3 ms·

Not sure how wise it is to use Huawei networking gear when it's been banned in some countries for security reasons. Also, setting up wifi access points through

Not sure how wise it is to use Huawei networking gear when it's been banned in some countries for security reasons. Also, setting up wifi access points through Debian can be a bit tedious. I simply recommend OpenWRT when it comes to router software, especially since it comes with firmware and patches for wifi, (such as 5ghz transmit support on atheros) and also provides simple configuration for things like 802.11s mesh networking, and multiple concurrent SSIDs.

mindslight 3y ago
Perhaps you could elaborate on a specific threat model rather than just handwaving about Huawei? As far as I can tell, the two significant threats of Huawei infrastructure are: 1. Massive DoS at a strategic moment, which is more relevant at country-scale with everyone losing communication simultaneously, rather than a few rare people having personal problems with their infrastructure. 2. Eavesdropping and backhauling the network traffic somehow. This mainly applies to corporations and governments wanting to keep using outdated plain text or even unauthenticated protocols. Individuals should be encrypting everything regardless of who makes the network gear. Especially as most countries lack privacy legislation or functional constraints on government, meaning that the WAN gear is an attacker regardless of who made it. As far as wifi access points, I never had a problem with Debian or now NixOS. OpenWRT is a bunch of clicking and bespoke management, which is exactly what I don't want.
- waste_monk 3y ago
  I'd be more worried about a more permanent DoS with some kind of remote kill-switch. Maybe something that sets an e-fuse and permanently bricks a device. It would not be a big deal for one individual user to have their ONT / router / etc. killed, but if you had a million devices bricked at approximately the same time it would be extremely disruptive. With work-from-home being so prevalent these days, having a million households suddenly knocked off the internet could be disastrous to the economy. Let alone if something like this happened to an ISP or telco's backbone equipment. Nothing that could not be worked around eventually, given time and replacement equipment, but then consider the case where the kill-switch is activated during a trade embargo and you can't source replacement equipment for weeks/months... not fun. Let alone the case where a kill-switch is activated as a disruption immediately prior to a military conflict (even if your military and government comms are 100% unaffected, there would be utter chaos on the civilian side as people assumed their friends have been bombed because they can't get in contact, remote work being crippled, etc. that would take days or weeks to calm down). Completely legit IMHO to not want Huawei deployed at scale or as part of infrastructure in your country, or any equipment with similar concerns, and I am glad it is banned in my country. It sounds paranoid, but keep in mind the Chinese government must agree as well - they are trying to replace their dependence on foreign tech by replacing it with local equivalents [1], such as replacing Intel gear with China's domestically manufactured Zhaoxin processors. [1] https://medium.com/technicity/chinese-3-5-2-policy-is-a-major-move-towards-tech-independence-48d178157b3f https://medium.com/technicity/chinese-3-5-2-policy-is-a-majo...
  - mindslight 3y ago
    I wasn't downplaying the problem with widespread infrastructure being Huawei? The scenario you're describing is exactly what I was alluding to in my #1. Rather the comment I responded to seemed to just be uncritically beating the dead horse of "Huawei bad", when it's not really a big deal in the individual use context. And in fact rereading the original post, the original ISP-supplied gear was Huawei as well! Which I do agree that widespread usage of is a problem. But the author's replacing of a Huawei standlone ONT with a Huawei SFP ONT doesn't affect much there! And sure maybe it could have been great opportunity to harden up the author's infrastructure so that they could still have comms even if everyone else's went dark. Except that the OLT (other end of the link) is likely Huawei as well since ONTs aren't chosen in a vacuum.

mindslight 3y ago

Perhaps you could elaborate on a specific threat model rather than just handwaving about Huawei? As far as I can tell, the two significant threats of Huawei infrastructure are: 1. Massive DoS at a strategic moment, which is more relevant at country-scale with everyone losing communication simultaneously, rather than a few rare people having personal problems with their infrastructure. 2. Eavesdropping and backhauling the network traffic somehow. This mainly applies to corporations and governments wanting to keep using outdated plain text or even unauthenticated protocols. Individuals should be encrypting everything regardless of who makes the network gear. Especially as most countries lack privacy legislation or functional constraints on government, meaning that the WAN gear is an attacker regardless of who made it. As far as wifi access points, I never had a problem with Debian or now NixOS. OpenWRT is a bunch of clicking and bespoke management, which is exactly what I don't want.

waste_monk 3y ago
I'd be more worried about a more permanent DoS with some kind of remote kill-switch. Maybe something that sets an e-fuse and permanently bricks a device. It would not be a big deal for one individual user to have their ONT / router / etc. killed, but if you had a million devices bricked at approximately the same time it would be extremely disruptive. With work-from-home being so prevalent these days, having a million households suddenly knocked off the internet could be disastrous to the economy. Let alone if something like this happened to an ISP or telco's backbone equipment. Nothing that could not be worked around eventually, given time and replacement equipment, but then consider the case where the kill-switch is activated during a trade embargo and you can't source replacement equipment for weeks/months... not fun. Let alone the case where a kill-switch is activated as a disruption immediately prior to a military conflict (even if your military and government comms are 100% unaffected, there would be utter chaos on the civilian side as people assumed their friends have been bombed because they can't get in contact, remote work being crippled, etc. that would take days or weeks to calm down). Completely legit IMHO to not want Huawei deployed at scale or as part of infrastructure in your country, or any equipment with similar concerns, and I am glad it is banned in my country. It sounds paranoid, but keep in mind the Chinese government must agree as well - they are trying to replace their dependence on foreign tech by replacing it with local equivalents [1], such as replacing Intel gear with China's domestically manufactured Zhaoxin processors. [1] https://medium.com/technicity/chinese-3-5-2-policy-is-a-major-move-towards-tech-independence-48d178157b3f https://medium.com/technicity/chinese-3-5-2-policy-is-a-majo...
- mindslight 3y ago
  I wasn't downplaying the problem with widespread infrastructure being Huawei? The scenario you're describing is exactly what I was alluding to in my #1. Rather the comment I responded to seemed to just be uncritically beating the dead horse of "Huawei bad", when it's not really a big deal in the individual use context. And in fact rereading the original post, the original ISP-supplied gear was Huawei as well! Which I do agree that widespread usage of is a problem. But the author's replacing of a Huawei standlone ONT with a Huawei SFP ONT doesn't affect much there! And sure maybe it could have been great opportunity to harden up the author's infrastructure so that they could still have comms even if everyone else's went dark. Except that the OLT (other end of the link) is likely Huawei as well since ONTs aren't chosen in a vacuum.