9 ms·

This has been bothering me quite a bit, it's ... You know companies will, as regular practice just give you a laptop to work on. Some will even provide a phone

by chx 4y ago

This has been bothering me quite a bit, it's ... You know companies will, as regular practice just give you a laptop to work on. Some will even provide a phone or tablet. These are not cheap. Not cheap at all. I've yet to hear of a company which would fleet-buy routers reflash with OpenWRT and hand them out. Why?

fragmede 4y ago
What would the router do in this case? On the other hand, companies will loan out commercial hotspot products (aka what you get from the eg Verizon store so employees can get Internet access at home.
- c0nsumer 4y ago
  OP here. And anecdotes, but almost everyone at this company as a Verizon mobile that has data enabled for tethering as needed, but then some people would... ...use it for Netflix and actually hit the "unlimited" data caps and get throttled. ...name their mobile network the same as their home network with the same password. ...place the phone somewhere weird (in the basement where they work, up against an earth-backed concrete/rebar wall, and complain that it's "too slow". There's almost no end to weird things people can do with tech and then blame just the tech. There are constant new problems that need to be handled on a case by case basis, because the root causes are not solvable solely by technical means.
  - fragmede 4y ago
    The ideal case would seem to be ship employees a laptop with LTE built in
- jon-wood 4y ago
  I used to work for a company that does development of things like TV apps, and physical hardware. They’d distribute wireless APs to engineers which automatically connected to the corporate VPN and exposed that via the AP for devices which couldn’t be directly configured to do so but needed access to development servers only accessible internally.
  - c0nsumer 4y ago
    We have those as well, for similar uses. And for folks for whom any connection to the public internet may want to be avoided. The stuff's expensive, though, so they are not for the day-to-day end users.
hug 4y ago
> Why? Because it wouldn’t work. It’s completely infeasible for an moderate sized non-tech business because the “IT environment”, such as it were, of employees homes is absolutely non-homogenous. You can, as an end-user IT support department, rely on basically only two things about any user’s home kit and ability to interface with it: they have power (usually), and they can probably get internet access via wifi somehow. Any other assumption about their home environment will prove incorrect in some wild way. I’ve run into users that don’t have Ethernet, or WPA2, or any kind of public IP, or next hop latency under 200ms, or more than 1mbps bandwidth. We have users that don’t have home Internet, and for the duration of WFH orders used their company provided phone as a hotspot. I’ve run into users who can’t promise that they’ll have mains power day to day. Even if the user does have Ethernet coming out whatever their NTD might be (and it might be exotic!) you can’t guarantee that they can follow any kind of instruction to set up a router: they are about as likely to end up without a functional internet connection at all as they are to get whatever box it is you give them to work. You also can’t even be sure your instructions will work for whatever it is you’re trying to do. Are you taking into account double NATing? Triple? Do you know that none of your users home ISPs have some kind of MAC whitelist on their NTD? What if their current router is built into some kind of HFC modem? This is not a problem you can solve the mass use case for and address the edge cases: it’s all edge cases, in my experience… and that’s if you’re operating in a single, highly developed first world country.
- justsomehnguy 4y ago
  > Are you taking into account double NATing? Triple? Usually this is not the problem... till some protocols what rely on port numbers. Like those used in audio/video conferencing. Then it's hell. Overall I want to upvote you twice. The only working way to provide a such thing would be to hand out the one with a mobile modem integrated, SIM inserted, configured, with WiFi SSID and password written on the case with at least 32pts. And still there would be problems.
  - justsomehnguy 4y ago
    EDIT: Oh, and the power supply cord epoxied hard to the case, how did I forgot that.
ownagefool 4y ago
Edge security isn't really a thing. Like sure, you could ship a router, firewall, IPS, WAF, et all. But if you're not stopping outbound, controlling clients ability to talk to each other, and blocking things like UPNP, then you're still basically on an untrusted network. Your options are basically make the network unuseable or mark it untrusted. At that point you might as well just force all traffic through a VPN.
c0nsumer 4y ago
OP here. Honestly, in my experience here in the US, /most/ people's home networks are just fine. There's just edge cases, and then there's weirdness like this. I think COVID WFH / School-From-Home was actually a boon for internet access in the US as it forced a lot of people to think about their home internet connection as more than just a binary works/doesn't. Something like this, for a large company, would be another massive thing to maintain. It'd be a whole additional cost to buy, platform to manage and support and patch and upgrade. And people would still just plug them into whatever network jack they see. Then there's the whole management/update infrastructure that'd have to be built and secured and maintained... It'd basically be like reimplementing what Cisco offers with Meraki, a small remote VPN box, but for everyone. Not cheap at all, and for most users, just not necessary.
forinti 4y ago
You can get routers with OpenWRT from the factory. So there's not even the cost of reflashing them.
- c0nsumer 4y ago
  The cost of this sort of thing for a company comes from support and maintenance, not initial device acquisition or setup. As a thought exercise, consider a company with 50,000 of these... - How do you patch and update them? - How do you deploy configuration changes? - How do you support them as they break? - How do you refresh them as they go EOL / get outdated? And, while this could solve the router layer problem, it doesn't solve the problems with people's home internet connections. Almost no one would use this in place of their home router, so it'll get plugged into them, and then this becomes nothing more than an additional layer of complexity on top of the home network.

