13 ms·

Calling All Hackers: Help Us Build an Open Wireless Router

850 points by Blahah 12y ago

pstuart 12y ago
One other feature that would be nice would be VPN.
- izak30 12y ago
  TomatoUSB on Asus NS66u runs OpenVPN pretty well.
- sparkie 12y ago
  OpenWRT supports a bunch of vpn solutions, including OpenVPN. It's lacking a simple UI to configure though (luci-app-openvpn was broken and removed, although there are updated .ipkg which can be manually installed).
- Rose-Ab 12y ago
  In order to enjoy VPN on all of your devices you can either flashing your current router with DD_WRT firmware or by a VPN router but cause DD_WRT is free, it might be better you give it shot first before looking for VPN router. DD-WRT is a free open source project aimed at developing a Linux based firmware solution that removes the restrictions placed on routers by their default programming. Fortunately, it has the option of selecting different VPN configurations like: PPTP, L2TP or OpenVPN and Once configured, users on the network don’t need to enter a log in process when they need to activate the VPN. It just starts automatically, so any device connects automatically and easily, giving you all the benefits of using a reliable VPN service. In order to check whether your router is DD-WRT supported or not, please check your router here : http://dd-wrt.com/site/support/router-database http://dd-wrt.com/site/support/router-database And here is a configuration guide that will give you better idea of how you can config it on your router: http://www.purevpn.com/config/router/ http://www.purevpn.com/config/router/
josteink 12y ago
Any reason CeroWRT was preferred over other options like OpenWRT?
- cbab 12y ago
  One of the main technical reason I would say is that CeroWRT has the CoDel[1] queue management enabled by default. See also [2]. [1] - http://www.bufferbloat.net/projects/codel/wiki http://www.bufferbloat.net/projects/codel/wiki [2] - https://www.bufferbloat.net/projects/cerowrt/wiki/How_is_CeroWrt_different_from_OpenWrt https://www.bufferbloat.net/projects/cerowrt/wiki/How_is_Cer...
- ajb 12y ago
  They thank Dave Taht for helping them, and that's his project. It may be as simple as that. CeroWRT tracks OpenWRT anyway, so they're not really in competition.
  - dtaht 12y ago
    I don't regard cerowrt so much as "my" project. There's a couple hundred people on the mailing list - it's the "reference router project" for the bufferbloat-fighting community, And: cerowrt is much closer to a "branch" of openwrt than a fork. It's synced with openwrt on a nearly weekly basis, and the net delta between it and openwrt at this point is a few dozen patches (most code under test), and a bunch of test tools maintained in the ceropackages feed. We have always collaborated closely with the openwrt folk (several help out on a regular basis). A core difference between openwrt and cerowrt is process - by focusing on one router only (where they focus on hundreds), we were able to spin up and prove out new ideas faster in some cases than they, and maybe get "Stabler", faster - (that said, see bug 442) Unfortunately - as so many have noted, that router is EOL, and we'e been trying to find a replacement platform for over a year now.
geekam 12y ago
This seems to be firmware only. Is there hardware for routers that is open or at least ethical? They seem to be using http://www.newegg.com/Product/Product.aspx?Item=N82E16833122523 http://www.newegg.com/Product/Product.aspx?Item=N82E16833122...
- lucb1e 12y ago
  At first I thought it would be for open hardware; we already have the open software... Sort of disappointed.
  - sigjuice 12y ago
    I don't know enough to say for sure, but would this qualify as open hardware? http://shop.8devices.com/carambola2-bundle http://shop.8devices.com/carambola2-bundle
    - ngcoders 12y ago
      Nope , they are closed source ( no schematics / design files are available for it ). Only module pin outs are available.
lucb1e 12y ago
I always regarded DDWRT as the de-facto open replacement for router firmware but the EFF doesn't even mention it. Why not fork from them, are there (legal) issues?
- wmf 12y ago
  CeroWRT is an improved version of OpenWRT.
- martinp 12y ago
  There has been some controversy around DD-WRT and GPL, maybe that's why. http://web.archive.org/web/20070726045835/http://www.bitsum.com/about-ddwrt.htm http://web.archive.org/web/20070726045835/http://www.bitsum.... http://www.wi-fiplanet.com/columns/article.php/3816236 http://www.wi-fiplanet.com/columns/article.php/3816236
  - zanny 12y ago
    It is just an openwrt fork anyway. I use openwrt on everything, ever. I'd wish the EFF would just contribute to that project, or at least present us with evidence they tried.
- marcelvdh 12y ago
  Not sure I agree with you that DD-WRT is the de-facto open replacement for router firmware. DD-WRT is just a fork of an old version of OpenWRT (White Russian). OpenWRT is where all the innovation really happens. The OpenWRT developers also contribute back to the Linux wireless stack. I believe DD-WRT also had a few GPL violations in the past. Not sure if they still do. Anyway, do agree with the consensus that none of this is really needed because we already have OpenWRT and OpenWRT runs on anything that you could possibly want :-)
  - supergauntlet 12y ago
    openwrt still does not run on the very popular Asus RT N-66U. So, no, not everything you could possibly want.
alex_duf 12y ago
Why TOR for updates ? I've always dreamed of a product using bittorrent to update itself.
dm2 12y ago
Is this needed? I've been using Tomato for years and DDWRT is also available. (only using Tomato because my current router status for DDWRT is "Work in Progress") Both are open source, compatible with most routers, and have a nicely developed user interface. http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato http://www.dd-wrt.com/ http://www.dd-wrt.com/ https://openwrt.org/ https://openwrt.org/ http://www.polarcloud.com/tofu http://www.polarcloud.com/tofu Maybe updating the title of this post would help with the confusion. "...Help Us Build an Open Wireless Router Firmware" I'm all for competition and alternatives to products, but developers might be able to better allocate our resources rather than create a clone that might not be necessary. Such as ensuring existing projects are secure.
- tga_d 12y ago
  Both are open source For varying definitions of "open source" (a considerable amount of functionality is offloaded to binary blobs in many models). In terms of duplicating effort, in the page linked it specifically states it's based on Cerowrt, which is in turn based on Open WRT (which is actually FOSS, instead of just in name). More importantly, it doesn't say "...Help Us Build an Open Wireless Router Firmware" because that's not the goal of this project. As you clearly pointed out yourself, and as they implied in the post they made, that's already been accomplished multiple times over. The goal is to make a router designed for the Open Wireless movement, which is why, in the first sentence, they link to https://openwireless.org/ https://openwireless.org/
  - dm2 12y ago
    That makes sense. They could even help support their project by selling routers with open-source firmware already installed (if allowed by the manufacturer). The current firmwares are kind of stagnant (considered good enough I suppose).
    - feider 12y ago
      Good idea, selling routers with this firmware would be beneficial to router manufacturer(s) as they get a new marketing tool ( Open Wireless Compatible TM -mark), which would skyrocket market adoption. That to happen needs brand value, so lets hope this project catches on.
ausjke 12y ago
Is this really needed? Openwrt/DD-WRT can both do this easily already?
- wtallis 12y ago
  This is a fork of a fork of OpenWRT, and includes some stuff that isn't in the upstream OpenWRT yet. It's not all-new, but it's not reinventing the wheel in any way. Think of this as trying to be Ubuntu to OpenWRT's debian.
edoceo 12y ago
I run a custom router on of a Soekris Net6501. It can run Gentoo or Ubuntu or whatever you like. No custom builds necessary - but the hardware is ~$400
justizin 12y ago
Just to be clear, almost all of these features would be net neutrality violations.
- theon144 12y ago
  No they wouldn't? >Allow small business and home users to easily enable an open network, so guests and passersby can get an Internet connection if they need one, while keeping a password-locked WPA2 network for themselves and their friends or coworkers. Irrelevant. >Let you share a bounded portion of your bandwidth on the open network, so guest users cannot slow down your Internet connection or use a large portion of your monthly quota. Irrelevant too. You're not favoring any content over anybody's elses. >Provide state-of-the-art network queuing, so most users can expect an improved Internet experience—especially with latency-sensitive applications—compared to what commonly available consumer grade routers are delivering today. QoS is not a net neutrality violation, it favors certain aspects of a certain class of services. It's not an ISP slowing down Netflix in order to provide their own alternative, it's an ISP prioritizing VoIP over BitTorrent so that you don't get choppy video-calls. (Besides, you're not an ISP.) >Offer a minimalist, secure, and elegant Web user interface to set up and configure the router. Advanced, non-minimalist administrative options are accessible by SSH. >Advance the state of the art in consumer Wi-Fi router security and begin turning back the growing tide of attacks against them. Most or all existing router software is full of XSS and CSRF vulnerabilities, and we want to change that. >Include a secure software auto-update mechanism. In addition to using HTTPS, firmware signatures and metadata are fetched via Tor to make targeted update attacks very difficult. Not even remotely relevant to net neutrality.
