7 ms·

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a rela

> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one. What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using the device for 15. And "require longer support" doesn't fix it because many of the vendors will go out of business. What you need is the ability for consumers to replace the firmware. That solves the problem in three ways. First, when the company goes out of business you can still put a supported third party firmware on the device. Second, you can do that immediately, because the open source firmwares have a better security record than the OEMs to begin with. And third, then the device is running a widely used open source firmware instead of a custom device-specific proprietary black box, which makes it easier for the government or anyone else who is so inclined to find vulnerabilities and patch them.

gerdesj 7mo ago
"You ship something with no known bugs and then someone finds one." You managed to say that with a straight face! Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out. How on earth is embedded creds in any way: "no known bugs"? I think we are on the same side (absolutely) but please don't allow the buggers any credibility!
- AnthonyMouse 7mo ago
  > How on earth is embedded creds in any way: "no known bugs"? You misunderstand how organizational knowledge works. You see, it doesn't. Some embeds the credentials, someone else ships the product. The first person doesn't even necessarily still work there at that point. Remember that time NASA sent a Mars orbiter to Mars and then immediately crashed it because some of them were using pounds and the others newtons? Literally rocket scientists. The best we know how to do here is to keep the incentives aligned so the people who suffer the consequences of something can do something about it. And in this case the people who suffer the consequences are the consumers, not the company that may have already ceased to exist, so we need to give the consumers a good way to fix it.
  - pixl97 7mo ago
    >Some embeds the credentials, someone else ships the product. It doesn't matter. When you are building software, you build a security process, not security individuals or stuff like this happens. >orbiter to Mars and then immediately crashed Right, and it cost NASA 1.4 billion+ is direct losses to them. With software writers the losses occur to the end user.
    - AnthonyMouse 7mo ago
      > When you are building software, you build a security process, not security individuals or stuff like this happens. You can't solve an incentive problem with process because then they lack the incentive to follow the process. To enforce a law you need to be able to identify a violation at a point in time when you can still impose a penalty for it. When a device is first released, you don't yet know if anyone will find a vulnerability in it or if the company will stay around to update it if they do. By the time you find out if it will happen, you can't punish them for the same reason they can't provide updates: they've ceased operations and no longer exist. So that doesn't work. > With software writers the losses occur to the end user. Which is why the end user needs to be empowered to efficiently prevent the losses, since they're the one with the strongest incentive to do it.
  - eesmith 7mo ago
    "Spectrum quickly learned that far more had gone wrong than just a units conversion error. A critical flaw was a program management grown too confident and too careless, even to the point of missing opportunities to avoid the disaster. "As reconstructed by Spectrum, ground controllers ignored a string of indications that something was seriously wrong with the craft's trajectory, over a period of weeks if not months. But managers demanded that worriers and doubters "prove something was wrong," even though classic and fundamental principles of mission safety should have demanded that they themselves, in the presence of significant doubts, properly "prove all is right" with the flight. Quoting https://web.archive.org/web/20210730150049/https://spectrum.ieee.org/why-the-mars-probe-went-off-course https://web.archive.org/web/20210730150049/https://spectrum.... linked to from https://en.wikipedia.org/wiki/Mars_Climate_Orbiter https://en.wikipedia.org/wiki/Mars_Climate_Orbiter . Plus, navigators, had concerns about the trajectory,which were dismissed because they "did not follow the rules about filling out [the incident surprise and analysis procedure] form to document their concerns" - from a trajectory team which was understaffed and overworked.
macintux 7mo ago
> What you need is the ability for consumers to replace the firmware. > That solves the problem in three ways. That alleviates the problem, but definitely doesn't solve it. Updates are still required, and most people will never update devices they don't directly interact with.
- wmf 7mo ago
  Auto-update obviously.
  - macintux 7mo ago
    Which introduces new security risks, but more importantly, the consumer has to configure the device to use open source firmware, and set up auto updates, unless the device is being auto updated by the device manufacturer and forces all of their customers to switch to the new firmware, which seems very unlikely.
