4 ms·

On a more serious note, is this any different from ISPs having a remote management system for ISP provided routers? Maybe, but in more and more European countr

On a more serious note, is this any different from ISPs having a remote management system for ISP provided routers? Maybe, but in more and more European countries, ISPs are required to accommodate you hooking up your own router/modem. E.g., I am on fiber and if I want to I can hook up my own router directly to fiber with an SFP+ module (I currently use the ISP-provided media converter, but my own router). Lots of tech users use their own Ubiquiti/OPNsense/OpenWrt routers, so no remote management. I wonder if this requirement applies to Starlink as well, since they are an ISP.

prajaybasu 1y ago
As far as I'm aware, they are only required to allow you to use your own router. DSL tech is far simpler and it's always a combo unit so I could see a case where you would be allowed to bring your own DSL modem. But it just doesn't work like that for DOCSIS or GPON where the cable modems or ONTs these days do much more than just media conversion - SIP, PPPoE, IGMP, etc. even if they don't do Wi-Fi (so ISPs don't call them "routers" - except SingTel, which uses "ONR" to distinguish these units because they are in fact routers for IPTV and SIP). For all of those modems/ONTs, the firmware updates and the configuration for telephony/SIP and PPPoE are controlled by the ISP and also tested to work with their OLT or CMTS so it's just not possible for the ISP to guarantee support for any random modem or ONT. And to support the advanced configuration required these days for VoIP, IPTV, etc. on the "modem" or "ONT", ISPs basically have a backdoor called TR-069 which is really not too dissimilar to what Starlink has access to with their SSH keys. Even if you get "true" dumb modems or ONTs which do not do any routing whatsoever, the device on the other side still has full control over your dumb device via the DOCSIS provisioning process or GPON's OMCI. Starlink seems to be using SSH instead of building a whole protocol - because satellite tech is proprietary and doesn't need to work on other hardware. So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this. At most, I think using your own router would require the EU ISPs to provide bridge mode support, but that's not special to EU. However, the TR-069 backdoor is still active even with bridge mode. It can be fairly easy to stop TR-069 with a "dumb" ONT (usually SFP) but ISPs can and will notice that. Whether they allow it is up to them.
- bkor 1y ago
  > So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this. Ziggo (called UPC in other EU countries) uses DOCSIS. The instructions on how to use your own DOCSIS modem are at the following link (in Dutch): https://www.ziggo.nl/klantenservice/apparaten/wifi-modems/eigen-modem#vragen https://www.ziggo.nl/klantenservice/apparaten/wifi-modems/ei... Edit: it really is using your own modem. It's not about putting it in bridge mode.
  - donnachangstein 1y ago
    "Your" modem is netbooting "their" firmware and they have full remote access on a management interface.
    - kotaKat 1y ago
      This. I can just provision in the backdoor interface on the modem with a config file anyways and gain access. Plus depending on model (like Arris modems), I can do things like set the password of the day seed (away from the factory default) to further lock it down and gain management access remotely.
      - microtonal 1y ago
        I don't know much about DOCSIS, but this is absolutely false for fiber here in The Netherlands. You can hook up your own OPNsense machine (or whatever you like) with an SFP+ module of your own choosing (as long as the transmitter is compatible, etc.). There is no way for the ISP to do any remote management. DOCSIS is slowly dying here anyway and bleeding customers because the cable providers are not competitive when it comes to internet. If they didn't have better linear TV packages the bleed would even be larger.
        kotaKat 1y ago
        DOCSIS modems require a configuration file from the cable modem termination system. This dictates the whole configuration from RF map and channel plan to things like QoS and management. Even with a customer-supplied modem, the CMTS will still supply a configuration file the modem must obey (and the CMTS will enforce). For many modems on the customer market this also can mean that the ISP can push their own version of the firmware for a modem if you buy identical - such as pushing SURFboard updates.
donnachangstein 1y ago
> I am on fiber and if I want to I can hook up my own router directly to fiber with an SFP+ module I don't think you quite understand how this works. The ISP controls whatever the other end of that fiber is plugged into. It doesn't matter if the medium is fiber, or copper, or a piece of string. The ISP always has control of the other side of the customer interface. It doesn't matter if the box physically resides in your home or not. In the case of Starlink, it's all contained within one box. In the case of DOCSIS (cable), you may physically own the modem, but the ISP controls the firmware it netboots and has full remote admin to the device.