  - msandford 12y ago
    Net neutrality for this kind of application is a flawed premise. If you're offering it for free that means you're not offering it commercially. And that means any of the precedent or case law or regulations regarding common carriers or any of that. Now if you started selling subscriptions? That would be a different story.
    - 12y ago
moreentropy 12y ago
Regarding the question why CeroWRT, I think this makes perfect sense. DD-WRT ist (afaik) still rooted in the open sourced Linksys firmware, while OpenWRT started from scratch in between. They really do awesome work and have developed a really powerful software platform for embedded devices in general. CeroWRT is based on OpenWRT but is focused on certain important aspects (bufferbloat). So I guess the EFF considers this important and wants to help by giving it some publicity. This is an awesome talk by OpenWRT developer nbd from 30c3 about the history and future of OpenWRT: https://media.ccc.de/browse/congress/2013/30C3_-_5497_-_en_-_saal_g_-_201312271400_-_10_years_of_fun_with_embedded_devices_-_nbd.html https://media.ccc.de/browse/congress/2013/30C3_-_5497_-_en_-...
vonklaus 12y ago
I think this is a pretty good idea, and something I have given a lot of thought to. The problem is really bigger than simple privacy though. If you are going to take the time to build an open router, it would be wise to make it have significant broadcast range to try and build in mesh network support. If people could pay a flat hardware fee and connect directly to the internet in a secure way, Comcast would have significantly less bargaining power and the customer would have significantly more privacy.
- icebraining 12y ago
  How could you pay for the Internet connection on an flat hardware fee? You'd still need some ISP to connect you to the rest of the world outside of the mesh network.
herf 12y ago
There is an additional need to make an automatic DMZ for "internet of things" devices (isolated like they're in a guest network, or even firewalled entirely), while still cleverly routing in packets from mobile devices.
- wmf 12y ago
  Why is IOT special?
  - herf 12y ago
    Two reasons: 1. Because devices are doing new things and often by companies without strong software cultures that build in update mechanisms and look after old devices, so they are not updated as well as major platforms. 2. For some devices, you can't simply isolate them as full guests, because existing protocols from your phone allow LAN-to-LAN discovery and control, so special NAT-style routing into the DMZ would be ideal.
    - herf 12y ago
      Related: the replacement cycle for devices like refrigerators, washer/dryers is not the 2 year cycle that we're used to for smartphone platforms. (e.g., even if your Android 2.2 phone can't be updated, you have probably replaced it by now.)
ibisum 12y ago
I am not an expert, this is my opinion based on casual observation and some experience with the death-roll that one encounters in maintaining a wifi-based Linux machine, but the 'reason for this', for those asking, or "why is this needed?", is this: because there isn't an open source stack all the way from http:// http:// to wifi0:, all the way, for a lot of the available chipsets. Wifi radios are little ARM machines surrounded by a black box, which somewhere depends on a binary blob to do the radio control/communication. So I think the answer is that the radio is where the open-source is needed; everything else is just a Distro War/-solution. tldr; consumer wifi stacks that allow open network bonding/pairing/ad-hoc connections, are dependent on the vendor-provided firmware blob having control over these features at the radio level. Thus, we need a fully open radio component to be truly, 'safe'. </opinion>
- wmf 12y ago
  AFAIK the Atheros drivers are open which is why this project is using Atheros hardware. The problem is solved as long as you are willing to buy specific hardware. It does appear that 90% of the effort in the router firmware community goes to dealing with blobs and diverse hardware support; whether that effort is wasted is a matter of opinion.
  - toomuchtodo 12y ago
    Is a Raspberry Pi powerful enough to do the job? Could a customer version be made with wifi chipset onboard?
    - wtallis 12y ago
      The Raspberry Pi doesn't have any high-bandwidth peripheral connections, and the CPU is too weak to do high-speed routing with QoS. What's needed is an open source board with a modern CPU, a mini-PCIe slot or two for the wifi, and at least one or two GigE NICs. In other words, this: http://www.pcengines.ch/apu.htm http://www.pcengines.ch/apu.htm Although once you add the wifi, case, power supply, and SD card or mSATA SSD, it's a bit on the expensive side.
higherpurpose 12y ago
Preferably one that allows for secure mesh networking (perhaps with CJDNS or other technology built-in).
- p4bl0 12y ago
  Yes. I'm actually surprised that this is not the main topic of the discussion.
  - dtaht 12y ago
    IMHO: EFF doesn't yet grok the importance of pushing out good routing protocols to the edge, and the need for mesh networking the edge together in the advent of emergency... or adversity. CeroWrt include every mesh networking protocol available - olsr, batman, and babel, for starters. The default is babel in it's source specific variant, and it's on by default. Tinq is also in there as an optional package, and recently RTT based metrics were added to babel to make meshing over vpns saner. I'm not sure what you mean by "secure mesh networking"? One of the cool features (not in the current cerowrt release) of the quagga-babeld protocol implementation was the ability to securely exchange routes over an insecure medium, which not only has an implementation but is an official RFC. http://tools.ietf.org/html/rfc7298 http://tools.ietf.org/html/rfc7298 I am under the impression commotion-wireless is doing something similar. If we are ever to replace BGP we need to start somewhere...
ibisum 12y ago
The plethora of solutions to this problem that are already out there, battling through the usability issues, leads me to a perilous thought: there really aren't any guarantees that .. not only do we have the NSA to deal with, but .. many other groups which can profit from severe fragmentation. Cocktail OS builds for commodity hardware are one thing, but knowing - truly - what is going on in the stack is another thing entirely. I think thats important, for an Open Source Wifi/Network effort. So any attempt to make an open source router OS that kicks ass, should, in my opinion, predominantly strive to be a self-hosting OS, with full sources on-board, and signed images being turnkey; i.e. everything needed to build the OS from source is part of the package; i.e. no cross-compiling, no binary blobs, the router builds its own firmware. Yes, its extreme, but I truly do think that the disconnect between build-ability and OS 'dependencies management tools' has a lot to offer in terms of improvement. If the first thing the machine did, OOBE, was to build itself its own unique system image .. from source .. as a feature for the user .. then we have a secure system. Unsigned system-image keys are going to be very, very much more important in this networking/communication space. Full source->build->signed-binary control as part of the bootup is where this effort should focus. Sign the code, build the code, sign the binaries, only run signed binaries on the OS built around the key, and so on. This allows intercommunication - shared Source, of course - but it also allows audit of things in the environment which is being defended. If we don't build-in sufficient encryption to make it truly safe, whats the point of being so Open about it? Imho, RouterOS should be full-Source onboard.
- wtallis 12y ago
  As a practical matter, consumer routers can't be self-hosting. They don't have the processing power, memory, and storage necessary, and none of the router vendors can be trusted to not have some kind of embedded rootkit that circumvents all of that. It's far better to work on having a deterministic verifiable cross-compiling build system and continue to flash the firmware over JTAG.
  - ibisum 12y ago
    >They don't have the processing power, memory, and storage necessary This is in my opinion, a sign of bloat. They darn-well do have the processing power to build their own images! Its just 'not desirable to use a slow computer to do it' .. Well, where the build is slow: refactor until its fast. > It's far better to work on having a deterministic verifiable cross-compiling build system and continue to flash the firmware over JTAG. The new open networks will require a lot more crypto. I'd prefer to run an open network where signed binaries and such things are just part of the norm. But then, this is all just hot-air .. time better spent actually working on the problem of so much hardware, so little actually safe source code to run on it.
deleted 12y ago
[deleted]
- deleted 12y ago
  [deleted]
akulbe 12y ago
Wouldn't ALL the hardware need to be open source, to be able to trust it? With our beloved NSA accused of back-dooring routers, this pretty much eliminates retail routers from consideration, doesn't it? It seems like the entire stack from top to bottom would need to be open source. DISCLAIMER: I'm just a wireless user. I don't know about either HW or driver design. These are just my questions.