  - kelnos 7mo ago
    How? The device phones home to the manufacturer's servers to get new updates. Manufacturer goes out of business, servers get shut down. How does it know where to get updates now?
    - M95D 7mo ago
      > Manufacturer goes out of business, servers get shut down. Continue your chain of reasoning: DNS name becomes unmaintained, gets grabbed by open source / foundation / gov agency, pushes open source firmware update. Same thing happens today with botnet C&C servers.
wmf 7mo ago
The concept of community firmware seems like a huge cop-out that allows companies to externalize costs. And it probably won't help security because 99% of devices will never get the third-party firmware installed anyway.
- AnthonyMouse 7mo ago
  If they were trying to save costs they would ship the community firmware on the device to begin with because then they wouldn't have to write and maintain their own. The community welcomes them to externalize those costs onto the people with better incentives to improve the software. What they're actually trying to do is obsolete the devices faster because then they won't add new protocols or other software-only features to older devices so you have to buy a new one, or only expose features in more expensive models that the less expensive hardware would also be capable of doing. Which is all the more reason for us to not have that. And if they were required to allow anyone to replace the firmware then you would get companies reflashing and selling them that way from the store because the free firmware has more advertisable features. There's a reason you can go to major PC OEMs and pick between Windows, Linux and "don't even install one" and the reason is that if you give customers a choice, they generally don't want their software to be made by the OEM.
  - pwg 7mo ago
    > What they're actually trying to do is obsolete the devices faster This is exactly why. Obsoleting older devices keeps (in their eyes) the purchase treadmill running. Making a device that could be updated forever means never making another sale to that user (unless some physical failure happens, or the user wants a second one).
- sroussey 7mo ago
  It could be part of dissolution of the company to mandate community firmware. But it depends on their licenses… Anyhow, this is a common enough practice. Many companies that provide infrastructure type software and sell to Fortune 500 companies often have a clause whereby they deliver their software to their customers if the shut down.
catlikesshrimp 7mo ago
Somebody has to pay for the support. There is no free meal. Enterprise must be able to pay for support for as long as they use devices. Solved. I can only think of requiring the devices to be serviceable, as you say. The absolute only way I can think of charging the consumers, ie the owners, is to charge a tax on internet connections. Then the government would pay somehow vulnerability hunters working along patchers, who can oversee each other. Consumers are tricky: if you include support in the sale price, the company will grab the money and run in 3 or 5 years; and some companies will sell cheaper because they know they won't provide support.
- AnthonyMouse 7mo ago
  > Somebody has to pay for the support. There is no free meal. The problem is not that people need a free meal. The problem is that people need the ability to eat some other food when the OEM's restaurant is closed or unsatisfactory.
  - catlikesshrimp 7mo ago
    I mean, OEM would make the device upgradeable, government will pay independent bounty hunters and patchers and will push the updates. Then consumers pay for all that.
  - nobodyandproud 7mo ago
    Who creates and regularly keeps the firmware for the dozens and dozens of router models secure and up-to-date? Who ensures the maintainers for these routers are incentivized to do this competently and in a timely fashion? You haven’t answered these key questions, which are equally or more important than whether a community firmware can be applied.
    - devilbunny 7mo ago
      It would be ideal if we could come up with a way to get people paid to maintain a community firmware. However, that's a considerably harder problem than "you absolutely must allow community firmware to be flashed".
RobotToaster 7mo ago
>The problem is that "secure firmware" is a relativistic statement. No it isn't, software formally verified to EAL7 is guaranteed to be secure.
- crote 7mo ago
  Sure, you formally verified that the software confirms to the specification, but how are you going to prove that the specification is correct?
- AnthonyMouse 7mo ago
  I would like to introduce you to Spectre and Rowhammer.
  - RobotToaster 7mo ago
    Secure software won't protect you from insecure hardware, which also needs to be formally verified for a secure system.
    - AnthonyMouse 7mo ago
      > Secure software won't protect you from insecure hardware Then what's KPTI etc.? > which also needs to be formally verified for a secure system. Now we just need a correct and complete theory of quantum mechanics and to do something about that Heisenberg thing. In general formal proofs tell you if something is true given a stipulated set of assumptions. They don't tell you if one of the stipulated assumptions is wrong or can be caused to be wrong on purpose by doing something nobody had previously known to be possible.
