying DD-WRT is the poster child.

While I like DD-WRT, if you can flash DD-WRT you can flash anything, and arbitrary code breaks all possible chain-of-trust models.

The FCC has a long history of moving for more restricted hardware as a way of regulating the airwaves, one of its chief jobs. As a ham & commercial radio operator it drives me up the wall, but I understand why they do it.

> arbitrary code breaks all possible chain-of-trust models

No. The code I get on my router from the store is an arbitrary closed source buggy crap.

The code I load from debian, openwrt, etc. is far more trusted.

His point was that individuals could compile their own malicious code in to DDWRT source then flash it to routers.

Your point is corporate code sucks.

I hate HN's tendency to be perfectly intelligent and rational most of the time, yet become infuriatingly obtuse and cultish any time we brush near ideology.

Obviously the FCC does not care about who you trust.

The code that ships in consumer routers is really awful security-wise compared to something like OpenWRT, though, and that's not ideology - it's the commercial reality of the consumer router market. Security costs money and it's not visible to the consumers buying the routers, so the manufacturers don't bother.

I trust GPL code only.

Keep in mind, these are the same idiots at the FCC who (forcibly) gave us the RP-SMA connector, on the grounds that if the user can't buy a compatible connector at Radio Shack, they won't be able to install a better antenna.

It's the bureaucratic equivalent of Apple's habit of inventing new proprietary Torx screws, which keep users out of their gadgets for the 2-3 weeks it takes the Chinese to come up with new screwdrivers.

Have you ever actually done extensive repair of mobile devices? I'm actually glad they changed the screws; Phillips screws that small strip pretty easily and then you're actually locked out of the device. the newer style screw allows for more torque and lower chance of stripping by far.

Nothing wrong with Torx screws. I'm talking about "security features" added to them at various times by various vendors (Apple's not the only guilty party) that serve no purpose but to keep owners, hobbyists, and independent repair shops out of their devices.

So the FCC is very interested in reducing the security of routers and getting all users of routers hacked. Good job FCC, you are the best. I guess they are concerned about the router firmware letting you configure routers in such a way as to cause interference. The proper way to address that is to inform the makers of router firmware and force them to comply, I am sure the US government is more than capable of doing that, even if the FCC is not.

I can think of another three letter agency that might very well have suggested this new "security measure" be implemented. /tinfoilhat

To be fair, you're talking about an agency that provably intercepted deliveries of Cisco hardware and installed backdoors in them.

I don't think it's particularly far fetched.

> To be fair, you're talking about an agency that provably intercepted deliveries of Cisco hardware and installed backdoors in them.

I'm unsurprised, but do you have a link for that? I'd like to read more about it.

http://www.engadget.com/2014/05/16/nsa-bugged-cisco-routers/

More here https://www.google.com/search?q=intercept+cisco+routers&ie=u...

http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...

HN submission from 440 days ago:

https://news.ycombinator.com/item?id=7737648

The part that worries me is:

> To whom is the UI accessible? (Professional installer, end user, other.)

What professional installer? Consumer routers are all set up so the user configures it. Making the distinction between the end user and the installer sounds like the way DOCSIS locks the firmware of cable modems so the network operator has complete control over it.

I also wonder if this is the part of the FCC's plan to put data in the white space of other bands. The argument has always been that it's too difficult to coordinate all the different radios to prevent one accidentally transmitting where it isn't supposed to. But sending out frequency maps is easier when you can limit the number of different radios to just a few authorized vendors.

The word "home" does not appear anywhere in that document. I assume this document applies to all WiFi routers sold in the United States capable of U-NII frequency use.

You're correct. I used the word "home" because that's typically where these devices are used and the market that will be most effected. The FCC makes no distinction between devices meant for home use vs. other markets.

Is there any actual merit to "impossible to flash" when you can open up the box and start replacing parts?

How large a proportion of people are able to de-solder surface mounted components and replace them? I'm not asking how many can learn to do so and get the equipment, but how many who knows how to do it and have the equipment.

No policies like this are made with the expectation they'll stop everyone. They just want to raise the barrier sufficiently.

If you open most SOHO routers today (mid-to high end ones) the baseband processor and the RF stuff will be on a daughter board, in many cases it will be the same or very similar mini-PCIE cards that you find in most laptops.

> the baseband processor and the RF stuff will be on a daughter board

Which doesn't help you all that much in replacing the firmware.

Yes. Signed bootloader loading signed kernel, etc.

Reply on news.ycombinator.com