- mattclarkdotnet 1y ago
  Owning the modem only gives them access to the link layer. It didn’t give them any access to my router or to my https traffic
  - jmb99 1y ago
    Do you think root access on your router gives access to your unencrypted https traffic?
    - conorjh 1y ago
      depends
    - lupusreal 1y ago
      It gives them access to the LAN so they can, for instance, figure out how many internet gadgets your house has and sell that information to advertisers, or do even worse than than.
    - deleted 1y ago
      [deleted]
- microtonal 1y ago
  Sorry, but your answer is all over the place. First you talk about the other end and then you talk about the modem. I don't care about DOCSIS, it's slowly dying here, almost all people have fiber to home in my country (last time I checked, it's getting close to 90%). So, let's talk about fiber. So: The ISP controls whatever the other end of that fiber is plugged into. It doesn't matter if the medium is fiber, or copper, or a piece of string. The ISP always has control of the other side of the customer interface. It doesn't matter if the box physically resides in your home or not. Sure, the ISP owns the other end, but what's your point? By using my own router (and my own SFP+ module, which is less important), the ISP does not have a device (backdoor) on my network and cannot control my router. Sure, they could capture traffic on their end, but at that point it's pretty much all encrypted anyway. If I don't trust my provider knowing to what individual hosts I connect, I could set my router to tunnel all traffic to another host/VPN/whatever. At any rate, using your own router + maybe modem removes the worst backdoor when it comes to providers.
miki123211 1y ago
Starlink is not an ISP in the traditional sense. If a normal ISP wants to operate in country a, they need infrastructure in country a. This means they either follow country a's laws or that infrastructure gets seized. Starlink could just as well be operating entirely from the US, and there's very little that foreign governments could do to stop them if they break some foreign laws. They could make payments and shipping complicated, which is probably why Starlink would rather comply if the requests are somewhat reasonable, but Musk has indicated multiple times that he's willing to stand up to unreasonable restrictions if the need is dire enough.
- ratatoskrt 1y ago
  This is not at all how laws actually work. If you sell a product to customers in a specific country, you generally have to comply with local laws. You might be able to avoid this if you're very small and your service is entirely virtual. However, as long as Starlink needs to provide their customers with physical hardware, there are numerous ways to enforce regulations. And you can always go after people - and I mean both Starlink executives and customers.
  - dangus 1y ago
    Right, if this is how it worked we’d have to explain how companies like DeepCool and Huawei are banned from doing business in the US.
    - zdragnar 1y ago
      Half of the EU have also banned ZTE and Huawei equipment, so it's not just a US thing.
- verzali 1y ago
  Some countries require you to have ground infrastructure in the country to operate satellite systems. Starlink's architecture also means they need to have a lot of ground stations all over the place. They can skip some areas if they need to and still offer service, but they'd seriously struggle to provide a global service by using only US ground stations.
lupusreal 1y ago
AFAIK, in America, ISPs are required to permit user-provided modems as long as those modems are technologically compatible. I believe the Television Viewer Protection Act of 2019 did this, although it was already the norm for ISPs to permit third party modems before this.. I guess because they knew if they pushed the issue they'd lose anyway, given the precedent of telephones, cable cards, etc. The problem then with Starlink is nobody is manufacturing compatible third party Starlink terminals, at least yet.
- surfaceofthesun 1y ago
  I'm not sure if that applies to Fiber connections. I had my own fun with a firmware update causing latency issues with ATT Fiber's gateways that was fixed several months later [1]. I was using the combo ONT + Router originally and had to switch to dedicated ONT. I ended up extracting 802.1x certificates with this[2] or a similar tool and interfacing directly with the ONT using OPNSense [3]. I was so angry I filed an FTC complaint because I had to do this bypass to do my job (the latency was so bad). --- [1] -- Linking to Reddit due to DSLReports going Down. https://www.reddit.com/r/ATTFiber/comments/1dwwh61/comment/lptj3rn/?share_id=cAIWhRXf0CsEt07-kPzpn=1 https://www.reddit.com/r/ATTFiber/comments/1dwwh61/comment/l... [2] -- https://github.com/0x888e/certs https://github.com/0x888e/certs [3] -- https://forum.opnsense.org/index.php?PHPSESSID=t6vvukft2ahga5e3e7o19cu51r&topic=41730.15 https://forum.opnsense.org/index.php?PHPSESSID=t6vvukft2ahga...
genewitch 1y ago
No idea if it is required, but you can use a third party router with starlink; and, in fact, must, if you want routable ipv6. Ipv4 is cgnat no matter what. I know this because I tested this.