- kelnos 7mo ago
  You're being sarcastic, right? The entire concept of "guaranteed to be secure" is a fantasy. Even EAL7 can't guarantee anything. It can only say that the tools used for verification didn't find anything wrong. I'm not saying the tools are garbage, but the tools were made by humans, and humans are fallible.
- 7mo ago
thayne 7mo ago
> What you need is the ability for consumers to replace the firmware. I don't think that's enough. Most people aren't going to replace the firmware on their device with an open source replacement made by someone else. Now if the firmware was required to be open source, and automatic updates could be seamlessly switched over to a non-profit or government agency in the event of the company going out of business, you might have something. But there would be a lot of details to work out.
- bluGill 7mo ago
  If you make something internet commected you must provide lifetime warranty for security. no import or sales sor even leases) until you have in escrow the money to pay for them. i will allow sunsetting and removing ipv4 after 2020 (that is more that 5 years ago)
- riskable 7mo ago
  I have a PC hooked up to my TV in my living room that has been running the latest version of Kubuntu for over 18 years now. It has had many upgrades in that time but it's still the same basic hardware: A CPU, some memory, USB ports, a video card, and an ethernet port on the back. That "genericness" is what's missing in the router space. Literally every consumer router that comes out has some super proprietary design that's meant to be replaced in its entirety in 3-4 years. Many can run Linux, sure, but how many have a replaceable/upgradable board? How many are like a PC where you can install whatever OS you want? Sure, you can forcibly flash a new OS (e.g. OpenWRT) but that is a hack. The company lets you do that because they figure they'll get a bit more market share out of their products if they don't lock the firmware so much. They key point remains, however: They're not just hardware—even though they should be! The world of consumer routers needs a PC-like architecture change. You can buy routers from companies like Banana Pi and Microtik like this but they're not marketed towards every-day consumers. Mostly because they're considered "too premium" and require too much expertise to setup. I think there's a huge hole in the market for consumer-minded routers that run hardware like the Banana Pi R4 (which I have). When you buy it, you get the board and nothing else. It's up to you to get a case and install an OS on it (with OpenWRT, Debian, and Ubuntu being the normal options). We need something like the Framework laptop for routers. Not from a, "it has interchangeable parts" perspective but from a marketing perspective. Normal people are buying Framework laptops because geeky friends and colleagues recommend them and they're not that much more expensive/troublesome than say, a cheap Acer/Asus laptop.
nobodyandproud 7mo ago
That’s a technical solution to a business and incentives problem. How does one ensure the support for the devices is funded?
samus 7mo ago
> And "require longer support" doesn't fix it because many of the vendors will go out of business. Which is not a real issue in practice. It's like arguing that warranty doesn't matter because the vendor might go out of business.
- consp 7mo ago
  It might also be illegal. Don't know about the US but forcing a bankruptcy to avoid regulations is usually frowned upon by the court system here. So putting a product in a child-dummycorp to go poof when you want and let the parent stay afloat usually puts the parent in the line of fire directly and you are screwed either way.
  - bluGill 7mo ago
    It is possible to require escrow accounts for cover costs of fixing future security issues) - these survive bankruptcy. They need to be big enough to cover the costs though - insurance can calculate this but it isn't cheap.
    - AnthonyMouse 7mo ago
      The obvious problem with that is the detriment to smaller companies, but it makes a good alternative to releasing the code. Then if you're a five person shop making routers and you publish the firmware source under a license that allows anyone to make and distribute modifications you're all set. And if you're Apple or Microsoft and you want to make a router without publishing the source code, you post the enormous bond which you have no trouble doing because you're an enormous company and you're all set.
- AnthonyMouse 7mo ago
  > Which is not a real issue in practice. Are you serious? The number of IoT companies that make a product for a couple years and then go bust is enormous. > It's like arguing that warranty doesn't matter because the vendor might go out of business. How are you going to use a warranty from a company that no longer exists to get a security update for a product a million consumers still have?
kelnos 7mo ago
