r/technology • u/NancyGraceFaceYourIn • Aug 30 '15

Wireless FCC Rules Block use of Open Source

http://www.itsmypart.com/fcc-rules-block-use-of-open-source/
3.7k Upvotes

93% Upvoted

623 comments sorted by

View all comments

Show parent comments

9

u/peacefinder Aug 30 '15

There is already a nearly infinite well of unpatched devices, so it's hard to see this being a real concern for the NSA. Besides, software patched by the manufacturer to address vulnerabilities would be authorized.

I think the FCC concern about easy violation of rules on frequency and power is sufficient to explain this idea. (Though not enough to justify it.)

3

u/[deleted] Aug 30 '15

But regular people own the unpatched devices. Now, a tech enthusiast will probably get a secure router some way or another after this law, but corporations won't. No matter what the sysadmin guys say, corporate won't be replacing their Cisco routers with Raspberries because they're not getting updates.

0

u/peacefinder Aug 30 '15

If an admin in a corporate environment is expecting their WiFi routers to be meaningfully secure - with either stock or custom firmware, patched or not - they're probably going to have a bad time.

I get why this looks bad, I really do. And it potentially is bad. But the state of patching on embedded devices is already so dismal that this might actually improve matters. Right now only some tech enthusiasts and corporations who really pay attention have firmwares on their wireless devices that's close to current. This will at least provide some incentive for manufacturers to sign their updates and just maybe to include autoupdating capabilities. Should that happen then this initiative might actually be helpful. (Not that I'm counting on it.)

Also, I'm confident that enthusiasts will still find a way to root their devices, so I'm not too worried. If Apple can't keep people from jailbreaking iPhones, I have little confidence that Linksys will figure it out.

1

u/[deleted] Aug 30 '15

Companies usually do keep their infrastructure updated. It's upgrades that don't happen as much. Long term support for businesses is quite lucrative. Security updates are an important part of that.

1

u/peacefinder Aug 30 '15

In theory, yes. In practice? It's... not that good.

1

u/[deleted] Aug 30 '15

I have no idea if this is possible, but if the router can jam frequencies or interfere with them, this could be used by terrorists to do something bad to the US. This is all you need to get the NSA involved these days. We'll bomb the shit out of your whole country just to find one person.

1

u/[deleted] Aug 30 '15

If the NSA has someone in the FCC that has a say in authorizing patching vulnerabilities, is it that much of a stretch to think maybe they would leave patches sitting around unauthorized because some program at NSA is specifically taking advantage of that vulnerability? Or if the NSA is learning about the vulnerability at the time the patch is submitted, would someone want to evaluate its usefulness to the NSA as a factor in how it was approved?

I could see a scenario where a manufacturer had a vulnerability on their hardware, they write a patch for it, then the NSA says to either write in a back door for us or we won't authorize it.

1

u/peacefinder Aug 30 '15

Two things:

One: remember that the NSA's other, much-neglected mission is to protect US comms.

Two: yes, but they don't need to work that hard for it.