FCC Should Mandate Open Source Router Firmware And Fast Security Updates, Say Internet Experts

Status
Not open for further replies.

AcostaJA

Distinguished
Dec 23, 2014
8
0
18,510
I totally Agree, wrong position from FCC, hardware control is not a matter of secret, but responsibility, having OpenSource there is warranty on this software to be auditable and do whatever is supposed have to do AND NOTHING MORE [PERIOD].

FCC should then establish liability for those publishing open or closed source (as Volkswagen) Firmware doing unwanted or illegal things on regulated hardware.

On the other hands, IMHO both DD-WRT and OpenWRT are outdated, developing only support for new platforms and radios, but the OS and the User interface are too Outdated, DD-WRT community have years asking for integrated package manager, as well OpenWRT better interface.
 

DrakeFS

Reputable
Aug 11, 2014
95
0
4,640
How about the FCC certifies the NOS rather than the hardware?

Since the FCC only cares about the radio, the NOS would only have to show that a user cannot modify the power settings for it.
 

Achoo22

Distinguished
Aug 23, 2011
350
2
18,780
Of course, nearly every router I've owned in the last five years (one cellular router, two from ISP, one Linksys) already used open source, GPL software. Of the bunch, only the Linksys adequately followed the terms of the GPL by making it known that I was free to inspect, modify, or distribute the software and showing me where I could find it in human-readable form. The FSF has a legal team that is supposed to work towards protecting GPL software, but I have lost all faith in them and all faith in most GPL projects to protect my work under the terms I have and do contribute. It is NOT OK for GPL software to settle with offenders to the benefit of the a current project leader; that is a perversion of the GPL and a huge betrayal for contributors that would've never become involved with a dual/multi-license system.
 

dgingeri

Distinguished
No. Mandating anything by government is a horrible idea. The government screws up everything they touch. They need to keep their noses out of this. If they even try this, routers will cost over $1000 in a matter of a year, and probably cut the usable bandwidth in half and need to reboot every few hours. Government = morons. Government = bad. Leave them out of this.

As far as people, the morons who buy routers that aren't kept secure by proper updates get what they deserve. I continue to buy small business routers that do have proper security and build Linux or Windows 2012r2 routing servers for people who want even better security. (All for much less than $1000, keep bandwidth at maximum, and don't need reboots, btw.) If people want better security, then they can pay for it. Those who just want cheap will continue to suffer. That's the way of things.
 

Kewlx25

Distinguished
If the government can't mandate a minimum quality, then customer should have a lemon law that they can invoke and easily sue companies for failing to provide basic support.

" the morons who buy routers that aren't kept secure by proper updates get what they deserve" - Blaming the victim ehh? Classic move.

You should go back in time a bit and seen the free market before government regulations. People would take young orphan child off the streets and force them to work. Child slave labor.

Of course it now sounds like you support child slave labor because you have a strict no-government intervention stance.
 
How about the FCC get out of the fucking way and let the best router emerge victorious with network engineers?

The market does not favor the best product. It favors what is more affordable. Betamax vs. VHS: VHS had inferior quality/length, but was cheaper. Guess which one became popular. Same thing happens almost every time with every other product competition.

The FCC has to step in when the companies are doing something wrong under the FCC's jurisdiction. That is literally what the FCC is there for. Fact is that the way the router manufacturers handle security problems in their bought products is putting their customers at significant risk and this is not something they will change unless they're given a reason to change.

Its one thing for the companies to not issue open source firmware for all of their products, but not fixing security vulnerabilities in reasonable amounts of time (if at all) is unacceptable.
 

dgingeri

Distinguished


You sound as if people don't have a choice in what they buy. They have a choice. They can research before buying. They can listen to experts. The problem is that most don't. They're too lazy to bother with it, or intentionally sacrifice security to get what's cheap. What is cheap is cheap because the manufacturers don't put the effort into it. If they were forced to put the effort into it, they'd have to spend more, and therefore charge more. People would hate it because they'd have to spend more money. There would be a lot more people who would just go without any firewall and connect directly to the internet again, and then things would be a lot worse.

Free markets regulate themselves, and people get what they pay for. Stupid and lazy people get bad stuff because they don't put effort into finding the right product, and then they learn and do better later. Without that, they'd never learn, and they'd stay stupid and keep buying crap, and the government would have to keep stepping in for them. That gives more and more power to the elite few and enslaves the rest of us. Keep the government out of it.
 


In what way does "people choose the more affordable product over the more expensive, yet superior product" translate to "people have no choice in what they buy"?

Yes, they can research routers before they buy. Unfortunately, most people won't understand what makes one router better than another even if they research it unless they pour weeks into learning how to quantify the differences. Furthermore, that has almost nothing to do with the article's purpose which is not about what routers are best, but about getting router companies to be more responsible about issuing effective and rapid updates to fix vulnerabilities as they are discovered. Now they also have to try to figure out which company is more likely to fix these problems in a timely manner.