> But then vendors want to stop issuing them after 3 years Tough shit. You provide updates for the mandated amount of time, or you lose access to the market. No warnings, you're just done. > And "require longer support" doesn't fix it because many of the vendors will go out of business. Source code escrow plus a bond. The bond is set at a level where a third party can pay engineers to maintain the software and distribute updates for the remainder of the mandated support period. And as time passes with documented active support, the bond requirements for that device go down until the end of the support period. Requiring that the customer be allowed to replace the firmware is essential, I agree, but not for this reason. That requirement, by itself, just externalizes the support costs onto open source communities. Companies that sell this sort of hardware need to put up the resources, up front, irrevocably, to ensure the cost of software maintenance is covered for the entire period. Personally I don't buy consumer router hardware that I can't immediately flash OpenWRT on, but that option is not suitable for the general public.
- steve_gh 7mo ago
  How does this help? 99% of the population aren't technically minded enough. Most people just buy a wifi router, plug it in (maybe having read the instructions) and that's it. They have neither the skills nor the inclination to update firmware. The real problem is: assuming that firmware can be updated, how do you run a nationwide update programme overcoming a population that doesn't really care or have the skills to do it. Vehicle safety standards (mandated annual safety checks like the UK MoT test) is the closest analogy I can think of - in the UK you can't insure your car without a valid MoT. If you were serious, then maybe tying ISP access to updated router firmware would be the way to go.
  - M95D 7mo ago
    Automatic updates. Now it also applies to cars.
0xbadcafebee 7mo ago
> What you need is not a government mandate for infallibility, it's updates So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring. And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month another kind soul finds more bad wiring. And we just have to hope there is an army of kind strangers out there checking every building built by every company. And hope in the meantime that the building doesn't burn down. Meanwhile, people have to live with bad wiring for years, that could have been completely prevented to begin with, by an electrician following the electrical code we all already agree on.
- danaris 7mo ago
  I mean, if you could download an update that would fix the wiring in your house, it would be much less critical that the initial installer got it right. (Still much more important than your router, though; it doesn't stop being an electrocution hazard during the un-updated period.) Trying to make analogies from software to hardware will always fall down on that point. If you want to argue that there should be stricter security & correctness requirements for routers, maybe look more toward "here is how people actually treat them in practice" with regard to ignoring updates...?
  - 0xbadcafebee 7mo ago
    > I mean, if you could download an update that would fix the wiring in your house, it would be much less critical that the initial installer got it right As in my example, some random stranger needs to first find out your "house" (the vendor's software) is wired wrong. And this needs to happen for every "house" (every piece of software). While waiting for this to be discovered, your house burns down (hackers penetrate millions of devices, or perhaps just Microsoft Sharepoint that the govt is uses).
- inejge 7mo ago
  > So, we don't need an electrical code to enforce correct wiring. For an analogy to work, its underlying elements should have a relation to the target. Your analogy is not in the same universe. For electrical work, there is a baseline of materials and practices which is known to produce acceptable results if adhered to. For software, there isn't. (Don't tell me about the Space Shuttle. Consumer software doesn't cost tens of millions and isn't written with dedicated teams over the decades.)
avadodin 7mo ago
The government obviously cares less about citizens running firmware China can hack than it does about citizens potentially running firmware the government can't hack.
post-it 7mo ago
Why not just put the onus on ISPs? 99% of users lease their router from their ISP. If updates stop after three years, looks like you're getting a complimentary service appointment to get a new router.
gos9 7mo ago
Congratulations, your router now costs $700!
- AnthonyMouse 7mo ago
  Customers notice higher prices at time of purchase a lot more than they notice a lack of future security updates, so good luck selling them for that price when someone else just puts an existing open source firmware on the existing hardware and sells it for the existing price.
pbhjpbhj 7mo ago
>And "require longer support" doesn't fix it because many of the vendors will go out of business. Do you mean 'out of business so they cannot provide updates'? Because, if you mean cheap companies won't be able to provide updates and stay in business, surely that's the point. Companies would have to shim to a standardised firmware that was robust, or something, to keep costs down. Isn't this all to protect USA business interests and ensure the Trump regime can install their own backdoor though?

