4 ms·

I haven't had chance to watch the video yet so apologies if this is covered, but are the ESP32 radios regulatory certifications tied to the official black box f

I haven't had chance to watch the video yet so apologies if this is covered, but are the ESP32 radios regulatory certifications tied to the official black box firmware? Would the same hardware but with open firmware need to be sent to the FCC (and others) again for proper compliance?

mystified5016 2y ago
Yes.
dlcarrier 2y ago
Yes, if distributed that way. No, if modified by the end user. I don't remember the CFR off hand, but the FCC explicitly allows anyone to use small numbers of uncertified devices. It would still be a violation if those devices don't otherwise follow regulations, but using modified hardware or software isn't itself prohibited.
- jdietrich 2y ago
  15.23, but it applies specifically to "home-built devices", so I'm not sure if modification of a commercially available device would be within scope. Devices constructed from a kit are specifically excluded. https://www.ecfr.gov/current/title-47/section-15.23 https://www.ecfr.gov/current/title-47/section-15.23
  - dlcarrier 2y ago
    They excluded kits, because there was a thriving market for pirate radio station transmitters sold as kits.
  - ssl-3 2y ago
    Are home-built devices allowed to be made using things like pre-manufactured valves and transistors? What about integrated circuits? Where's the line drawn? Am I allowed to order some parts from Digikey and assemble them into a widget, or must I start closer to the beginning by mining my own ores?
    - TomatoCo 2y ago
      If you can't make your own protons store bought is okay.
- jgerrish 2y ago
  This could change depending on the fallout from the current drone saga, no pun intended. Or other upcoming events. Even if it's not FCC regulations, but some other agencies, there may be some close re-examination of what's allowed due to safety. I'm guessing certain manufacturers are going to be impacted more than others. I'm sorry for the uncertainty in boardrooms and garages across the world. I diversified my embedded sources but damn it's annoying. But I suppose that's the machine. I just picked up an ESP32-C6 for some mostly legal Bluetooth and maybe Zigbee experiments. I don't plan on hacking to this level, the Rust ecosystem is welcoming enough to make just building fun so far. On a side note, I stepped in shit today. I know I have five q-tips in storage somewhere. And a few more in the closet. Sorry for the weird tangent.
  - paradox460 2y ago
    Chevron being tossed also makes this all immensely more complicated
    - jgerrish 2y ago
      I'm sorry, yeah. It's more than boardrooms and garages. I'm sorry to all. Financial independence is just... it's nice having on top of other security and basic life guarantees. Enjoy it while it is there.
- galangalalgol 2y ago
  The power and directionality rules for ISM bands are good guidelines for not interfering with other's use of the band. If you have another story that makes interference unlikely, it probably also makes it unlikely to get caught. Plenty of items for sale on Amazon don't have any silkscreen on chips or boards, much less an FCC id. If they can get away with it...
numpad0 2y ago
I think it's a gray area. If I'm not grossly mistaken, only worst case radio performances are tested and documented, and the rest of required technical documents are more of rather detailed brochures like high level block diagrams and theory of operations than modern full design documents like PCB manufacturing files and firmware build scripts. They hardly acknowledge existence of firmware. And there is at least one good reason: certified and unlicensed radio equipment, like Wi-Fi(or unlike HAM) are expected to be tamper resistant, for public good. And so last time FCC discussed certification requirements for Wi-Fi routers, they naturally considered extending it to software in form of mandatory Secure Boot - for every ultra vulnerable garbage Wi-Fi routers! That was a horrible idea and was scrapped. For now, I think, IANAL, this is semi-legal or semi-illegal unless resulting firmware clearly generates out-of-spec emissions.
- AnthonyMouse 2y ago
  > And there is at least one good reason: certified and unlicensed radio equipment, like Wi-Fi(or unlike HAM) are expected to be tamper resistant, for public good. This is such an own-goal. The way manufacturers implement this is by locking out third party firmware. Then the device goes out of support a decade before people stop using it, but because nobody else can update it either -- and the manufacturer has higher internal support costs because there is no community submitting patches they could just adopt and ship -- the device gets full of public unpatched security vulnerabilities. Which at scale is a significant threat to national security. On top of losing whatever other benefits the public would derive from the community being able to fix firmware bugs or add features. Meanwhile the purpose of the requirement is supposed to be to keep users from modifying the radio parameters to exceed regulatory limits. Which, first of all, hardly anybody is going to do anyway, because the vast majority of people don't even know how and most of the remainder aren't interested in risking huge fines just to avoid buying a second access point. But the people who are going to do it, because the devices don't get patched, can just use the vulnerabilities to root them and then modify the radio parameters anyway. Which makes it a pointless rule that compromises the public good.
  - numpad0 2y ago

mystified5016 2y ago

Yes.

