5 ms·

s/malicious actors/hardware owners/ See, I bought this WNDR3800 off Ebay, because I wanted to put OpenWRT on it. Its compatible. But I made the mistake of buyi

by miah_ 11y ago

s/malicious actors/hardware owners/ See, I bought this WNDR3800 off Ebay, because I wanted to put OpenWRT on it. Its compatible. But I made the mistake of buying a used router that was managed by a ISP. They built their own firmware and purposefully made the firmware updater require specific headers in the firmware package. Now I can't update this device to OpenWRT, without some very specific hacking and compiling my own version of OpenWRT. Who owns this hardware? I bought it. I paid for it. Its in my house. But apparently this ISP is truly the owner and I can't do anything that I wish with this device. The firmware is based on Linux, the ISP of course hasn't released their source. The only way I know about the header bit is because somebody else figured this out years ago and there is a single message on a random web forum detail it. Presumably, the "openness" of the original device running Linux is what allowed them to build their own custom firmware in the first place.

jabgrabdthrow 11y ago
I agree you own that hardware. I don't think the ISP is the owner. I just think that the piece of hardware you own is only useful if you have the private keys. That configuration is a physical property of the object you bought. Are you suggesting we should force that manufacturer to tell us some private knowledge he has? Don't try to make a "freedom" argument here. Vote with your Value and buy an unlocked piece of harware.
eridius 11y ago
The problem with the argument "I can't do anything that I wish with this device" is it's also the same thing as "Other people can't do whatever they wish with my device". I sympathize with the desire to customize your router firmware, and I think it's important that this ability be available in general (e.g. no laws prohibiting it), and I think it's great that there are devices on the market that allow it, I don't think that any particular vendor should be forced to allow it. If they want to use GPLv3 then they do have to allow it, but it's perfectly legal for vendors using GPLv2 software to put restrictions firmware updates, and I have no objection to that. If you want to customize your firmware, you can simply choose not to buy their product (this of course depends on my earlier statement that it's great that there are devices on the market that do support this). The important point here is that vendors aren't locking down their firmware because they're control freaks that hate when customers install modified firmware, it's also a big security hole. If you can replace your firmware with a modified copy, so can anyone else who manages to gain access to your device. There's other angles too of course, such as vendors who offer unique hardware may want to require their customers to always be using that business's products, as that's how they make money, but when we're talking about generic equipment like routers, the most important reason is security.
- belorn 11y ago
  I am perfectly fine with an ISP retaining property ownership of a device if it is marketed as such. It should be illegal to use technical means to evade laws that dictate how renting work and what taxes applies for that kind of product.
- miah_ 11y ago
  The problem is, that when I bought this device there was nothing to say that it was modified by this ISP. The device looks exactly the same as any other WNDR3800. It wasn't Netgear who limited the hardware in this way, it also wasn't the Ebay seller; though it was their responsibility to disclose it was 'locked' to this ISP. I could buy a _new_ WNDR3800 from Amazon and easily install OpenWRT on it without any issues. I realize the security issues, I'm not worried about them. As somebody who wants to learn about embedded Linux development, and who owns several other OpenWRT compatible devices 'locking' the firmware is not something I am interested in.
- AnthonyMouse 11y ago
  > The problem with the argument "I can't do anything that I wish with this device" is it's also the same thing as "Other people can't do whatever they wish with my device". It isn't. If someone has physical access to your device, you have lost. The end. They could just replace the entire device with one with an identical case but different internals. But if you successfully prevent attackers from gaining physical access to your device then there is no security cost in granting anyone with physical access full control over the firmware. And for devices you know will be placed in unsecured areas where you would still like some security theater (or to inhibit meddling by unsophisticated malcontents), there is nothing wrong with allowing the owner to lock the firmware using the owner's key or password.
zorpner 11y ago
I made the mistake of buying a used router that was managed by a ISP. ... Who owns this hardware? I bought it. I paid for it. Its in my house. This argument breaks down when you're not talking about the manufacturer -- at the time the ISP made that modification, they bought it. They owned it. Should they not be permitted to do what they like? Should you not be permitted to write your own firmware which requires headers?
- lmm 11y ago
  You can write your own firmware, but when you distribute the router you should distribute everything needed to build it with it.
  - btilly 11y ago
    If I sell you a cake, do I need to sell you the recipe with it?
    - WatchDog 11y ago
      If the recipe is licensed with GPL, then yes.
  - zorpner 11y ago
    A private sale between two parties is not distribution.
    - dfox 11y ago
      While that might be true, it has no effect on requirements of GPL. If the actual contract explicitly stated that the buyer will not exercise his rights coming from GPL, that might be another thing.
  - monochromatic 11y ago
    You "should" do what the license requires. Anything more is nice, but charity.
CamperBob2 11y ago
There is an infinite set of things you can't do with that device even though you own it. You can't turn it into a surfboard, a dishwasher, or a birdcage. You also can't turn it into a customized router, apparently. Maybe it's just me, but this seems like an easy thing to get over by buying some different hardware. Instead of stressing out about this particular WNDR3800, focus your angst on the general case, which is the FCC's attempt to make it illegal to upload custom firmware to any router.
- wolfgke 11y ago
  > There is an infinite set of things you can't do with that device even though you own it. You can't turn it into a surfboard, a dishwasher, or a birdcage. You also can't turn it into a customized router, apparently. This is sophistry. It's not a question of "can" in the sense of "be able (because of your skills) to", but of "the vendor actively prevents it". And the vendor is surely not preventing you actively from turning your device into a surfboard, a dishwasher, or a birdcage. But he is actively preventing you from turning it into a customized router.