gerdesj 7mo ago

"You ship something with no known bugs and then someone finds one." You managed to say that with a straight face! Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out. How on earth is embedded creds in any way: "no known bugs"? I think we are on the same side (absolutely) but please don't allow the buggers any credibility!

AnthonyMouse 7mo ago
> How on earth is embedded creds in any way: "no known bugs"? You misunderstand how organizational knowledge works. You see, it doesn't. Some embeds the credentials, someone else ships the product. The first person doesn't even necessarily still work there at that point. Remember that time NASA sent a Mars orbiter to Mars and then immediately crashed it because some of them were using pounds and the others newtons? Literally rocket scientists. The best we know how to do here is to keep the incentives aligned so the people who suffer the consequences of something can do something about it. And in this case the people who suffer the consequences are the consumers, not the company that may have already ceased to exist, so we need to give the consumers a good way to fix it.
- pixl97 7mo ago
  >Some embeds the credentials, someone else ships the product. It doesn't matter. When you are building software, you build a security process, not security individuals or stuff like this happens. >orbiter to Mars and then immediately crashed Right, and it cost NASA 1.4 billion+ is direct losses to them. With software writers the losses occur to the end user.
  - AnthonyMouse 7mo ago
    > When you are building software, you build a security process, not security individuals or stuff like this happens. You can't solve an incentive problem with process because then they lack the incentive to follow the process. To enforce a law you need to be able to identify a violation at a point in time when you can still impose a penalty for it. When a device is first released, you don't yet know if anyone will find a vulnerability in it or if the company will stay around to update it if they do. By the time you find out if it will happen, you can't punish them for the same reason they can't provide updates: they've ceased operations and no longer exist. So that doesn't work. > With software writers the losses occur to the end user. Which is why the end user needs to be empowered to efficiently prevent the losses, since they're the one with the strongest incentive to do it.
- eesmith 7mo ago
  "Spectrum quickly learned that far more had gone wrong than just a units conversion error. A critical flaw was a program management grown too confident and too careless, even to the point of missing opportunities to avoid the disaster. "As reconstructed by Spectrum, ground controllers ignored a string of indications that something was seriously wrong with the craft's trajectory, over a period of weeks if not months. But managers demanded that worriers and doubters "prove something was wrong," even though classic and fundamental principles of mission safety should have demanded that they themselves, in the presence of significant doubts, properly "prove all is right" with the flight. Quoting https://web.archive.org/web/20210730150049/https://spectrum.ieee.org/why-the-mars-probe-went-off-course https://web.archive.org/web/20210730150049/https://spectrum.... linked to from https://en.wikipedia.org/wiki/Mars_Climate_Orbiter https://en.wikipedia.org/wiki/Mars_Climate_Orbiter . Plus, navigators, had concerns about the trajectory,which were dismissed because they "did not follow the rules about filling out [the incident surprise and analysis procedure] form to document their concerns" - from a trajectory team which was understaffed and overworked.

macintux 7mo ago

> What you need is the ability for consumers to replace the firmware. > That solves the problem in three ways. That alleviates the problem, but definitely doesn't solve it. Updates are still required, and most people will never update devices they don't directly interact with.

wmf 7mo ago
Auto-update obviously.
- macintux 7mo ago
  Which introduces new security risks, but more importantly, the consumer has to configure the device to use open source firmware, and set up auto updates, unless the device is being auto updated by the device manufacturer and forces all of their customers to switch to the new firmware, which seems very unlikely.
- kelnos 7mo ago
  How? The device phones home to the manufacturer's servers to get new updates. Manufacturer goes out of business, servers get shut down. How does it know where to get updates now?
  - M95D 7mo ago
    > Manufacturer goes out of business, servers get shut down. Continue your chain of reasoning: DNS name becomes unmaintained, gets grabbed by open source / foundation / gov agency, pushes open source firmware update. Same thing happens today with botnet C&C servers.

wmf 7mo ago

The concept of community firmware seems like a huge cop-out that allows companies to externalize costs. And it probably won't help security because 99% of devices will never get the third-party firmware installed anyway.