dlcarrier 2y ago

Yes, if distributed that way. No, if modified by the end user. I don't remember the CFR off hand, but the FCC explicitly allows anyone to use small numbers of uncertified devices. It would still be a violation if those devices don't otherwise follow regulations, but using modified hardware or software isn't itself prohibited.

jdietrich 2y ago
15.23, but it applies specifically to "home-built devices", so I'm not sure if modification of a commercially available device would be within scope. Devices constructed from a kit are specifically excluded. https://www.ecfr.gov/current/title-47/section-15.23 https://www.ecfr.gov/current/title-47/section-15.23
- dlcarrier 2y ago
  They excluded kits, because there was a thriving market for pirate radio station transmitters sold as kits.
- ssl-3 2y ago
  Are home-built devices allowed to be made using things like pre-manufactured valves and transistors? What about integrated circuits? Where's the line drawn? Am I allowed to order some parts from Digikey and assemble them into a widget, or must I start closer to the beginning by mining my own ores?
  - TomatoCo 2y ago
    If you can't make your own protons store bought is okay.
jgerrish 2y ago
This could change depending on the fallout from the current drone saga, no pun intended. Or other upcoming events. Even if it's not FCC regulations, but some other agencies, there may be some close re-examination of what's allowed due to safety. I'm guessing certain manufacturers are going to be impacted more than others. I'm sorry for the uncertainty in boardrooms and garages across the world. I diversified my embedded sources but damn it's annoying. But I suppose that's the machine. I just picked up an ESP32-C6 for some mostly legal Bluetooth and maybe Zigbee experiments. I don't plan on hacking to this level, the Rust ecosystem is welcoming enough to make just building fun so far. On a side note, I stepped in shit today. I know I have five q-tips in storage somewhere. And a few more in the closet. Sorry for the weird tangent.
- paradox460 2y ago
  Chevron being tossed also makes this all immensely more complicated
  - jgerrish 2y ago
    I'm sorry, yeah. It's more than boardrooms and garages. I'm sorry to all. Financial independence is just... it's nice having on top of other security and basic life guarantees. Enjoy it while it is there.
galangalalgol 2y ago
The power and directionality rules for ISM bands are good guidelines for not interfering with other's use of the band. If you have another story that makes interference unlikely, it probably also makes it unlikely to get caught. Plenty of items for sale on Amazon don't have any silkscreen on chips or boards, much less an FCC id. If they can get away with it...

numpad0 2y ago

I think it's a gray area. If I'm not grossly mistaken, only worst case radio performances are tested and documented, and the rest of required technical documents are more of rather detailed brochures like high level block diagrams and theory of operations than modern full design documents like PCB manufacturing files and firmware build scripts. They hardly acknowledge existence of firmware. And there is at least one good reason: certified and unlicensed radio equipment, like Wi-Fi(or unlike HAM) are expected to be tamper resistant, for public good. And so last time FCC discussed certification requirements for Wi-Fi routers, they naturally considered extending it to software in form of mandatory Secure Boot - for every ultra vulnerable garbage Wi-Fi routers! That was a horrible idea and was scrapped. For now, I think, IANAL, this is semi-legal or semi-illegal unless resulting firmware clearly generates out-of-spec emissions.

AnthonyMouse 2y ago
> And there is at least one good reason: certified and unlicensed radio equipment, like Wi-Fi(or unlike HAM) are expected to be tamper resistant, for public good. This is such an own-goal. The way manufacturers implement this is by locking out third party firmware. Then the device goes out of support a decade before people stop using it, but because nobody else can update it either -- and the manufacturer has higher internal support costs because there is no community submitting patches they could just adopt and ship -- the device gets full of public unpatched security vulnerabilities. Which at scale is a significant threat to national security. On top of losing whatever other benefits the public would derive from the community being able to fix firmware bugs or add features. Meanwhile the purpose of the requirement is supposed to be to keep users from modifying the radio parameters to exceed regulatory limits. Which, first of all, hardly anybody is going to do anyway, because the vast majority of people don't even know how and most of the remainder aren't interested in risking huge fines just to avoid buying a second access point. But the people who are going to do it, because the devices don't get patched, can just use the vulnerabilities to root them and then modify the radio parameters anyway. Which makes it a pointless rule that compromises the public good.
- numpad0 2y ago