For an analogy to work, its underlying elements should have a relation to the target. Your analogy is not in the same universe. For electrical work, there is a baseline of materials and practices which is known to produce acceptable results if adhered to. For software, there isn't. (Don't tell me about the Space Shuttle. Consumer software doesn't cost tens of millions and isn't written with dedicated teams over the decades.)

Are you familiar with how the actual electrical code works? It's a racket. The code is quite long and most of the inspectors don't know most of it so only a small subset is ever actually checked, and that only in the places where the person doing the work is actually pulling permits and the local inspector isn't corrupt or lax in areas the local tradespeople have learned that they're lax. Then we purposely limit the supply of licensed electricians so that they're expensive enough that ordinary people can't afford one, so that handyman from Craigslist or whatever, who isn't even allowed to pull permits, is the one who ends up doing the work.

It only basically works because no one has the incentive to purposely burn down your house and then it only happens in the cases where the numerous violations turned out to actually matter, which is rare enough for people to not get too upset about it.

But the thing that makes it a racket is the making the official process expensive on purpose to milk wealthy homeowners and corporations who actually use the official process, which is the same thing that drives common people to someone who charges a price they can afford even knowing that then there no inspection.

> Then that kind person can inform the company of the bad wiring.

The point is rather that when the homeowner discovers that their microwave outlet is heating up, they can fix it themselves or hire an independent professional to do it instead of the company that built the house (which may or may not even still exist) being the only one who can feasibly cause it to not stay like that until the house is on fire.

Trying to make analogies from software to hardware will always fall down on that point. If you want to argue that there should be stricter security & correctness requirements for routers, maybe look more toward "here is how people actually treat them in practice" with regard to ignoring updates...?

Those standards aren’t related to the functionality or security of the router.

That "genericness" is what's missing in the router space. Literally every consumer router that comes out has some super proprietary design that's meant to be replaced in its entirety in 3-4 years. Many can run Linux, sure, but how many have a replaceable/upgradable board? How many are like a PC where you can install whatever OS you want?

Sure, you can forcibly flash a new OS (e.g. OpenWRT) but that is a hack. The company lets you do that because they figure they'll get a bit more market share out of their products if they don't lock the firmware so much. They key point remains, however: They're not just hardware—even though they should be!

The world of consumer routers needs a PC-like architecture change. You can buy routers from companies like Banana Pi and Microtik like this but they're not marketed towards every-day consumers. Mostly because they're considered "too premium" and require too much expertise to setup.

I think there's a huge hole in the market for consumer-minded routers that run hardware like the Banana Pi R4 (which I have). When you buy it, you get the board and nothing else. It's up to you to get a case and install an OS on it (with OpenWRT, Debian, and Ubuntu being the normal options).

We need something like the Framework laptop for routers. Not from a, "it has interchangeable parts" perspective but from a marketing perspective. Normal people are buying Framework laptops because geeky friends and colleagues recommend them and they're not that much more expensive/troublesome than say, a cheap Acer/Asus laptop.

i will allow sunsetting and removing ipv4 after 2020 (that is more that 5 years ago)

What they're actually trying to do is obsolete the devices faster because then they won't add new protocols or other software-only features to older devices so you have to buy a new one, or only expose features in more expensive models that the less expensive hardware would also be capable of doing. Which is all the more reason for us to not have that.

And if they were required to allow anyone to replace the firmware then you would get companies reflashing and selling them that way from the store because the free firmware has more advertisable features. There's a reason you can go to major PC OEMs and pick between Windows, Linux and "don't even install one" and the reason is that if you give customers a choice, they generally don't want their software to be made by the OEM.

Anyhow, this is a common enough practice. Many companies that provide infrastructure type software and sell to Fortune 500 companies often have a clause whereby they deliver their software to their customers if the shut down.

Are you serious? The number of IoT companies that make a product for a couple years and then go bust is enormous.

> It's like arguing that warranty doesn't matter because the vendor might go out of business.

How are you going to use a warranty from a company that no longer exists to get a security update for a product a million consumers still have?

The problem is not that people need a free meal. The problem is that people need the ability to eat some other food when the OEM's restaurant is closed or unsatisfactory.

The real problem is: assuming that firmware can be updated, how do you run a nationwide update programme overcoming a population that doesn't really care or have the skills to do it.

Vehicle safety standards (mandated annual safety checks like the UK MoT test) is the closest analogy I can think of - in the UK you can't insure your car without a valid MoT. If you were serious, then maybe tying ISP access to updated router firmware would be the way to go.

You misunderstand how organizational knowledge works. You see, it doesn't.

Some embeds the credentials, someone else ships the product. The first person doesn't even necessarily still work there at that point.

Remember that time NASA sent a Mars orbiter to Mars and then immediately crashed it because some of them were using pounds and the others newtons? Literally rocket scientists.

The best we know how to do here is to keep the incentives aligned so the people who suffer the consequences of something can do something about it. And in this case the people who suffer the consequences are the consumers, not the company that may have already ceased to exist, so we need to give the consumers a good way to fix it.