AnthonyMouse 7mo ago
If they were trying to save costs they would ship the community firmware on the device to begin with because then they wouldn't have to write and maintain their own. The community welcomes them to externalize those costs onto the people with better incentives to improve the software. What they're actually trying to do is obsolete the devices faster because then they won't add new protocols or other software-only features to older devices so you have to buy a new one, or only expose features in more expensive models that the less expensive hardware would also be capable of doing. Which is all the more reason for us to not have that. And if they were required to allow anyone to replace the firmware then you would get companies reflashing and selling them that way from the store because the free firmware has more advertisable features. There's a reason you can go to major PC OEMs and pick between Windows, Linux and "don't even install one" and the reason is that if you give customers a choice, they generally don't want their software to be made by the OEM.
- pwg 7mo ago
  > What they're actually trying to do is obsolete the devices faster This is exactly why. Obsoleting older devices keeps (in their eyes) the purchase treadmill running. Making a device that could be updated forever means never making another sale to that user (unless some physical failure happens, or the user wants a second one).
sroussey 7mo ago
It could be part of dissolution of the company to mandate community firmware. But it depends on their licenses… Anyhow, this is a common enough practice. Many companies that provide infrastructure type software and sell to Fortune 500 companies often have a clause whereby they deliver their software to their customers if the shut down.

catlikesshrimp 7mo ago

Somebody has to pay for the support. There is no free meal. Enterprise must be able to pay for support for as long as they use devices. Solved. I can only think of requiring the devices to be serviceable, as you say. The absolute only way I can think of charging the consumers, ie the owners, is to charge a tax on internet connections. Then the government would pay somehow vulnerability hunters working along patchers, who can oversee each other. Consumers are tricky: if you include support in the sale price, the company will grab the money and run in 3 or 5 years; and some companies will sell cheaper because they know they won't provide support.

AnthonyMouse 7mo ago
> Somebody has to pay for the support. There is no free meal. The problem is not that people need a free meal. The problem is that people need the ability to eat some other food when the OEM's restaurant is closed or unsatisfactory.
- catlikesshrimp 7mo ago
  I mean, OEM would make the device upgradeable, government will pay independent bounty hunters and patchers and will push the updates. Then consumers pay for all that.
- nobodyandproud 7mo ago
  Who creates and regularly keeps the firmware for the dozens and dozens of router models secure and up-to-date? Who ensures the maintainers for these routers are incentivized to do this competently and in a timely fashion? You haven’t answered these key questions, which are equally or more important than whether a community firmware can be applied.
  - devilbunny 7mo ago
    It would be ideal if we could come up with a way to get people paid to maintain a community firmware. However, that's a considerably harder problem than "you absolutely must allow community firmware to be flashed".

RobotToaster 7mo ago

>The problem is that "secure firmware" is a relativistic statement. No it isn't, software formally verified to EAL7 is guaranteed to be secure.

crote 7mo ago
Sure, you formally verified that the software confirms to the specification, but how are you going to prove that the specification is correct?
AnthonyMouse 7mo ago
I would like to introduce you to Spectre and Rowhammer.
- RobotToaster 7mo ago
  Secure software won't protect you from insecure hardware, which also needs to be formally verified for a secure system.
  - AnthonyMouse 7mo ago
    > Secure software won't protect you from insecure hardware Then what's KPTI etc.? > which also needs to be formally verified for a secure system. Now we just need a correct and complete theory of quantum mechanics and to do something about that Heisenberg thing. In general formal proofs tell you if something is true given a stipulated set of assumptions. They don't tell you if one of the stipulated assumptions is wrong or can be caused to be wrong on purpose by doing something nobody had previously known to be possible.
kelnos 7mo ago
You're being sarcastic, right? The entire concept of "guaranteed to be secure" is a fantasy. Even EAL7 can't guarantee anything. It can only say that the tools used for verification didn't find anything wrong. I'm not saying the tools are garbage, but the tools were made by humans, and humans are fallible.
7mo ago

