6 ms·

But what if someone moves or simply uses hardware in a different region that's sold? What if the laws change? The correct 'work around' is to build a kernel w

But what if someone moves or simply uses hardware in a different region that's sold? What if the laws change? The correct 'work around' is to build a kernel with a DEFAULT regulatory domain, abstract from any vendor's specific implementation, allow that domain to be updated at runtime (particularly for mobile devices), and follow the laws there in. I also advocate (in this post) for wifi_regulations=BREAKTHELAWANDDISABLE (allcaps required) to completely bypass filtering channels. This would be useful in some situations such as isolated testing environments, use in International Waters, and any other environment that's isolated enough.

jodrellblank 4y ago
If you aren't breaking any laws transmitting like that in International Waters, why call it BREAKTHELAW and call out that use case? If you are breaking laws transmitting like that in International Waters, why would this setting be called out as specifically useful in International Waters? Neither seems to make sense. (And does this come from the Microsoft team who came up with setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF ?)
- mjevans 4y ago
  It doesn't make sense to call the same option multiple things for such a small number of use cases; you really want the last thing, but someone might not know that in _many_ circumstances it could be against the law to use it, hence the prefix to document that. Edit: ALSO, in case it wasn't clear... E.G. wifi_regulations=USA or wifi_regulations=CDN or wifi_regulations=GBR or some other set of country codes / match in the table of known regulations. A longer string that manually specifies allowed frequencies in some way might also work.
stefan_ 4y ago
Keep in mind that for stations only (e.g. mobile devices most of the time), the rules are relaxed: if the station sees an AP operating on some channel, it is allowed to assume that it can operate on that channel. And of course passively scanning a channel to check for the presence of an AP is not transmitting, so no regulatory problem there. But don't worry, for 6 GHz the FCC has come up with even more insane stuff: if you want to unlock more channels and power, your AP will have to (1) geolocate itself and (2) contact a central server to determine regulatory restrictions for that location. They are calling this Automatic Frequency Coordination (AFC). See page 13 of https://docs.fcc.gov/public/attachments/DOC-363490A1.pdf https://docs.fcc.gov/public/attachments/DOC-363490A1.pdf: > We will require the AFC to use a centralized model where each standard-power access point remotely accesses an AFC to obtain a list of available frequency ranges in which it is permitted to operate and the maximum permissible power in each frequency range
- dcow 4y ago
  Why does the FCC even care so much? What nefarious things can the average consumer possibly do that a motivated attacker can't already do? A motivated attacker who wants to change all the street lights to green will have hardware that lets them do whatever they want. The other 99.999% of people will just use their system as configured by their software vendor, legally. Why do we need hardware failsafes? Why do we need certifiably absurd things happening at the driver level like AFC? It's not like this is a health and safety issue--these consumer devices shouldn't be capable of transmitting that much radiation regardless. So why does the FCC care so much? Is there a history of disaster related to consumer radios operating illegally that I'm unaware of?
  - jiggawatts 4y ago
    The FAA raised a huge stink recently because they weren’t ready for 5G rollout and were worried that the altimeter radar would give false readings on approach to landing. Agencies — even when in the wrong — can throw their weight around and demand that the FCC ban things. Consumers like you and me have no real representation in government so we have no political clout and can’t throw our weight around to demand simpler legislation.
    - csdvrx 4y ago
      > The FAA raised a huge stink recently because they weren’t ready for 5G rollout and were worried that the altimeter radar would give false readings on approach to landing. If the FAA didn't do its job and certified altimeters that shouldn't have been, as the 5G rollout was announced and previsible, maybe they should start working instead of complaining that others help them do their job? Also, if all it takes to mess with altimeters is a rogue 5G cell, the right approach is to harden the altimeters, instead of hoping no 5G cell ever will be misconfigured or pushed wrong configuation parameters by a enemy country or ransomware hacker group.
      - trifurcate 4y ago
        > Also, if all it takes to mess with altimeters is a rogue 5G cell, the right approach is to harden the altimeters, instead of hoping no 5G cell ever will be misconfigured or pushed wrong configuation parameters by a enemy country or ransomware hacker group. Wow, that is a lot of misconception about the threat model and real issue at hand packed into a single sentence. First of all, great, let's say you're right. How do you harden the existing altimeters out there, equipped on thousands of aircraft? These are sensitive, tightly controlled and life-critical instruments. Radar altimeters have been in use for decades, almost a century now, and so the FAA is for the most part talking about already installed altimeters which were designed far before 5G was ever a thing. Likely most of their designs will not readily accommodate hardening against new kinds of RF interference. If you managed to patch all the different kinds out there and get fixes pushed out, that'd be a great effort in labor, logistics, and certification. Of course, one could simply replace the old radar altimeters with new ones, at a much greater cost too. Separately from the difficulty of actual hardening, there's the question to be asked of, why ask old technology to adapt to new one when we can adapt the new technology to suit the old? Especially because, again, these are safety critical instruments that you don't wanna mess with, whereas 5G towers are much better suited to new experiments or fixes, or just being designed correctly and safely from the get go when the technology hasn't even launched yet. And then, why do you think this is a security issue, as in an attacker aiming to disrupt air travel? You must be aware that most all aviation radio comms are in the clear and extremely easy to jam and spoof, including critical instrument systems like ILS. That is not the threat model! The FAA is worried about interference from ordinary people trying to use their cellphones, rather than a specialized attacker targeting radar altimeters. Of course, because these are two very different situations!