- moe 12y ago
  NSA accused of back-dooring routers http://it.slashdot.org/story/14/01/02/2314259/backdoor-discovered-in-netgear-and-linkys-routers http://it.slashdot.org/story/14/01/02/2314259/backdoor-disco...
dannypgh 12y ago
Limiting the fraction of bandwidth used is a much harder problem than it sounds like, thanks to torrents. When you join the torrent you're inviting lots of UDP traffic to you. You can keep it from getting to the endpoint by traffic shaping, but that won't help if your uplink gets saturated by all of the incoming requests. Your typical asymmetric DSL is therefore very hard to safely share. You can try to block torrents, but there's no truly reliable way of doing so that doesn't involve blocking all encrypted traffic.
- wpietri 12y ago
  Could this be solved by a collaborative protocol? A simple home router has the advantage that all resources are being consumed by a small group of people that already are used to cooperating around resource allocation. E.g.: The router has some sort of bandwidthd. The Torrent app checks in, asks how much it can use for a low-priority bulk download, and gets a token good for a 30-second lease on 10 megabits down. Before that expires, it tries to renew the token, and maybe it gets only 5 megabits because somebody is watching Netflix. If at some point the connection quality gets bad, the router's owner gets an email saying that the router has noticed a lot of BitTorrent traffic from "Timmy's MacBook" and that maybe they should switch to a BT client that supports bandwidthd. And so dad gets Timmy to upgrade.
  - rektide 12y ago
    The parent simply skipped past the part that a connected peer will send less traffic if they sense packet loss. It's a little problematic, in that there are a lot of clients all sending at once and all looking to see if they can increase their rate of send, but if you ingress limit (drop packets, or via ECN) BitTorrent is controllable. BitTorrent peers are collorative, because otherwise turning on BitTorrent anywhere would immediately result in the parent's boogeyman showing up: being flooded by way more traffic than can be handled. That's not an overlooked part of designing a client: it's known that when writing UDP protocols one has to do one's own flow control.
    - dannypgh 12y ago
obvio171 12y ago
You know what a killer app for this would be? An "app store" of stupidly-simple-to-use server software. Routers are most people's only always ON computer, and having the ability to run decentralized applications on them like media, backups, microblogging, chat bouncers, etc. as easily as one would install a smartphone app could really tip the scale back toward the edges and away from centralized services. Money can't be ignored though. There has to be a (cryptocurrency-y?) way for people to voluntarily "subscribe" to recurringly give money to developers of these services, and it has to be so simple that it's almost easier than not giving. Costs could be offset by the user by renting out cpu/bandwidth/storage in a similarly one-click way by running specialized apps that handle that.
- jiggy2011 12y ago
  ISPs would hate this and the security implications of all of these routers running various services available to the internet is quite bad.
  - obvio171 12y ago
    That would have to be thoroughly thought of to offer a simple solution, maybe even at the cost of defining stricter boundaries of what such services would be allowed to do. But there's no reason why running servers should be so scary that only the powerful are able to run them. And "server" is not synonymous with "webhosting". There's a lot of p2p to be done if we want a decentralized internet. I regularly run a Bittorrent "server" available to the internet and never had any problem. I also run a Ricochet "server" (also a p2p app), no headache either. We have to get past the FUD and dig ourselves out of this hole.
- wpietri 12y ago
  My Synology DiskStation has a nice set of packages for things like that. As does my OpenWRT router. Both are pretty awesome. Something as nice as the App Store definitely requires some sort of revenue model. The Synology stuff is about an order of magnitude friendlier than the OpenWRT: the apps are more curated, better polished, etc. Which makes sense; polishing an app to consumer-grade UI levels and then properly cataloging it is a lot of work. Work that doesn't often happen in the open-source scratching-one's-own-itch context.
Aissen 12y ago
It also needs an anonymizing service, because when you offer open internet, you never know what users might do with it, that will be traced to your personnal connection. Putting the open wifi on Tor would be good idea.
rasz_pl 12y ago
In case you are wondering WTF are they talking about (openwrt is here after all), its "open wireless" router, not open source wireless router. they want open hotspots everywhere, probably running tor.
- cowbell 12y ago
  Which really seems to be missing a great opportunity. Why would they want open access routers just so it can connect to one of a handful of local monopoly ISPs? That's not freedom. If they're doing it, why not instead work on building a mesh. There are enough wireless hotspots in my metro area to link up the whole city if only these things talked to each other instead of to the centralized wired network.
  - serf 12y ago
    mesh networks are made difficult by sanctioning bodies and spectrum laws, whereas this intermediary step of ensuring non-malicious routers isn't hindered the same ways.
    - Istof 12y ago
      there is "Super-WiFi" which uses TV frequencies (which can help for range between mesh nodes) http://en.wikipedia.org/wiki/Super_Wi-Fi http://en.wikipedia.org/wiki/Super_Wi-Fi
    - femto 12y ago
      There's an even deeper problem than the mesh itself, and that is the dependence on a managed address space (IP, Ethernet, ...). Even with a physical mesh in place, an open IP network will probably fail due to the need for someone to manage the address space. There will be disagreements about address management among the participants, the job will become too big for volunteers, and eventually there will be a need to have a formal organisation to control addresses. In time, this organistion will become IANAv2, along with exactly the same questions about who gets to control it. That's what happened to a lot of the community wireless networks set up in the early 2000s: they fell apart due to management issues. Also, as shown by the propagation of "three strikes" rules, and copyright notice sent to IP addresses, a managed address space provides an handle for those who with to exert power, whether that be power over individual addressees or the managing organisation. My guess is that a successful open network will have to use a protocol that doesn't rely on a unique address. For example, can Freenet be run as a mesh network instead of an overlay network?
deleted 12y ago
[deleted]
walshemj 12y ago
Sorry to rain one someone's parade what exactly does this hardware project have to do with the EFFs mission? Why are they not campaigning on more relevant issues?
- rektide 12y ago
  Instead of trying to fight to make big corporations and governments play nice on the Internet, this project tries to allow individuals & small & medium businesses to be good/model citizens. This is a grass-roots attempt to create a shareable electronic freedom: not only ought you have the right to privacy and expression, but sensibly, you ought have the means to share and spread that right too.
  - walshemj 12y ago
    So giving up and getting side-tracked into pious and in the end pointless sideshows. There are already projects aiming at that ie the fon platform. "shareable electronic freedom" seems to be they are looking after first world teenagers who don't want to pay for content.
- fyrabanks 12y ago
  This is wild speculation, but when I read the announcement I figured that they're planning to provide the firmware and software for free, while selling fully-assembled hardware pre-loaded with the stack. Can't always rely on donations alone. I could quite easily be wrong, but without money in the equation, I feel like it would make more sense for them to work with OpenWRT rather than fork it.
- schoen 12y ago
  Two previous explanations: https://www.eff.org/deeplinks/2011/04/open-wireless-movement https://www.eff.org/deeplinks/2011/04/open-wireless-movement https://www.eff.org/deeplinks/2012/10/why-we-have-open-wireless-movement https://www.eff.org/deeplinks/2012/10/why-we-have-open-wirel... I hope to go into more detail about this elsewhere, but to me anonymity is a key point -- existing telecommunications infrastructure is very hostile to anonymity, both in its authentication and payment models. Open wireless networks at cafés, libraries, and so on are already much friendlier to anonymity. Broadening the availability of this kind of infrastructure could be helpful to making anonymity a practical default, at least for some applications. (I work at EFF and have contributed to this project, but wasn't responsible for EFF's adoption of it.) Edit: My colleague Yan Zhu and I have also been looking at the question of transparency in software development, including deterministic and reproducible builds as well as update mechanisms that make it hard for the software publisher to target users with malware. I think this project also makes for a good testbed for how transparent we can make software development and distribution. One thing that I did on the initial release of this project is making it get update manifests over Tor so that EFF can't distinguish particular users when serving them update images. I think Ranga spoke about this in his talk at HOPE, and I think it's something EFF will continue working on quite a bit.