Even your example of increased costs is false. Fixing the software needs to be done on high end models just as much as cheaper low end models. If they fix a high end model, then they can apply the same fix to a low end model, unless they're using two completely different systems for the two models which is in of itself a waste of time and money. Furthermore, buying a more expensive model doesn't mean you get the security updates that are in question, so the "you get what you pay for" argument doesn't apply anyway.

In no way whatsoever does the government telling these companies that they need to respond to threats to their customers "give more and more power to the elite few and enslave the rest of us." Completely free markets always regulate themselves in favor of exploiting the customer and the situation which the FCC is being asked to respond to is the result of such a free market that is supposedly regulating itself. Yes, too much regulation or improper regulation is bad and causes inefficiency.

However, complete lack of regulation is also bad. What happens if we don't regulate water quality? You end up drinking lead and mercury in your morning coffee. What happens if we don't regulate internet prices? You end up spending exponentially more money for inferior services because you don't have any choice other than garbage for premium prices, especially in rural areas. That's some great self-regulation in action. These are all things that happen right now in the USA. The FCC is trying to fix these problems because the markets will never stop exploiting the people until the markets are forced to do stop the exploitation. The only odd exceptions are things like Google Fiber and that's nowhere near enough to fix things at this point.
 

dgingeri

Distinguished


1. The way you're pushing government intervention to force companies to put out security patches makes it look like all people have no choice but to buy routers that aren't maintained. Sorry, you're wrong there. There are routers that have software that was written with security in mind, are secure from the start, and are updated fairly regularly. (I bought one, a Cisco RV320. It's expensive at about $160, with no wireless capability, but it is worth the expense to secure my network.) So, yes, people have the choice whether or not to take security as a concern. You're posts are acting as if people have no choice but to buy insecure routers, and that just isn't true.

2. Updating the software on routers costs money. They have to keep programmers around to write new code to correct the security issues that come up. So, it will drive up the cost of the insecure routers, whether they are cheap or expensive from the start. For example, if someone buys a $60 Belkin router or a $200 Belkin router, they're going to get crap security either way, and likely have to reboot the router every few hours, but if they buy a $160 Cisco router, they would have good security, but few extra options. The government forces Belkin to actually secure their software on their routers, then they have to hire the people to do that, which drives up the cost to $160 for the cheap one and $300 for the expensive one. Since Cisco has been securing their software, they don't have to drive up their costs, but they still have fewer features. The Cisco router just doesn't have to be rebooted all the time. People don't bother to think about having to reboot the router all the time and just buy the Belkin. Here's the thing, though. If the government is forcing this, then they have to pass paws or go through bureaucracy all the time to force new security holes to be patched, and that takes months. Also, beign government bureaucracy, they don't bother to actually check if the updates actually fix anything, and we get a whole bunch of firmware updates that just create problems and don't actually make anything secure. On top of that, government has to implement "regulation" for it, which means the companies have to pay for some government bureaucrat to sit around and make sure that the company is complying. That drives up the prices of the routers, from all companies, another $100-200 just to pay for the government regulation. So, new we get the same security from the Cisco routers for $260-360, and improved security from the crappy, unstable Belkin routers for the same price, paying extra money to employ some lazyass to sit around and rubberstamp the security updates that don't do any good.

3. People don't have to go and learn about router security on their own. Those that don't understand security can listen to the experts on the matter, like me. I've been in IT for 18 years. I've researched router security thoroughly. People could actually listen to me. I could tell them to stop buying the crappy $60 routers because they aren't secure, and to secure their information and their internet connection from leeches. I could hook them up with $160 small business routers and $150 small business wireless access points (the only ones without that HUGE blaring security hole known as WPS) and get them properly secured. Will they listen? Well, so far Bulletproof Home Networks (my small business) has had all of 3 customers in 4 months. Not even my family listens to me about it. My older sister is even still using the massively insecure Xfinity wireless router Comcast gave her. If people are going to be stupid, let them be stupid.

4. When has government actually done any good? ALL current regulation is managed by lazyasses who couldn't care less about doing their jobs because they can't be fired. You think your water quality is because of those idiot bureaucrats?? Think again. Half the water in this country has three to four times the fluoride content designated by the government, to the point of causing major side effects in children. Why do you think so many people buy bottled water? (Oddly, bottled water, almost completely unregulated, is far more pure than tap water, which is heavily regulated.) There's high levels of lead, mercury, sulphur, and other dangerous compounds in most water in this country. The bureaucrats don't care. There have been 17 meat recalls for quality problems that aren't even covered by government regulation this year alone. There have also been 3 recalls on meat for things that are covered by government regulation where the regulators and inspectors from the government didn't catch them. In all 3 cases, their internal reports caught the issue, and they voluntarily registered it with the government and started the recall before the government even requested it. In all the government regulation of food, only ONE recall has been caught and instituted by the government regulators in the last TWENTY YEARS. (That was the ConAgra Peanut Butter recall.) In ALL other cases, it was the COMPANY that caught the problem and issued the recall. It has been, for the last 20 years, corporations who have looked out for the safety of their customers FAR more than the lazy government bureaucrats, and it costs us far less.
 