jodrellblank 4y ago

If you aren't breaking any laws transmitting like that in International Waters, why call it BREAKTHELAW and call out that use case? If you are breaking laws transmitting like that in International Waters, why would this setting be called out as specifically useful in International Waters? Neither seems to make sense. (And does this come from the Microsoft team who came up with setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF ?)

mjevans 4y ago
It doesn't make sense to call the same option multiple things for such a small number of use cases; you really want the last thing, but someone might not know that in _many_ circumstances it could be against the law to use it, hence the prefix to document that. Edit: ALSO, in case it wasn't clear... E.G. wifi_regulations=USA or wifi_regulations=CDN or wifi_regulations=GBR or some other set of country codes / match in the table of known regulations. A longer string that manually specifies allowed frequencies in some way might also work.

stefan_ 4y ago

Keep in mind that for stations only (e.g. mobile devices most of the time), the rules are relaxed: if the station sees an AP operating on some channel, it is allowed to assume that it can operate on that channel. And of course passively scanning a channel to check for the presence of an AP is not transmitting, so no regulatory problem there. But don't worry, for 6 GHz the FCC has come up with even more insane stuff: if you want to unlock more channels and power, your AP will have to (1) geolocate itself and (2) contact a central server to determine regulatory restrictions for that location. They are calling this Automatic Frequency Coordination (AFC). See page 13 of https://docs.fcc.gov/public/attachments/DOC-363490A1.pdf https://docs.fcc.gov/public/attachments/DOC-363490A1.pdf: > We will require the AFC to use a centralized model where each standard-power access point remotely accesses an AFC to obtain a list of available frequency ranges in which it is permitted to operate and the maximum permissible power in each frequency range

dcow 4y ago
Why does the FCC even care so much? What nefarious things can the average consumer possibly do that a motivated attacker can't already do? A motivated attacker who wants to change all the street lights to green will have hardware that lets them do whatever they want. The other 99.999% of people will just use their system as configured by their software vendor, legally. Why do we need hardware failsafes? Why do we need certifiably absurd things happening at the driver level like AFC? It's not like this is a health and safety issue--these consumer devices shouldn't be capable of transmitting that much radiation regardless. So why does the FCC care so much? Is there a history of disaster related to consumer radios operating illegally that I'm unaware of?
- jiggawatts 4y ago
  The FAA raised a huge stink recently because they weren’t ready for 5G rollout and were worried that the altimeter radar would give false readings on approach to landing. Agencies — even when in the wrong — can throw their weight around and demand that the FCC ban things. Consumers like you and me have no real representation in government so we have no political clout and can’t throw our weight around to demand simpler legislation.
  - csdvrx 4y ago
    > The FAA raised a huge stink recently because they weren’t ready for 5G rollout and were worried that the altimeter radar would give false readings on approach to landing. If the FAA didn't do its job and certified altimeters that shouldn't have been, as the 5G rollout was announced and previsible, maybe they should start working instead of complaining that others help them do their job? Also, if all it takes to mess with altimeters is a rogue 5G cell, the right approach is to harden the altimeters, instead of hoping no 5G cell ever will be misconfigured or pushed wrong configuation parameters by a enemy country or ransomware hacker group.
    - trifurcate 4y ago
      > Also, if all it takes to mess with altimeters is a rogue 5G cell, the right approach is to harden the altimeters, instead of hoping no 5G cell ever will be misconfigured or pushed wrong configuation parameters by a enemy country or ransomware hacker group. Wow, that is a lot of misconception about the threat model and real issue at hand packed into a single sentence. First of all, great, let's say you're right. How do you harden the existing altimeters out there, equipped on thousands of aircraft? These are sensitive, tightly controlled and life-critical instruments. Radar altimeters have been in use for decades, almost a century now, and so the FAA is for the most part talking about already installed altimeters which were designed far before 5G was ever a thing. Likely most of their designs will not readily accommodate hardening against new kinds of RF interference. If you managed to patch all the different kinds out there and get fixes pushed out, that'd be a great effort in labor, logistics, and certification. Of course, one could simply replace the old radar altimeters with new ones, at a much greater cost too. Separately from the difficulty of actual hardening, there's the question to be asked of, why ask old technology to adapt to new one when we can adapt the new technology to suit the old? Especially because, again, these are safety critical instruments that you don't wanna mess with, whereas 5G towers are much better suited to new experiments or fixes, or just being designed correctly and safely from the get go when the technology hasn't even launched yet. And then, why do you think this is a security issue, as in an attacker aiming to disrupt air travel? You must be aware that most all aviation radio comms are in the clear and extremely easy to jam and spoof, including critical instrument systems like ILS. That is not the threat model! The FAA is worried about interference from ordinary people trying to use their cellphones, rather than a specialized attacker targeting radar altimeters. Of course, because these are two very different situations!