eliben 12y ago
It's 2014. I'm surprised such a project wasn't run on Kickstarter already.
chiro 12y ago
Uh, no thanks EFF. We were working on this idea, we approached you - all we wanted was a little endorsement from you, and our large company partner was willing to open license a slew of patents, RPI style. What we got back was from the EFF was a bunch of nerd arrogance and essentially this: We are too busy reading the news about the Snowden affair (which was new at the time) to talk with you. A month or two later we facepalmed reading a post from another EFF staffer about the importance of open patents...
- Infinitesimus 12y ago
  Are there any more details you can provide about this issue? (The present form is just a claim). Unless you're bound by contracts and can't disclose the group you were working with. If this is true, it is important to bring it to the attention of the public imo
- lvs 12y ago
  This is all a little too cagey for anyone else to understand. It sounds like you got snubbed by someone at EFF at a time when they were somewhat distracted by arguably the largest geopolitical event the internet may ever have experienced. Can you point to what it is you're working on that is relevant to the announcement?
- Gracana 12y ago
  Only a month or two ago? Sounds like you could get their support now and be all set.
- chiro 12y ago
  I can't mention BigCo's name, they definitely wouldn't appreciate it and the deal would be off the table now anyway. Other info: We asked to keep our discussions confidential. We weren't asking them to sign an NDA, we explicitly mentioned that their word would have been enough. It's pretty simple, they weren't willing to discuss it confidentially, so we let it drop after about 9 emails. It's true it was a snubbing, but I'm not upset about it. It is however somewhat ironic to read this call for help after we proactively contacted the EFF with just such an offer of help. A lesson I learned was - you can admire what an organization stands for, but not always the way that organization is run. It also may be an ineffective organization. I guess these comments could hold for quite a few charitable organizations.
Spoutingshite 12y ago
I am interested in seeing more open router firmware variants. If the open SSL debacle has thought us anything it is that more eyes on the code is better but alternative implementations are better. Not wanting to play devils advocate tho...I was reading through a few academic journals on Coredemia and I came across this one from Ken Thompson: Reflections On Trusting Trust http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomps... In the paper Ken looks into potential vulnerability in compliers. He shows a trivial way that code can be manipulated and a trojan house could be injected into code by a vulnerable complier. His point is that checking the source code is not enough. Ps. I found out about Coredemia in HN: https://news.ycombinator.com/item?id=8061166 https://news.ycombinator.com/item?id=8061166
pyed 12y ago
Gargoyle-router is great, based on openWRT with emphasis on QoS and bandwidth management
listic 12y ago
Is there a pre-existing firmware that allows me to easily create separate public and private networks? I am thinking first and foremost about x86-based ones like m0n0wall or pfsense, but it would be good to know about ARM-based ones like DD-WRT.
- wmf 12y ago
  A lot of firmwares have this feature. I'm pretty sure CeroWRT does.
- sdfjkl 12y ago
  pfSense lets you do this, along with pretty much anything else you can think of. https://www.pfsense.org/about-pfsense/features.html https://www.pfsense.org/about-pfsense/features.html
  - listic 12y ago
    Which section should I look into?
sbierwagen 12y ago
Off topic, but hopefully there are some wireless guys in this thread who know the answer: Whatever happened to 802.11ad? Wikipedia says the spec was approved in 2012, but there's pretty much no products on the market. It seemed like everybody was rushing to get .11n stuff on the market, even before the spec was finished, (draft-n, etc) but nobody's building .11ad radios?
- wmf 12y ago
  What is ad good for that would justify the additional cost?
- alecdbrooks 12y ago
  Do you mean 802.11ac? Many new radios use 802.11ac[0], although maybe the rush is smaller than that for 802.11n. 802.11ad is a 60 Ghz protocol, a different frequency than 802.11n or ac use. It looks like 802.11ad would mostly be used as a sort of wireless USB or HDMI, [1] not networking, because it doesn't penetrate walls. [0]: https://en.wikipedia.org/wiki/IEEE_802.11ac#Products https://en.wikipedia.org/wiki/IEEE_802.11ac#Products [1]: http://www.cnet.com/news/60ghz-tech-promises-wireless-docking-usb-hdmi/ http://www.cnet.com/news/60ghz-tech-promises-wireless-dockin...
globaljitters 12y ago
Currently the WiFi protocol is vulnerable within a millisecond, and a completely new non-defective-by-design WiFi protocol would have to be created. Also, you'd have to make sure that the device(s) could not have a vulnerability to remote code execution of any kind, or the device may be capable of being remotely turned into a directed energy weapon, which could lead to serious security concerns.
- icebraining 12y ago
  Currently the WiFi protocol is vulnerable within a millisecond I'm pretty sure that WPA2 w/AES (assuming WPS is disabled) is not vulnerable within a milisecond. Even TKIP is far from easily crackable.
hoggle 12y ago
Those are the kinds of initiatives that make me optimistic about the future <3 If you are interested in where the OpenWRT project currently stands (hint: they need web as well as systems programmers) you might enjoy watching this talk from 30c3 - OpenWRT and 10 Years of Fun with Embedded Devices: https://news.ycombinator.com/item?id=7704216 https://news.ycombinator.com/item?id=7704216
gcb0 12y ago
i always run openWRT and always left a secured, open wifi for anyone around to use. until i moved to verizon (since they have the officially sanctioned monopoly of my region) and now i have to run the ugly, power hungry, wireless AP+cable modem (they market it as fiber, but it is cable all the way until the block repeater, then fiber, then into my home, then cable again... the few meters of useless fiber is probably just to avoid CA laws to provide open TV channels for free if it was market as cable) anyway, all that rant just to say that my will to maintain yet another device is null after that. i just roll with the verizon aberration.
hexleo 12y ago
They want to build an open wireless router. I think they want a open source software like openWRT. I found I was wrong, when I read comments, everybody discuss the router hardware... I want to know, why they calling hackers to do with hardware not software?
- mscarborough 12y ago
  To avoid backdoors in the chip design.
katepery 12y ago
Since I started with my online business I earn $58 every 15 minutes. It sounds unbelievable but you wont forgive yourself if you don't check it out. ▂ ▄ ▅ ▇ LIFETIME OPPORTUNITY ▇ ▅ ▄ ▂ ▁ >>>>>>>>>➜➜➜➜➜➜➜ ➜➜➜➜➜➜➜➜➜➜➜➜➜➜ WWW.PAYRAP.cℴm
Tepix 12y ago
Too bad they don't start with a router that supports the current 802.11ac standard. The WNDR3800 is already obsolete.
known 12y ago
http://www.open-mesh.com/ http://www.open-mesh.com/
bjf 12y ago
I'm missing something here. How are the security concerns of open networks being addressed? Why should I trust an open access point?
recursion1133 12y ago
Check out TP-Link. They already have open source routers, from the factory.
wahsd 12y ago
I hope there will be a way to manage the bandwidth and load properly. I think it will be a critical point for this project to be successful. If, e.g., I have an open wifi network access point in an apartment complex or even neighborhood, without the ability to manage bandwidth it might lead to a freeloader problem. I am thinking it would be cool for local access point owners to, through the router, network and set bandwidth policies as a group. That way freeloading could be mitigated by throttling bandwidth to encourage people to add nodes. It would need to also maybe support lightweight communications protocols in order to facilitate coordination and maybe messaging to people connecting to the open wifi access points.
- sequoia 12y ago
  They don't mention it in the post but they did in the talk: their firmware will allow easy bandwidth usage capping & throttling on the guest network.
wahsd 12y ago
I hope there will be a way to manage the bandwidth and load properly. I think it will be a critical point for this project to be successful. If, e.g., I have an open wifi network access point in an apartment complex or even neighborhood, without the ability to manage bandwidth it might lead to a freeloader problem. I am thinking it would be cool for local access point owners to, through the router, network and set bandwidth policies as a group. That way freeloading could be mitigated by throttling bandwidth to encourage people to add nodes. It would need to also maybe support lightweight communications protocols in order to facilitate coordination and maybe messaging to people connecting to the open wifi access points.
sitkack 12y ago
Lots of people talking about a lack of open wireless drivers, what about implementing your own wireless stack using something like http://sdr.osmocom.org/trac/wiki/rtl-sdr http://sdr.osmocom.org/trac/wiki/rtl-sdr
natch 12y ago
Did I miss it or do they simply not acknowledge the possibility of mesh networking?