by chx 4y ago

fragmede 4y ago

What would the router do in this case? On the other hand, companies will loan out commercial hotspot products (aka what you get from the eg Verizon store so employees can get Internet access at home.

c0nsumer 4y ago
OP here. And anecdotes, but almost everyone at this company as a Verizon mobile that has data enabled for tethering as needed, but then some people would... ...use it for Netflix and actually hit the "unlimited" data caps and get throttled. ...name their mobile network the same as their home network with the same password. ...place the phone somewhere weird (in the basement where they work, up against an earth-backed concrete/rebar wall, and complain that it's "too slow". There's almost no end to weird things people can do with tech and then blame just the tech. There are constant new problems that need to be handled on a case by case basis, because the root causes are not solvable solely by technical means.
- fragmede 4y ago
  The ideal case would seem to be ship employees a laptop with LTE built in
jon-wood 4y ago
I used to work for a company that does development of things like TV apps, and physical hardware. They’d distribute wireless APs to engineers which automatically connected to the corporate VPN and exposed that via the AP for devices which couldn’t be directly configured to do so but needed access to development servers only accessible internally.
- c0nsumer 4y ago
  We have those as well, for similar uses. And for folks for whom any connection to the public internet may want to be avoided. The stuff's expensive, though, so they are not for the day-to-day end users.

hug 4y ago

> Why? Because it wouldn’t work. It’s completely infeasible for an moderate sized non-tech business because the “IT environment”, such as it were, of employees homes is absolutely non-homogenous. You can, as an end-user IT support department, rely on basically only two things about any user’s home kit and ability to interface with it: they have power (usually), and they can probably get internet access via wifi somehow. Any other assumption about their home environment will prove incorrect in some wild way. I’ve run into users that don’t have Ethernet, or WPA2, or any kind of public IP, or next hop latency under 200ms, or more than 1mbps bandwidth. We have users that don’t have home Internet, and for the duration of WFH orders used their company provided phone as a hotspot. I’ve run into users who can’t promise that they’ll have mains power day to day. Even if the user does have Ethernet coming out whatever their NTD might be (and it might be exotic!) you can’t guarantee that they can follow any kind of instruction to set up a router: they are about as likely to end up without a functional internet connection at all as they are to get whatever box it is you give them to work. You also can’t even be sure your instructions will work for whatever it is you’re trying to do. Are you taking into account double NATing? Triple? Do you know that none of your users home ISPs have some kind of MAC whitelist on their NTD? What if their current router is built into some kind of HFC modem? This is not a problem you can solve the mass use case for and address the edge cases: it’s all edge cases, in my experience… and that’s if you’re operating in a single, highly developed first world country.

justsomehnguy 4y ago
> Are you taking into account double NATing? Triple? Usually this is not the problem... till some protocols what rely on port numbers. Like those used in audio/video conferencing. Then it's hell. Overall I want to upvote you twice. The only working way to provide a such thing would be to hand out the one with a mobile modem integrated, SIM inserted, configured, with WiFi SSID and password written on the case with at least 32pts. And still there would be problems.
- justsomehnguy 4y ago
  EDIT: Oh, and the power supply cord epoxied hard to the case, how did I forgot that.

ownagefool 4y ago

Edge security isn't really a thing. Like sure, you could ship a router, firewall, IPS, WAF, et all. But if you're not stopping outbound, controlling clients ability to talk to each other, and blocking things like UPNP, then you're still basically on an untrusted network. Your options are basically make the network unuseable or mark it untrusted. At that point you might as well just force all traffic through a VPN.

c0nsumer 4y ago

OP here. Honestly, in my experience here in the US, /most/ people's home networks are just fine. There's just edge cases, and then there's weirdness like this. I think COVID WFH / School-From-Home was actually a boon for internet access in the US as it forced a lot of people to think about their home internet connection as more than just a binary works/doesn't. Something like this, for a large company, would be another massive thing to maintain. It'd be a whole additional cost to buy, platform to manage and support and patch and upgrade. And people would still just plug them into whatever network jack they see. Then there's the whole management/update infrastructure that'd have to be built and secured and maintained... It'd basically be like reimplementing what Cisco offers with Meraki, a small remote VPN box, but for everyone. Not cheap at all, and for most users, just not necessary.

forinti 4y ago

You can get routers with OpenWRT from the factory. So there's not even the cost of reflashing them.

c0nsumer 4y ago
The cost of this sort of thing for a company comes from support and maintenance, not initial device acquisition or setup. As a thought exercise, consider a company with 50,000 of these... - How do you patch and update them? - How do you deploy configuration changes? - How do you support them as they break? - How do you refresh them as they go EOL / get outdated? And, while this could solve the router layer problem, it doesn't solve the problems with people's home internet connections. Almost no one would use this in place of their home router, so it'll get plugged into them, and then this becomes nothing more than an additional layer of complexity on top of the home network.