prajaybasu 1y ago

As far as I'm aware, they are only required to allow you to use your own router. DSL tech is far simpler and it's always a combo unit so I could see a case where you would be allowed to bring your own DSL modem. But it just doesn't work like that for DOCSIS or GPON where the cable modems or ONTs these days do much more than just media conversion - SIP, PPPoE, IGMP, etc. even if they don't do Wi-Fi (so ISPs don't call them "routers" - except SingTel, which uses "ONR" to distinguish these units because they are in fact routers for IPTV and SIP). For all of those modems/ONTs, the firmware updates and the configuration for telephony/SIP and PPPoE are controlled by the ISP and also tested to work with their OLT or CMTS so it's just not possible for the ISP to guarantee support for any random modem or ONT. And to support the advanced configuration required these days for VoIP, IPTV, etc. on the "modem" or "ONT", ISPs basically have a backdoor called TR-069 which is really not too dissimilar to what Starlink has access to with their SSH keys. Even if you get "true" dumb modems or ONTs which do not do any routing whatsoever, the device on the other side still has full control over your dumb device via the DOCSIS provisioning process or GPON's OMCI. Starlink seems to be using SSH instead of building a whole protocol - because satellite tech is proprietary and doesn't need to work on other hardware. So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this. At most, I think using your own router would require the EU ISPs to provide bridge mode support, but that's not special to EU. However, the TR-069 backdoor is still active even with bridge mode. It can be fairly easy to stop TR-069 with a "dumb" ONT (usually SFP) but ISPs can and will notice that. Whether they allow it is up to them.

bkor 1y ago
> So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this. Ziggo (called UPC in other EU countries) uses DOCSIS. The instructions on how to use your own DOCSIS modem are at the following link (in Dutch): https://www.ziggo.nl/klantenservice/apparaten/wifi-modems/eigen-modem#vragen https://www.ziggo.nl/klantenservice/apparaten/wifi-modems/ei... Edit: it really is using your own modem. It's not about putting it in bridge mode.
- donnachangstein 1y ago
  "Your" modem is netbooting "their" firmware and they have full remote access on a management interface.
  - kotaKat 1y ago
    This. I can just provision in the backdoor interface on the modem with a config file anyways and gain access. Plus depending on model (like Arris modems), I can do things like set the password of the day seed (away from the factory default) to further lock it down and gain management access remotely.
    - microtonal 1y ago
      I don't know much about DOCSIS, but this is absolutely false for fiber here in The Netherlands. You can hook up your own OPNsense machine (or whatever you like) with an SFP+ module of your own choosing (as long as the transmitter is compatible, etc.). There is no way for the ISP to do any remote management. DOCSIS is slowly dying here anyway and bleeding customers because the cable providers are not competitive when it comes to internet. If they didn't have better linear TV packages the bleed would even be larger.
      - kotaKat 1y ago
        DOCSIS modems require a configuration file from the cable modem termination system. This dictates the whole configuration from RF map and channel plan to things like QoS and management. Even with a customer-supplied modem, the CMTS will still supply a configuration file the modem must obey (and the CMTS will enforce). For many modems on the customer market this also can mean that the ISP can push their own version of the firmware for a modem if you buy identical - such as pushing SURFboard updates.

donnachangstein 1y ago

> I am on fiber and if I want to I can hook up my own router directly to fiber with an SFP+ module I don't think you quite understand how this works. The ISP controls whatever the other end of that fiber is plugged into. It doesn't matter if the medium is fiber, or copper, or a piece of string. The ISP always has control of the other side of the customer interface. It doesn't matter if the box physically resides in your home or not. In the case of Starlink, it's all contained within one box. In the case of DOCSIS (cable), you may physically own the modem, but the ISP controls the firmware it netboots and has full remote admin to the device.