850 points by Blahah 12y ago

pstuart 12y ago

One other feature that would be nice would be VPN.

izak30 12y ago
TomatoUSB on Asus NS66u runs OpenVPN pretty well.
sparkie 12y ago
OpenWRT supports a bunch of vpn solutions, including OpenVPN. It's lacking a simple UI to configure though (luci-app-openvpn was broken and removed, although there are updated .ipkg which can be manually installed).
Rose-Ab 12y ago
In order to enjoy VPN on all of your devices you can either flashing your current router with DD_WRT firmware or by a VPN router but cause DD_WRT is free, it might be better you give it shot first before looking for VPN router. DD-WRT is a free open source project aimed at developing a Linux based firmware solution that removes the restrictions placed on routers by their default programming. Fortunately, it has the option of selecting different VPN configurations like: PPTP, L2TP or OpenVPN and Once configured, users on the network don’t need to enter a log in process when they need to activate the VPN. It just starts automatically, so any device connects automatically and easily, giving you all the benefits of using a reliable VPN service. In order to check whether your router is DD-WRT supported or not, please check your router here : http://dd-wrt.com/site/support/router-database http://dd-wrt.com/site/support/router-database And here is a configuration guide that will give you better idea of how you can config it on your router: http://www.purevpn.com/config/router/ http://www.purevpn.com/config/router/

josteink 12y ago

Any reason CeroWRT was preferred over other options like OpenWRT?

cbab 12y ago
One of the main technical reason I would say is that CeroWRT has the CoDel[1] queue management enabled by default. See also [2]. [1] - http://www.bufferbloat.net/projects/codel/wiki http://www.bufferbloat.net/projects/codel/wiki [2] - https://www.bufferbloat.net/projects/cerowrt/wiki/How_is_CeroWrt_different_from_OpenWrt https://www.bufferbloat.net/projects/cerowrt/wiki/How_is_Cer...
ajb 12y ago
They thank Dave Taht for helping them, and that's his project. It may be as simple as that. CeroWRT tracks OpenWRT anyway, so they're not really in competition.
- dtaht 12y ago
  I don't regard cerowrt so much as "my" project. There's a couple hundred people on the mailing list - it's the "reference router project" for the bufferbloat-fighting community, And: cerowrt is much closer to a "branch" of openwrt than a fork. It's synced with openwrt on a nearly weekly basis, and the net delta between it and openwrt at this point is a few dozen patches (most code under test), and a bunch of test tools maintained in the ceropackages feed. We have always collaborated closely with the openwrt folk (several help out on a regular basis). A core difference between openwrt and cerowrt is process - by focusing on one router only (where they focus on hundreds), we were able to spin up and prove out new ideas faster in some cases than they, and maybe get "Stabler", faster - (that said, see bug 442) Unfortunately - as so many have noted, that router is EOL, and we'e been trying to find a replacement platform for over a year now.

geekam 12y ago

This seems to be firmware only. Is there hardware for routers that is open or at least ethical? They seem to be using http://www.newegg.com/Product/Product.aspx?Item=N82E16833122523 http://www.newegg.com/Product/Product.aspx?Item=N82E16833122...

lucb1e 12y ago
At first I thought it would be for open hardware; we already have the open software... Sort of disappointed.
- sigjuice 12y ago
  I don't know enough to say for sure, but would this qualify as open hardware? http://shop.8devices.com/carambola2-bundle http://shop.8devices.com/carambola2-bundle
  - ngcoders 12y ago
    Nope , they are closed source ( no schematics / design files are available for it ). Only module pin outs are available.

lucb1e 12y ago

I always regarded DDWRT as the de-facto open replacement for router firmware but the EFF doesn't even mention it. Why not fork from them, are there (legal) issues?

wmf 12y ago
CeroWRT is an improved version of OpenWRT.
martinp 12y ago
There has been some controversy around DD-WRT and GPL, maybe that's why. http://web.archive.org/web/20070726045835/http://www.bitsum.com/about-ddwrt.htm http://web.archive.org/web/20070726045835/http://www.bitsum.... http://www.wi-fiplanet.com/columns/article.php/3816236 http://www.wi-fiplanet.com/columns/article.php/3816236
- zanny 12y ago
  It is just an openwrt fork anyway. I use openwrt on everything, ever. I'd wish the EFF would just contribute to that project, or at least present us with evidence they tried.
marcelvdh 12y ago
Not sure I agree with you that DD-WRT is the de-facto open replacement for router firmware. DD-WRT is just a fork of an old version of OpenWRT (White Russian). OpenWRT is where all the innovation really happens. The OpenWRT developers also contribute back to the Linux wireless stack. I believe DD-WRT also had a few GPL violations in the past. Not sure if they still do. Anyway, do agree with the consensus that none of this is really needed because we already have OpenWRT and OpenWRT runs on anything that you could possibly want :-)
- supergauntlet 12y ago
  openwrt still does not run on the very popular Asus RT N-66U. So, no, not everything you could possibly want.

alex_duf 12y ago

Why TOR for updates ? I've always dreamed of a product using bittorrent to update itself.

dm2 12y ago

Is this needed? I've been using Tomato for years and DDWRT is also available. (only using Tomato because my current router status for DDWRT is "Work in Progress") Both are open source, compatible with most routers, and have a nicely developed user interface. http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato http://www.dd-wrt.com/ http://www.dd-wrt.com/ https://openwrt.org/ https://openwrt.org/ http://www.polarcloud.com/tofu http://www.polarcloud.com/tofu Maybe updating the title of this post would help with the confusion. "...Help Us Build an Open Wireless Router Firmware" I'm all for competition and alternatives to products, but developers might be able to better allocate our resources rather than create a clone that might not be necessary. Such as ensuring existing projects are secure.

tga_d 12y ago
Both are open source For varying definitions of "open source" (a considerable amount of functionality is offloaded to binary blobs in many models). In terms of duplicating effort, in the page linked it specifically states it's based on Cerowrt, which is in turn based on Open WRT (which is actually FOSS, instead of just in name). More importantly, it doesn't say "...Help Us Build an Open Wireless Router Firmware" because that's not the goal of this project. As you clearly pointed out yourself, and as they implied in the post they made, that's already been accomplished multiple times over. The goal is to make a router designed for the Open Wireless movement, which is why, in the first sentence, they link to https://openwireless.org/ https://openwireless.org/
- dm2 12y ago
  That makes sense. They could even help support their project by selling routers with open-source firmware already installed (if allowed by the manufacturer). The current firmwares are kind of stagnant (considered good enough I suppose).
  - feider 12y ago
    Good idea, selling routers with this firmware would be beneficial to router manufacturer(s) as they get a new marketing tool ( Open Wireless Compatible TM -mark), which would skyrocket market adoption. That to happen needs brand value, so lets hope this project catches on.

ausjke 12y ago

Is this really needed? Openwrt/DD-WRT can both do this easily already?

wtallis 12y ago
This is a fork of a fork of OpenWRT, and includes some stuff that isn't in the upstream OpenWRT yet. It's not all-new, but it's not reinventing the wheel in any way. Think of this as trying to be Ubuntu to OpenWRT's debian.

edoceo 12y ago

I run a custom router on of a Soekris Net6501. It can run Gentoo or Ubuntu or whatever you like. No custom builds necessary - but the hardware is ~$400

justizin 12y ago

Just to be clear, almost all of these features would be net neutrality violations.