Even EAL7 can't guarantee anything. It can only say that the tools used for verification didn't find anything wrong. I'm not saying the tools are garbage, but the tools were made by humans, and humans are fallible.

They regulate broadcast TV. Those rules leak into cable TV because the originators generally want content that can be sold for broadcast in the future and is advertiser friendly. Cable operators are also often beholden to community standards imposed by municipalities they serve. The FCC isn't responsible for content restrictions on cable.

The FCC also regulates interstate wire transmissions.

But ultimately, you're not quite getting it right. It's all RF, it's just that we sometimes choose a really shitty wire called "the atmosphere".

(That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)

No, I don't have it but you may check with Santa Claus.

https://nvd.nist.gov/vuln/detail/CVE-2023-1389

if there's really one thing that destroys countries is corruption. being originally from a 3rd world country - I have seen it. now the US is heading towards the same path.

having worked in the IOT industry before - I can tell even domestic manufactures will be forced to pay bribes soon cloaked in 'state secrets' - there's already export laws etc - but now they will be forced to pay for compliance e.g maybe donating the president's vanity project.

The old payola model. This new model encompasses the old one and adds a neat layer of outright politician bribery on top.

According to SCOTUS in Snyder v. United States, if the payment occurs after the official act, it's a perfectly legal "gratuity."

Dario (CEO of Anthropic) said the DoW contract violations and threats were direct retaliation for not paying Trump "campaign" money. Later, he was forced to apologize for speaking the truth.

People who care about the problems of digital security are not going to lean into the idea of simply banning devices based on where they were manufactured. Rather they would work at general standards and solutions to actually solve the problems - things like untying the markets for hardware/firmware/services, requiring firmware source escrow, mandating LAN protocols and controllers so every single IoT device isn't backhauling to its own mothership, and so on.

Likewise people who care about domestic manufacturing first and foremost are not going to champion applying steep blanket tariffs two decades after all of that industry has already left, or using regulatory agencies to shake down manufacturers for unrelated concessions.

Even if this wasn't done, at the very least they must publish their software testing procedures, the way UL, ETL, and CSA require to certify devices for the US power grid. (https://www.komaspec.com/about-us/blog/ul-etl-csa-certificat...) They can also do black box testing.

But ideally they would actually inspect the software to ensure its design is correct. Otherwise vibe-coded apps with swiss cheese code will be running critical infrastructure and nobody will know until it's too late.

The difficulty of installing OpenWRT or Linux in general on hardware comes from that hardware not being documented, or not having straightforward APIs like BIOS/EFI.

Or for some devices, community distributions that dubiously remix manufacturer-supplied binaries are available. But we generally see that as soon as the manufacturer stops their updates, the community versions start lagging behind as well.

This is already the case today with many embedded devices. They have secure boot enabled so even if the vendor releases the GPL source code (big if), you can't do anything because the device will only boot the vendor's signed firmware.

> at a minimum I think there should be a wifi card that does refuse modifications and a main application processor that is 100% user controlled so that they can actually fix problems without needing the vendor to help

This is already possible. The RF components frequently have a signed firmware blob that is verified on load. There is no reason but planned obsolescence and greed keeping the application processor locked to running the vendor's signed code.

https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal

And I don't mean to suggest, in any way, that this means that most people are stupid or anything like that. They can have ridiculously high intelligence while the nuts and bolts of networking remain completely beyond the scope of their thought processes.

But yet: Every-day consumer-oriented stores (including Wal-Mart) have routers (and mesh systems and...) in stock on the shelf for purchase in Anytown, USA right now. So while they may not be the majority, people are buying them.

And superficially, it sounds like a straight-forward thing for me or anyone else to do here in the states, but things get murky quickly: What differentiates a foreign-made router from a US-made router?

Can I get some flunky push the button in his studio apartment in Idaho to flash open (but globally-sourced!) firmware onto some boxes from Alibaba (in exchange for startup promises) and call that good enough?

Do I have to spin up the boards here in the States? And the ICs, too? How about the passive jelly-bean parts like the capacitors and resistors and the antennas?

What of the rest of the device? Like, things such as the housing, the packaging, the power supply, and the included ethernet cable: Do I need to source those from domestic US production or is it OK if they're foreign-made components?

Do I have to produce the software in the States? (If so, Linux is right out.)

Where is the line drawn? How is the line shaped?

For example, my router/firewall, which also implements various other network services, e.g. hosting my own e-mail server, is an old Intel NUC with 5 Ethernet ports, 4 of which are made with USB Ethernet interfaces.

If Apple can make a Neo laptop out of phone parts, they could make a US Airport router out of US mini PC parts.

However, the approvals appear to have not been based on any objective methodology, but sometimes nothing has been approved, while otherwise there may have been some approvals but their randomness was suspicious.

Now this new interdiction continues the trend, so it is normal for people to be wary that any approvals will be based on some kind of bribing and not on any serious security audit.

Great, please share it with us! If what you've said is true, the kind of comment you're uniquely qualified to share is the very thing the thread most needs.

So no, this does not pull all existing routers off the market. Anything that already got FCC approval remains approved and new stock may be imported and sold.