mattclarkdotnet 1y ago
Owning the modem only gives them access to the link layer. It didn’t give them any access to my router or to my https traffic
- jmb99 1y ago
  Do you think root access on your router gives access to your unencrypted https traffic?
  - conorjh 1y ago
    depends
  - lupusreal 1y ago
    It gives them access to the LAN so they can, for instance, figure out how many internet gadgets your house has and sell that information to advertisers, or do even worse than than.
  - deleted 1y ago
    [deleted]
microtonal 1y ago
Sorry, but your answer is all over the place. First you talk about the other end and then you talk about the modem. I don't care about DOCSIS, it's slowly dying here, almost all people have fiber to home in my country (last time I checked, it's getting close to 90%). So, let's talk about fiber. So: The ISP controls whatever the other end of that fiber is plugged into. It doesn't matter if the medium is fiber, or copper, or a piece of string. The ISP always has control of the other side of the customer interface. It doesn't matter if the box physically resides in your home or not. Sure, the ISP owns the other end, but what's your point? By using my own router (and my own SFP+ module, which is less important), the ISP does not have a device (backdoor) on my network and cannot control my router. Sure, they could capture traffic on their end, but at that point it's pretty much all encrypted anyway. If I don't trust my provider knowing to what individual hosts I connect, I could set my router to tunnel all traffic to another host/VPN/whatever. At any rate, using your own router + maybe modem removes the worst backdoor when it comes to providers.

miki123211 1y ago

Starlink is not an ISP in the traditional sense. If a normal ISP wants to operate in country a, they need infrastructure in country a. This means they either follow country a's laws or that infrastructure gets seized. Starlink could just as well be operating entirely from the US, and there's very little that foreign governments could do to stop them if they break some foreign laws. They could make payments and shipping complicated, which is probably why Starlink would rather comply if the requests are somewhat reasonable, but Musk has indicated multiple times that he's willing to stand up to unreasonable restrictions if the need is dire enough.

ratatoskrt 1y ago
This is not at all how laws actually work. If you sell a product to customers in a specific country, you generally have to comply with local laws. You might be able to avoid this if you're very small and your service is entirely virtual. However, as long as Starlink needs to provide their customers with physical hardware, there are numerous ways to enforce regulations. And you can always go after people - and I mean both Starlink executives and customers.
- dangus 1y ago
  Right, if this is how it worked we’d have to explain how companies like DeepCool and Huawei are banned from doing business in the US.
  - zdragnar 1y ago
    Half of the EU have also banned ZTE and Huawei equipment, so it's not just a US thing.
verzali 1y ago
Some countries require you to have ground infrastructure in the country to operate satellite systems. Starlink's architecture also means they need to have a lot of ground stations all over the place. They can skip some areas if they need to and still offer service, but they'd seriously struggle to provide a global service by using only US ground stations.

lupusreal 1y ago

AFAIK, in America, ISPs are required to permit user-provided modems as long as those modems are technologically compatible. I believe the Television Viewer Protection Act of 2019 did this, although it was already the norm for ISPs to permit third party modems before this.. I guess because they knew if they pushed the issue they'd lose anyway, given the precedent of telephones, cable cards, etc. The problem then with Starlink is nobody is manufacturing compatible third party Starlink terminals, at least yet.

surfaceofthesun 1y ago
I'm not sure if that applies to Fiber connections. I had my own fun with a firmware update causing latency issues with ATT Fiber's gateways that was fixed several months later [1]. I was using the combo ONT + Router originally and had to switch to dedicated ONT. I ended up extracting 802.1x certificates with this[2] or a similar tool and interfacing directly with the ONT using OPNSense [3]. I was so angry I filed an FTC complaint because I had to do this bypass to do my job (the latency was so bad). --- [1] -- Linking to Reddit due to DSLReports going Down. https://www.reddit.com/r/ATTFiber/comments/1dwwh61/comment/lptj3rn/?share_id=cAIWhRXf0CsEt07-kPzpn=1 https://www.reddit.com/r/ATTFiber/comments/1dwwh61/comment/l... [2] -- https://github.com/0x888e/certs https://github.com/0x888e/certs [3] -- https://forum.opnsense.org/index.php?PHPSESSID=t6vvukft2ahga5e3e7o19cu51r&topic=41730.15 https://forum.opnsense.org/index.php?PHPSESSID=t6vvukft2ahga...

genewitch 1y ago

No idea if it is required, but you can use a third party router with starlink; and, in fact, must, if you want routable ipv6. Ipv4 is cgnat no matter what. I know this because I tested this.