theon144 12y ago
No they wouldn't? >Allow small business and home users to easily enable an open network, so guests and passersby can get an Internet connection if they need one, while keeping a password-locked WPA2 network for themselves and their friends or coworkers. Irrelevant. >Let you share a bounded portion of your bandwidth on the open network, so guest users cannot slow down your Internet connection or use a large portion of your monthly quota. Irrelevant too. You're not favoring any content over anybody's elses. >Provide state-of-the-art network queuing, so most users can expect an improved Internet experience—especially with latency-sensitive applications—compared to what commonly available consumer grade routers are delivering today. QoS is not a net neutrality violation, it favors certain aspects of a certain class of services. It's not an ISP slowing down Netflix in order to provide their own alternative, it's an ISP prioritizing VoIP over BitTorrent so that you don't get choppy video-calls. (Besides, you're not an ISP.) >Offer a minimalist, secure, and elegant Web user interface to set up and configure the router. Advanced, non-minimalist administrative options are accessible by SSH. >Advance the state of the art in consumer Wi-Fi router security and begin turning back the growing tide of attacks against them. Most or all existing router software is full of XSS and CSRF vulnerabilities, and we want to change that. >Include a secure software auto-update mechanism. In addition to using HTTPS, firmware signatures and metadata are fetched via Tor to make targeted update attacks very difficult. Not even remotely relevant to net neutrality.
- msandford 12y ago
  Net neutrality for this kind of application is a flawed premise. If you're offering it for free that means you're not offering it commercially. And that means any of the precedent or case law or regulations regarding common carriers or any of that. Now if you started selling subscriptions? That would be a different story.
  - 12y ago

moreentropy 12y ago

Regarding the question why CeroWRT, I think this makes perfect sense. DD-WRT ist (afaik) still rooted in the open sourced Linksys firmware, while OpenWRT started from scratch in between. They really do awesome work and have developed a really powerful software platform for embedded devices in general. CeroWRT is based on OpenWRT but is focused on certain important aspects (bufferbloat). So I guess the EFF considers this important and wants to help by giving it some publicity. This is an awesome talk by OpenWRT developer nbd from 30c3 about the history and future of OpenWRT: https://media.ccc.de/browse/congress/2013/30C3_-_5497_-_en_-_saal_g_-_201312271400_-_10_years_of_fun_with_embedded_devices_-_nbd.html https://media.ccc.de/browse/congress/2013/30C3_-_5497_-_en_-...

vonklaus 12y ago

I think this is a pretty good idea, and something I have given a lot of thought to. The problem is really bigger than simple privacy though. If you are going to take the time to build an open router, it would be wise to make it have significant broadcast range to try and build in mesh network support. If people could pay a flat hardware fee and connect directly to the internet in a secure way, Comcast would have significantly less bargaining power and the customer would have significantly more privacy.

icebraining 12y ago
How could you pay for the Internet connection on an flat hardware fee? You'd still need some ISP to connect you to the rest of the world outside of the mesh network.

herf 12y ago

There is an additional need to make an automatic DMZ for "internet of things" devices (isolated like they're in a guest network, or even firewalled entirely), while still cleverly routing in packets from mobile devices.

wmf 12y ago
Why is IOT special?
- herf 12y ago
  Two reasons: 1. Because devices are doing new things and often by companies without strong software cultures that build in update mechanisms and look after old devices, so they are not updated as well as major platforms. 2. For some devices, you can't simply isolate them as full guests, because existing protocols from your phone allow LAN-to-LAN discovery and control, so special NAT-style routing into the DMZ would be ideal.
  - herf 12y ago
    Related: the replacement cycle for devices like refrigerators, washer/dryers is not the 2 year cycle that we're used to for smartphone platforms. (e.g., even if your Android 2.2 phone can't be updated, you have probably replaced it by now.)

ibisum 12y ago

I am not an expert, this is my opinion based on casual observation and some experience with the death-roll that one encounters in maintaining a wifi-based Linux machine, but the 'reason for this', for those asking, or "why is this needed?", is this: because there isn't an open source stack all the way from http:// http:// to wifi0:, all the way, for a lot of the available chipsets. Wifi radios are little ARM machines surrounded by a black box, which somewhere depends on a binary blob to do the radio control/communication. So I think the answer is that the radio is where the open-source is needed; everything else is just a Distro War/-solution. tldr; consumer wifi stacks that allow open network bonding/pairing/ad-hoc connections, are dependent on the vendor-provided firmware blob having control over these features at the radio level. Thus, we need a fully open radio component to be truly, 'safe'. </opinion>

wmf 12y ago
AFAIK the Atheros drivers are open which is why this project is using Atheros hardware. The problem is solved as long as you are willing to buy specific hardware. It does appear that 90% of the effort in the router firmware community goes to dealing with blobs and diverse hardware support; whether that effort is wasted is a matter of opinion.
- toomuchtodo 12y ago
  Is a Raspberry Pi powerful enough to do the job? Could a customer version be made with wifi chipset onboard?
  - wtallis 12y ago
    The Raspberry Pi doesn't have any high-bandwidth peripheral connections, and the CPU is too weak to do high-speed routing with QoS. What's needed is an open source board with a modern CPU, a mini-PCIe slot or two for the wifi, and at least one or two GigE NICs. In other words, this: http://www.pcengines.ch/apu.htm http://www.pcengines.ch/apu.htm Although once you add the wifi, case, power supply, and SD card or mSATA SSD, it's a bit on the expensive side.

higherpurpose 12y ago

Preferably one that allows for secure mesh networking (perhaps with CJDNS or other technology built-in).

p4bl0 12y ago
Yes. I'm actually surprised that this is not the main topic of the discussion.
- dtaht 12y ago
  IMHO: EFF doesn't yet grok the importance of pushing out good routing protocols to the edge, and the need for mesh networking the edge together in the advent of emergency... or adversity. CeroWrt include every mesh networking protocol available - olsr, batman, and babel, for starters. The default is babel in it's source specific variant, and it's on by default. Tinq is also in there as an optional package, and recently RTT based metrics were added to babel to make meshing over vpns saner. I'm not sure what you mean by "secure mesh networking"? One of the cool features (not in the current cerowrt release) of the quagga-babeld protocol implementation was the ability to securely exchange routes over an insecure medium, which not only has an implementation but is an official RFC. http://tools.ietf.org/html/rfc7298 http://tools.ietf.org/html/rfc7298 I am under the impression commotion-wireless is doing something similar. If we are ever to replace BGP we need to start somewhere...

ibisum 12y ago

The plethora of solutions to this problem that are already out there, battling through the usability issues, leads me to a perilous thought: there really aren't any guarantees that .. not only do we have the NSA to deal with, but .. many other groups which can profit from severe fragmentation. Cocktail OS builds for commodity hardware are one thing, but knowing - truly - what is going on in the stack is another thing entirely. I think thats important, for an Open Source Wifi/Network effort. So any attempt to make an open source router OS that kicks ass, should, in my opinion, predominantly strive to be a self-hosting OS, with full sources on-board, and signed images being turnkey; i.e. everything needed to build the OS from source is part of the package; i.e. no cross-compiling, no binary blobs, the router builds its own firmware. Yes, its extreme, but I truly do think that the disconnect between build-ability and OS 'dependencies management tools' has a lot to offer in terms of improvement. If the first thing the machine did, OOBE, was to build itself its own unique system image .. from source .. as a feature for the user .. then we have a secure system. Unsigned system-image keys are going to be very, very much more important in this networking/communication space. Full source->build->signed-binary control as part of the bootup is where this effort should focus. Sign the code, build the code, sign the binaries, only run signed binaries on the OS built around the key, and so on. This allows intercommunication - shared Source, of course - but it also allows audit of things in the environment which is being defended. If we don't build-in sufficient encryption to make it truly safe, whats the point of being so Open about it? Imho, RouterOS should be full-Source onboard.

wtallis 12y ago
As a practical matter, consumer routers can't be self-hosting. They don't have the processing power, memory, and storage necessary, and none of the router vendors can be trusted to not have some kind of embedded rootkit that circumvents all of that. It's far better to work on having a deterministic verifiable cross-compiling build system and continue to flash the firmware over JTAG.
- ibisum 12y ago
  >They don't have the processing power, memory, and storage necessary This is in my opinion, a sign of bloat. They darn-well do have the processing power to build their own images! Its just 'not desirable to use a slow computer to do it' .. Well, where the build is slow: refactor until its fast. > It's far better to work on having a deterministic verifiable cross-compiling build system and continue to flash the firmware over JTAG. The new open networks will require a lot more crypto. I'd prefer to run an open network where signed binaries and such things are just part of the norm. But then, this is all just hot-air .. time better spent actually working on the problem of so much hardware, so little actually safe source code to run on it.