thayne 7mo ago

> What you need is the ability for consumers to replace the firmware. I don't think that's enough. Most people aren't going to replace the firmware on their device with an open source replacement made by someone else. Now if the firmware was required to be open source, and automatic updates could be seamlessly switched over to a non-profit or government agency in the event of the company going out of business, you might have something. But there would be a lot of details to work out.

bluGill 7mo ago
If you make something internet commected you must provide lifetime warranty for security. no import or sales sor even leases) until you have in escrow the money to pay for them. i will allow sunsetting and removing ipv4 after 2020 (that is more that 5 years ago)
riskable 7mo ago
I have a PC hooked up to my TV in my living room that has been running the latest version of Kubuntu for over 18 years now. It has had many upgrades in that time but it's still the same basic hardware: A CPU, some memory, USB ports, a video card, and an ethernet port on the back. That "genericness" is what's missing in the router space. Literally every consumer router that comes out has some super proprietary design that's meant to be replaced in its entirety in 3-4 years. Many can run Linux, sure, but how many have a replaceable/upgradable board? How many are like a PC where you can install whatever OS you want? Sure, you can forcibly flash a new OS (e.g. OpenWRT) but that is a hack. The company lets you do that because they figure they'll get a bit more market share out of their products if they don't lock the firmware so much. They key point remains, however: They're not just hardware—even though they should be! The world of consumer routers needs a PC-like architecture change. You can buy routers from companies like Banana Pi and Microtik like this but they're not marketed towards every-day consumers. Mostly because they're considered "too premium" and require too much expertise to setup. I think there's a huge hole in the market for consumer-minded routers that run hardware like the Banana Pi R4 (which I have). When you buy it, you get the board and nothing else. It's up to you to get a case and install an OS on it (with OpenWRT, Debian, and Ubuntu being the normal options). We need something like the Framework laptop for routers. Not from a, "it has interchangeable parts" perspective but from a marketing perspective. Normal people are buying Framework laptops because geeky friends and colleagues recommend them and they're not that much more expensive/troublesome than say, a cheap Acer/Asus laptop.

nobodyandproud 7mo ago

That’s a technical solution to a business and incentives problem. How does one ensure the support for the devices is funded?

samus 7mo ago

> And "require longer support" doesn't fix it because many of the vendors will go out of business. Which is not a real issue in practice. It's like arguing that warranty doesn't matter because the vendor might go out of business.

consp 7mo ago
It might also be illegal. Don't know about the US but forcing a bankruptcy to avoid regulations is usually frowned upon by the court system here. So putting a product in a child-dummycorp to go poof when you want and let the parent stay afloat usually puts the parent in the line of fire directly and you are screwed either way.
- bluGill 7mo ago
  It is possible to require escrow accounts for cover costs of fixing future security issues) - these survive bankruptcy. They need to be big enough to cover the costs though - insurance can calculate this but it isn't cheap.
  - AnthonyMouse 7mo ago
    The obvious problem with that is the detriment to smaller companies, but it makes a good alternative to releasing the code. Then if you're a five person shop making routers and you publish the firmware source under a license that allows anyone to make and distribute modifications you're all set. And if you're Apple or Microsoft and you want to make a router without publishing the source code, you post the enormous bond which you have no trouble doing because you're an enormous company and you're all set.
AnthonyMouse 7mo ago
> Which is not a real issue in practice. Are you serious? The number of IoT companies that make a product for a couple years and then go bust is enormous. > It's like arguing that warranty doesn't matter because the vendor might go out of business. How are you going to use a warranty from a company that no longer exists to get a security update for a product a million consumers still have?