by miah_ 11y ago

jabgrabdthrow 11y ago

I agree you own that hardware. I don't think the ISP is the owner. I just think that the piece of hardware you own is only useful if you have the private keys. That configuration is a physical property of the object you bought. Are you suggesting we should force that manufacturer to tell us some private knowledge he has? Don't try to make a "freedom" argument here. Vote with your Value and buy an unlocked piece of harware.

eridius 11y ago

The problem with the argument "I can't do anything that I wish with this device" is it's also the same thing as "Other people can't do whatever they wish with my device". I sympathize with the desire to customize your router firmware, and I think it's important that this ability be available in general (e.g. no laws prohibiting it), and I think it's great that there are devices on the market that allow it, I don't think that any particular vendor should be forced to allow it. If they want to use GPLv3 then they do have to allow it, but it's perfectly legal for vendors using GPLv2 software to put restrictions firmware updates, and I have no objection to that. If you want to customize your firmware, you can simply choose not to buy their product (this of course depends on my earlier statement that it's great that there are devices on the market that do support this). The important point here is that vendors aren't locking down their firmware because they're control freaks that hate when customers install modified firmware, it's also a big security hole. If you can replace your firmware with a modified copy, so can anyone else who manages to gain access to your device. There's other angles too of course, such as vendors who offer unique hardware may want to require their customers to always be using that business's products, as that's how they make money, but when we're talking about generic equipment like routers, the most important reason is security.

belorn 11y ago
I am perfectly fine with an ISP retaining property ownership of a device if it is marketed as such. It should be illegal to use technical means to evade laws that dictate how renting work and what taxes applies for that kind of product.
miah_ 11y ago
The problem is, that when I bought this device there was nothing to say that it was modified by this ISP. The device looks exactly the same as any other WNDR3800. It wasn't Netgear who limited the hardware in this way, it also wasn't the Ebay seller; though it was their responsibility to disclose it was 'locked' to this ISP. I could buy a _new_ WNDR3800 from Amazon and easily install OpenWRT on it without any issues. I realize the security issues, I'm not worried about them. As somebody who wants to learn about embedded Linux development, and who owns several other OpenWRT compatible devices 'locking' the firmware is not something I am interested in.
AnthonyMouse 11y ago
> The problem with the argument "I can't do anything that I wish with this device" is it's also the same thing as "Other people can't do whatever they wish with my device". It isn't. If someone has physical access to your device, you have lost. The end. They could just replace the entire device with one with an identical case but different internals. But if you successfully prevent attackers from gaining physical access to your device then there is no security cost in granting anyone with physical access full control over the firmware. And for devices you know will be placed in unsecured areas where you would still like some security theater (or to inhibit meddling by unsophisticated malcontents), there is nothing wrong with allowing the owner to lock the firmware using the owner's key or password.

zorpner 11y ago

I made the mistake of buying a used router that was managed by a ISP. ... Who owns this hardware? I bought it. I paid for it. Its in my house. This argument breaks down when you're not talking about the manufacturer -- at the time the ISP made that modification, they bought it. They owned it. Should they not be permitted to do what they like? Should you not be permitted to write your own firmware which requires headers?

lmm 11y ago
You can write your own firmware, but when you distribute the router you should distribute everything needed to build it with it.
- btilly 11y ago
  If I sell you a cake, do I need to sell you the recipe with it?
  - WatchDog 11y ago
    If the recipe is licensed with GPL, then yes.
- zorpner 11y ago
  A private sale between two parties is not distribution.
  - dfox 11y ago
    While that might be true, it has no effect on requirements of GPL. If the actual contract explicitly stated that the buyer will not exercise his rights coming from GPL, that might be another thing.
- monochromatic 11y ago
  You "should" do what the license requires. Anything more is nice, but charity.

CamperBob2 11y ago

There is an infinite set of things you can't do with that device even though you own it. You can't turn it into a surfboard, a dishwasher, or a birdcage. You also can't turn it into a customized router, apparently. Maybe it's just me, but this seems like an easy thing to get over by buying some different hardware. Instead of stressing out about this particular WNDR3800, focus your angst on the general case, which is the FCC's attempt to make it illegal to upload custom firmware to any router.

wolfgke 11y ago
> There is an infinite set of things you can't do with that device even though you own it. You can't turn it into a surfboard, a dishwasher, or a birdcage. You also can't turn it into a customized router, apparently. This is sophistry. It's not a question of "can" in the sense of "be able (because of your skills) to", but of "the vendor actively prevents it". And the vendor is surely not preventing you actively from turning your device into a surfboard, a dishwasher, or a birdcage. But he is actively preventing you from turning it into a customized router.