deleted 12y ago

[deleted]

deleted 12y ago
[deleted]

akulbe 12y ago

Wouldn't ALL the hardware need to be open source, to be able to trust it? With our beloved NSA accused of back-dooring routers, this pretty much eliminates retail routers from consideration, doesn't it? It seems like the entire stack from top to bottom would need to be open source. DISCLAIMER: I'm just a wireless user. I don't know about either HW or driver design. These are just my questions.

moe 12y ago
NSA accused of back-dooring routers http://it.slashdot.org/story/14/01/02/2314259/backdoor-discovered-in-netgear-and-linkys-routers http://it.slashdot.org/story/14/01/02/2314259/backdoor-disco...

dannypgh 12y ago

Limiting the fraction of bandwidth used is a much harder problem than it sounds like, thanks to torrents. When you join the torrent you're inviting lots of UDP traffic to you. You can keep it from getting to the endpoint by traffic shaping, but that won't help if your uplink gets saturated by all of the incoming requests. Your typical asymmetric DSL is therefore very hard to safely share. You can try to block torrents, but there's no truly reliable way of doing so that doesn't involve blocking all encrypted traffic.

wpietri 12y ago
Could this be solved by a collaborative protocol? A simple home router has the advantage that all resources are being consumed by a small group of people that already are used to cooperating around resource allocation. E.g.: The router has some sort of bandwidthd. The Torrent app checks in, asks how much it can use for a low-priority bulk download, and gets a token good for a 30-second lease on 10 megabits down. Before that expires, it tries to renew the token, and maybe it gets only 5 megabits because somebody is watching Netflix. If at some point the connection quality gets bad, the router's owner gets an email saying that the router has noticed a lot of BitTorrent traffic from "Timmy's MacBook" and that maybe they should switch to a BT client that supports bandwidthd. And so dad gets Timmy to upgrade.
- rektide 12y ago
  The parent simply skipped past the part that a connected peer will send less traffic if they sense packet loss. It's a little problematic, in that there are a lot of clients all sending at once and all looking to see if they can increase their rate of send, but if you ingress limit (drop packets, or via ECN) BitTorrent is controllable. BitTorrent peers are collorative, because otherwise turning on BitTorrent anywhere would immediately result in the parent's boogeyman showing up: being flooded by way more traffic than can be handled. That's not an overlooked part of designing a client: it's known that when writing UDP protocols one has to do one's own flow control.
  - dannypgh 12y ago

obvio171 12y ago

You know what a killer app for this would be? An "app store" of stupidly-simple-to-use server software. Routers are most people's only always ON computer, and having the ability to run decentralized applications on them like media, backups, microblogging, chat bouncers, etc. as easily as one would install a smartphone app could really tip the scale back toward the edges and away from centralized services. Money can't be ignored though. There has to be a (cryptocurrency-y?) way for people to voluntarily "subscribe" to recurringly give money to developers of these services, and it has to be so simple that it's almost easier than not giving. Costs could be offset by the user by renting out cpu/bandwidth/storage in a similarly one-click way by running specialized apps that handle that.

jiggy2011 12y ago
ISPs would hate this and the security implications of all of these routers running various services available to the internet is quite bad.
- obvio171 12y ago
  That would have to be thoroughly thought of to offer a simple solution, maybe even at the cost of defining stricter boundaries of what such services would be allowed to do. But there's no reason why running servers should be so scary that only the powerful are able to run them. And "server" is not synonymous with "webhosting". There's a lot of p2p to be done if we want a decentralized internet. I regularly run a Bittorrent "server" available to the internet and never had any problem. I also run a Ricochet "server" (also a p2p app), no headache either. We have to get past the FUD and dig ourselves out of this hole.
wpietri 12y ago
My Synology DiskStation has a nice set of packages for things like that. As does my OpenWRT router. Both are pretty awesome. Something as nice as the App Store definitely requires some sort of revenue model. The Synology stuff is about an order of magnitude friendlier than the OpenWRT: the apps are more curated, better polished, etc. Which makes sense; polishing an app to consumer-grade UI levels and then properly cataloging it is a lot of work. Work that doesn't often happen in the open-source scratching-one's-own-itch context.

Aissen 12y ago

It also needs an anonymizing service, because when you offer open internet, you never know what users might do with it, that will be traced to your personnal connection. Putting the open wifi on Tor would be good idea.

rasz_pl 12y ago

In case you are wondering WTF are they talking about (openwrt is here after all), its "open wireless" router, not open source wireless router. they want open hotspots everywhere, probably running tor.

cowbell 12y ago
Which really seems to be missing a great opportunity. Why would they want open access routers just so it can connect to one of a handful of local monopoly ISPs? That's not freedom. If they're doing it, why not instead work on building a mesh. There are enough wireless hotspots in my metro area to link up the whole city if only these things talked to each other instead of to the centralized wired network.
- serf 12y ago
  mesh networks are made difficult by sanctioning bodies and spectrum laws, whereas this intermediary step of ensuring non-malicious routers isn't hindered the same ways.
  - Istof 12y ago
    there is "Super-WiFi" which uses TV frequencies (which can help for range between mesh nodes) http://en.wikipedia.org/wiki/Super_Wi-Fi http://en.wikipedia.org/wiki/Super_Wi-Fi
  - femto 12y ago
    There's an even deeper problem than the mesh itself, and that is the dependence on a managed address space (IP, Ethernet, ...). Even with a physical mesh in place, an open IP network will probably fail due to the need for someone to manage the address space. There will be disagreements about address management among the participants, the job will become too big for volunteers, and eventually there will be a need to have a formal organisation to control addresses. In time, this organistion will become IANAv2, along with exactly the same questions about who gets to control it. That's what happened to a lot of the community wireless networks set up in the early 2000s: they fell apart due to management issues. Also, as shown by the propagation of "three strikes" rules, and copyright notice sent to IP addresses, a managed address space provides an handle for those who with to exert power, whether that be power over individual addressees or the managing organisation. My guess is that a successful open network will have to use a protocol that doesn't rely on a unique address. For example, can Freenet be run as a mesh network instead of an overlay network?

deleted 12y ago

[deleted]

walshemj 12y ago

Sorry to rain one someone's parade what exactly does this hardware project have to do with the EFFs mission? Why are they not campaigning on more relevant issues?

rektide 12y ago
Instead of trying to fight to make big corporations and governments play nice on the Internet, this project tries to allow individuals & small & medium businesses to be good/model citizens. This is a grass-roots attempt to create a shareable electronic freedom: not only ought you have the right to privacy and expression, but sensibly, you ought have the means to share and spread that right too.
- walshemj 12y ago
  So giving up and getting side-tracked into pious and in the end pointless sideshows. There are already projects aiming at that ie the fon platform. "shareable electronic freedom" seems to be they are looking after first world teenagers who don't want to pay for content.
fyrabanks 12y ago
This is wild speculation, but when I read the announcement I figured that they're planning to provide the firmware and software for free, while selling fully-assembled hardware pre-loaded with the stack. Can't always rely on donations alone. I could quite easily be wrong, but without money in the equation, I feel like it would make more sense for them to work with OpenWRT rather than fork it.
schoen 12y ago
Two previous explanations: https://www.eff.org/deeplinks/2011/04/open-wireless-movement https://www.eff.org/deeplinks/2011/04/open-wireless-movement https://www.eff.org/deeplinks/2012/10/why-we-have-open-wireless-movement https://www.eff.org/deeplinks/2012/10/why-we-have-open-wirel... I hope to go into more detail about this elsewhere, but to me anonymity is a key point -- existing telecommunications infrastructure is very hostile to anonymity, both in its authentication and payment models. Open wireless networks at cafés, libraries, and so on are already much friendlier to anonymity. Broadening the availability of this kind of infrastructure could be helpful to making anonymity a practical default, at least for some applications. (I work at EFF and have contributed to this project, but wasn't responsible for EFF's adoption of it.) Edit: My colleague Yan Zhu and I have also been looking at the question of transparency in software development, including deterministic and reproducible builds as well as update mechanisms that make it hard for the software publisher to target users with malware. I think this project also makes for a good testbed for how transparent we can make software development and distribution. One thing that I did on the initial release of this project is making it get update manifests over Tor so that EFF can't distinguish particular users when serving them update images. I think Ranga spoke about this in his talk at HOPE, and I think it's something EFF will continue working on quite a bit.

eliben 12y ago

It's 2014. I'm surprised such a project wasn't run on Kickstarter already.

chiro 12y ago

Uh, no thanks EFF. We were working on this idea, we approached you - all we wanted was a little endorsement from you, and our large company partner was willing to open license a slew of patents, RPI style. What we got back was from the EFF was a bunch of nerd arrogance and essentially this: We are too busy reading the news about the Snowden affair (which was new at the time) to talk with you. A month or two later we facepalmed reading a post from another EFF staffer about the importance of open patents...