Achoo22

Distinguished
Aug 23, 2011
350
2
18,780
You sound as if people don't have a choice in what they buy. They have a choice.
Wrong. In the case of routers, it is becoming increasingly difficult to bring your own for many ISP markets. If your're not on DOCSIS then you may find yourself forced into leasing equipment from your ISP - equipment that may very well be designed to suit your ISPs goals far more than your own. Getting technical information from my ISP is like pulling teeth and the chances of getting, eg, a personally owned bonded modem setup are very nearly nil. Further, the routers they lease (and formally sold) are loaded with open-source software but nobody can tell you where to go to view it. The situation with radios in cellular phones isn't much better.

If not for regulation, you would still be renting your phone from Ma' Bell; with today's tech it would probably be spying on you and all manner of other nonsense. It is time to similarly pry devices from the greedy hands of network providers once and for all. Standardize the equipment and protocols they use to communicate on FCC-authorize spectrum, regardless of vendor - just like we do for television.

The recurring, and very ignorant, argument that open source software or frequent updates drives prices is outlandish. The current market is dominated by a select few chipsets all of which have zero-cost open-source drivers and surrounding hardware right now. ESPECIALLY in the budget market, router vendors (which is the segment the counterargument seems focused on), almost EVERY product already runs a full complement of Linux/GNU software. You're right that it's expensive to write custom software, especially for devices that need UI/web hosts for management, but it's cheap to embed a Linux kernel. Guess what? That means that most popular routers should already have their sources available for inspection.

Finally, to counter the same tired "if you don't wanna' use what's provided then don't subscribe" argument that I am sure is coming: that's brainless. You wouldn't suggest that someone unhappy with medical care stop going to a doctor, you wouldn't suggest someone unhappy with their laws leave the country, and you shouldn't suggest someone unhappy with their ISP/cellular provider stop buying service either.
 

dgingeri

Distinguished


1. in order to patch software for security issues, a company has to pay for the person or people writing them. That costs money. That drives up the cost of doing business, and therefore drives up the price. Companies don't just create money out of this air. So, yeah, having to patch things drives up the price, always. Even having to implement open source patches to open source software takes time and programmers to package and distribute them. Plus, it takes money to run the servers to actually hold the patches so that people could get them.

2. Open source software is definitely not the panacea that you guys seem to think. I have to deal with open source software, mostly Linux, every single day. (I'm the admin in a server level software and hardware test lab.) Mostly, it's crap. There are reasons most people don't like it. The logic on how different modules operate differs from module to module, so the only way to know how to use it all is just to memorize it. That's is just asinine. Most of the modules, due to bad logic, are extremely difficult to use. (Postfix, which I've been dealing with lately, is a perfect example.) It's far too hard to use. Also, the people writing these horrible programs are horrible at documentation, so figuring out how to use them is like trying to thread a needle from 10,000 feet away. Finally, there are SO many bugs with many open source programs that simply get ignored, too, mostly because most of the developers writing this crap think they are gods and couldn't possibly do anything wrong. I know this well, because I've had to deal with them so frequently. Expect a patch for a security vulnerability for open source software? Expect to spend a year trying to convince the arrogant ass that is actually IS a problem.

3. Regarding "If not for regulation, you would still be renting your phone from Ma' Bell", you're SO wrong. People would not put up with that. It was the companies that created electronic switching and touch tones so that we could be connected faster. It was companies that developed new and cheaper ways to build phones so more people could afford them. It was companies, driven by market forces and customer needs that made this world what it is today. Government regulation has only slowed things down. I've worked for 18 years in corporate jobs, and I know how they work from the inside. The things people attribute to corporations is absolutely asinine. They couldn't be like that or the corporation would keep running for a year. People like you make it sound like we're running Satanic rituals half the time we're at work. You obviously have never even worked for a corporation. What I see when I'm there is a bunch of hard working people working on common goals for specific products, directed by a central vision created by the few corporate leaders. Those corporate leaders, like Elan Musk and Jeff Bezos, give a general vision for things, middle managers manage the employees to make it happen. (Well, except for Comcast. They very well might be running Satanic rituals.) They do what few people can do: guide large groups of people to get stuff done. I can guarantee you couldn't do it. It is that leadership and that vision that makes the big profits and earns them the big salaries, and most of them deserve it. Without the leadership they provide, people end up bickering and backbiting with nothing ever getting done.
 

alidan

Splendid
Aug 5, 2009
5,303
0
25,780
How about the FCC get out of the fucking way and let the best router emerge victorious with network engineers?

The market does not favor the best product. It favors what is more affordable. Betamax vs. VHS: VHS had inferior quality/length, but was cheaper. Guess which one became popular. Same thing happens almost every time with every other product competition.

The FCC has to step in when the companies are doing something wrong under the FCC's jurisdiction. That is literally what the FCC is there for. Fact is that the way the router manufacturers handle security problems in their bought products is putting their customers at significant risk and this is not something they will change unless they're given a reason to change.

Its one thing for the companies to not issue open source firmware for all of their products, but not fixing security vulnerabilities in reasonable amounts of time (if at all) is unacceptable.

just want to point out, beta lost because they wouldn't allow porn on it, vhs would.
 
Status
Not open for further replies.