kelnos 7mo ago

> But then vendors want to stop issuing them after 3 years Tough shit. You provide updates for the mandated amount of time, or you lose access to the market. No warnings, you're just done. > And "require longer support" doesn't fix it because many of the vendors will go out of business. Source code escrow plus a bond. The bond is set at a level where a third party can pay engineers to maintain the software and distribute updates for the remainder of the mandated support period. And as time passes with documented active support, the bond requirements for that device go down until the end of the support period. Requiring that the customer be allowed to replace the firmware is essential, I agree, but not for this reason. That requirement, by itself, just externalizes the support costs onto open source communities. Companies that sell this sort of hardware need to put up the resources, up front, irrevocably, to ensure the cost of software maintenance is covered for the entire period. Personally I don't buy consumer router hardware that I can't immediately flash OpenWRT on, but that option is not suitable for the general public.

steve_gh 7mo ago
How does this help? 99% of the population aren't technically minded enough. Most people just buy a wifi router, plug it in (maybe having read the instructions) and that's it. They have neither the skills nor the inclination to update firmware. The real problem is: assuming that firmware can be updated, how do you run a nationwide update programme overcoming a population that doesn't really care or have the skills to do it. Vehicle safety standards (mandated annual safety checks like the UK MoT test) is the closest analogy I can think of - in the UK you can't insure your car without a valid MoT. If you were serious, then maybe tying ISP access to updated router firmware would be the way to go.
- M95D 7mo ago
  Automatic updates. Now it also applies to cars.

0xbadcafebee 7mo ago

> What you need is not a government mandate for infallibility, it's updates So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring. And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month another kind soul finds more bad wiring. And we just have to hope there is an army of kind strangers out there checking every building built by every company. And hope in the meantime that the building doesn't burn down. Meanwhile, people have to live with bad wiring for years, that could have been completely prevented to begin with, by an electrician following the electrical code we all already agree on.

danaris 7mo ago
I mean, if you could download an update that would fix the wiring in your house, it would be much less critical that the initial installer got it right. (Still much more important than your router, though; it doesn't stop being an electrocution hazard during the un-updated period.) Trying to make analogies from software to hardware will always fall down on that point. If you want to argue that there should be stricter security & correctness requirements for routers, maybe look more toward "here is how people actually treat them in practice" with regard to ignoring updates...?
- 0xbadcafebee 7mo ago
  > I mean, if you could download an update that would fix the wiring in your house, it would be much less critical that the initial installer got it right As in my example, some random stranger needs to first find out your "house" (the vendor's software) is wired wrong. And this needs to happen for every "house" (every piece of software). While waiting for this to be discovered, your house burns down (hackers penetrate millions of devices, or perhaps just Microsoft Sharepoint that the govt is uses).
inejge 7mo ago
> So, we don't need an electrical code to enforce correct wiring. For an analogy to work, its underlying elements should have a relation to the target. Your analogy is not in the same universe. For electrical work, there is a baseline of materials and practices which is known to produce acceptable results if adhered to. For software, there isn't. (Don't tell me about the Space Shuttle. Consumer software doesn't cost tens of millions and isn't written with dedicated teams over the decades.)

avadodin 7mo ago

The government obviously cares less about citizens running firmware China can hack than it does about citizens potentially running firmware the government can't hack.

post-it 7mo ago

Why not just put the onus on ISPs? 99% of users lease their router from their ISP. If updates stop after three years, looks like you're getting a complimentary service appointment to get a new router.

gos9 7mo ago

Congratulations, your router now costs $700!

AnthonyMouse 7mo ago
Customers notice higher prices at time of purchase a lot more than they notice a lack of future security updates, so good luck selling them for that price when someone else just puts an existing open source firmware on the existing hardware and sells it for the existing price.

pbhjpbhj 7mo ago

>And "require longer support" doesn't fix it because many of the vendors will go out of business. Do you mean 'out of business so they cannot provide updates'? Because, if you mean cheap companies won't be able to provide updates and stay in business, surely that's the point. Companies would have to shim to a standardised firmware that was robust, or something, to keep costs down. Isn't this all to protect USA business interests and ensure the Trump regime can install their own backdoor though?