Infinitesimus 12y ago
Are there any more details you can provide about this issue? (The present form is just a claim). Unless you're bound by contracts and can't disclose the group you were working with. If this is true, it is important to bring it to the attention of the public imo
lvs 12y ago
This is all a little too cagey for anyone else to understand. It sounds like you got snubbed by someone at EFF at a time when they were somewhat distracted by arguably the largest geopolitical event the internet may ever have experienced. Can you point to what it is you're working on that is relevant to the announcement?
Gracana 12y ago
Only a month or two ago? Sounds like you could get their support now and be all set.
chiro 12y ago
I can't mention BigCo's name, they definitely wouldn't appreciate it and the deal would be off the table now anyway. Other info: We asked to keep our discussions confidential. We weren't asking them to sign an NDA, we explicitly mentioned that their word would have been enough. It's pretty simple, they weren't willing to discuss it confidentially, so we let it drop after about 9 emails. It's true it was a snubbing, but I'm not upset about it. It is however somewhat ironic to read this call for help after we proactively contacted the EFF with just such an offer of help. A lesson I learned was - you can admire what an organization stands for, but not always the way that organization is run. It also may be an ineffective organization. I guess these comments could hold for quite a few charitable organizations.

Spoutingshite 12y ago

I am interested in seeing more open router firmware variants. If the open SSL debacle has thought us anything it is that more eyes on the code is better but alternative implementations are better. Not wanting to play devils advocate tho...I was reading through a few academic journals on Coredemia and I came across this one from Ken Thompson: Reflections On Trusting Trust http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomps... In the paper Ken looks into potential vulnerability in compliers. He shows a trivial way that code can be manipulated and a trojan house could be injected into code by a vulnerable complier. His point is that checking the source code is not enough. Ps. I found out about Coredemia in HN: https://news.ycombinator.com/item?id=8061166 https://news.ycombinator.com/item?id=8061166

pyed 12y ago

Gargoyle-router is great, based on openWRT with emphasis on QoS and bandwidth management

listic 12y ago

Is there a pre-existing firmware that allows me to easily create separate public and private networks? I am thinking first and foremost about x86-based ones like m0n0wall or pfsense, but it would be good to know about ARM-based ones like DD-WRT.

wmf 12y ago
A lot of firmwares have this feature. I'm pretty sure CeroWRT does.
sdfjkl 12y ago
pfSense lets you do this, along with pretty much anything else you can think of. https://www.pfsense.org/about-pfsense/features.html https://www.pfsense.org/about-pfsense/features.html
- listic 12y ago
  Which section should I look into?

sbierwagen 12y ago

Off topic, but hopefully there are some wireless guys in this thread who know the answer: Whatever happened to 802.11ad? Wikipedia says the spec was approved in 2012, but there's pretty much no products on the market. It seemed like everybody was rushing to get .11n stuff on the market, even before the spec was finished, (draft-n, etc) but nobody's building .11ad radios?

wmf 12y ago
What is ad good for that would justify the additional cost?
alecdbrooks 12y ago
Do you mean 802.11ac? Many new radios use 802.11ac[0], although maybe the rush is smaller than that for 802.11n. 802.11ad is a 60 Ghz protocol, a different frequency than 802.11n or ac use. It looks like 802.11ad would mostly be used as a sort of wireless USB or HDMI, [1] not networking, because it doesn't penetrate walls. [0]: https://en.wikipedia.org/wiki/IEEE_802.11ac#Products https://en.wikipedia.org/wiki/IEEE_802.11ac#Products [1]: http://www.cnet.com/news/60ghz-tech-promises-wireless-docking-usb-hdmi/ http://www.cnet.com/news/60ghz-tech-promises-wireless-dockin...

globaljitters 12y ago

Currently the WiFi protocol is vulnerable within a millisecond, and a completely new non-defective-by-design WiFi protocol would have to be created. Also, you'd have to make sure that the device(s) could not have a vulnerability to remote code execution of any kind, or the device may be capable of being remotely turned into a directed energy weapon, which could lead to serious security concerns.

icebraining 12y ago
Currently the WiFi protocol is vulnerable within a millisecond I'm pretty sure that WPA2 w/AES (assuming WPS is disabled) is not vulnerable within a milisecond. Even TKIP is far from easily crackable.

hoggle 12y ago

Those are the kinds of initiatives that make me optimistic about the future <3 If you are interested in where the OpenWRT project currently stands (hint: they need web as well as systems programmers) you might enjoy watching this talk from 30c3 - OpenWRT and 10 Years of Fun with Embedded Devices: https://news.ycombinator.com/item?id=7704216 https://news.ycombinator.com/item?id=7704216

gcb0 12y ago

i always run openWRT and always left a secured, open wifi for anyone around to use. until i moved to verizon (since they have the officially sanctioned monopoly of my region) and now i have to run the ugly, power hungry, wireless AP+cable modem (they market it as fiber, but it is cable all the way until the block repeater, then fiber, then into my home, then cable again... the few meters of useless fiber is probably just to avoid CA laws to provide open TV channels for free if it was market as cable) anyway, all that rant just to say that my will to maintain yet another device is null after that. i just roll with the verizon aberration.

hexleo 12y ago

They want to build an open wireless router. I think they want a open source software like openWRT. I found I was wrong, when I read comments, everybody discuss the router hardware... I want to know, why they calling hackers to do with hardware not software?

mscarborough 12y ago
To avoid backdoors in the chip design.

katepery 12y ago

Since I started with my online business I earn $58 every 15 minutes. It sounds unbelievable but you wont forgive yourself if you don't check it out. ▂ ▄ ▅ ▇ LIFETIME OPPORTUNITY ▇ ▅ ▄ ▂ ▁ >>>>>>>>>➜➜➜➜➜➜➜ ➜➜➜➜➜➜➜➜➜➜➜➜➜➜ WWW.PAYRAP.cℴm

Tepix 12y ago

Too bad they don't start with a router that supports the current 802.11ac standard. The WNDR3800 is already obsolete.

known 12y ago

http://www.open-mesh.com/ http://www.open-mesh.com/

bjf 12y ago

I'm missing something here. How are the security concerns of open networks being addressed? Why should I trust an open access point?

recursion1133 12y ago

Check out TP-Link. They already have open source routers, from the factory.

wahsd 12y ago

I hope there will be a way to manage the bandwidth and load properly. I think it will be a critical point for this project to be successful. If, e.g., I have an open wifi network access point in an apartment complex or even neighborhood, without the ability to manage bandwidth it might lead to a freeloader problem. I am thinking it would be cool for local access point owners to, through the router, network and set bandwidth policies as a group. That way freeloading could be mitigated by throttling bandwidth to encourage people to add nodes. It would need to also maybe support lightweight communications protocols in order to facilitate coordination and maybe messaging to people connecting to the open wifi access points.

sequoia 12y ago
They don't mention it in the post but they did in the talk: their firmware will allow easy bandwidth usage capping & throttling on the guest network.

wahsd 12y ago

sitkack 12y ago

Lots of people talking about a lack of open wireless drivers, what about implementing your own wireless stack using something like http://sdr.osmocom.org/trac/wiki/rtl-sdr http://sdr.osmocom.org/trac/wiki/rtl-sdr

natch 12y ago

Did I miss it or do they simply not acknowledge the possibility of mesh networking?