22 comments

  • WarOnPrivacy 2 hours ago

        The FCC maintains a list of equipment and services (Covered List) 
        that have been determined to “pose an unacceptable risk to the
        national security
    
        Recently, malicious state and non-state sponsored cyber attackers
        have increasingly leveraged the vulnerabilities in small and home
        office routers produced abroad to carry out direct attacks against
        American civilians in their homes.
    
    Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices. Security experts have been trying to call attention to this problem for 2 decades.

    Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware. This includes the FCC which license their devices and the FTC who (until recently) had the direct mandate to protect consumers.

    Our most recent step backward was to gut those agencies of any ability to provide consumer oversight. All they they can do now is craft protectionist policies that favor campaign donors.

    The US has a bazillion devices with crap security because we set ourselves up for this.

    • AnthonyMouse 25 minutes ago
      > Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware.

      The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one.

      What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using the device for 15. And "require longer support" doesn't fix it because many of the vendors will go out of business.

      What you need is the ability for consumers to replace the firmware.

      That solves the problem in three ways. First, when the company goes out of business you can still put a supported third party firmware on the device. Second, you can do that immediately, because the open source firmwares have a better security record than the OEMs to begin with. And third, then the device is running a widely used open source firmware instead of a custom device-specific proprietary black box, which makes it easier for the government or anyone else who is so inclined to find vulnerabilities and patch them.

      • wmf 0 minutes ago
        The concept of community firmware seems like a huge cop-out that allows companies to externalize costs. And it probably won't help security because 99% of devices will never get the third-party firmware installed anyway.
      • macintux 9 minutes ago
        > What you need is the ability for consumers to replace the firmware.

        > That solves the problem in three ways.

        That alleviates the problem, but definitely doesn't solve it. Updates are still required, and most people will never update devices they don't directly interact with.

        • wmf 3 minutes ago
          Auto-update obviously.
      • gerdesj 10 minutes ago
        "You ship something with no known bugs and then someone finds one."

        You managed to say that with a straight face!

        Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out.

        How on earth is embedded creds in any way: "no known bugs"?

        I think we are on the same side (absolutely) but please don't allow the buggers any credibility!

    • orthogonal_cube 1 hour ago
      That’s the ironic part.

      Plenty of consumer-grade devices have had very lax security settings or backdoors baked in for purposes of “troubleshooting” and recovery assistance. It’s never been limited to foreign-made devices.

      Security has never been part of the review process. The only time any agency has really cared is when encryption is involved, and that’s just been the FBI wanting it to be neutered so they can have their own backdoors.

    • longislandguido 1 hour ago
      > Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices.

      Sorry but this is merely a convenient excuse. Source: I have hard evidence of a Chinese IoT device where crap security practices were later leveraged by the same company to inject exploit code. It's called plausible deniability and it's foolish to tell me it's a coincidence.

      You're not going to convince me that a foreign state actor pressuring a company to include a backdoor wouldn't disguise it as a "whoopsie, our crap code lol" as opposed to adding in the open with a disclaimer on it.

      It's all closed source firmware. Even the GPL packages from most consumer router vendors are loaded with binary blobs. Tell me I should trust it.

      • gobins 1 hour ago
        Are you saying that other manufacturers don't do this?
        • cjk 1 hour ago
          If US manufacturers (or manufacturers in allied countries) do this, legal avenues exist to hold those manufacturers accountable. Not so with China.

          (That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)

          • mindslight 28 minutes ago
            > legal avenues exist to hold those manufacturers accountable

            Oh, sweet summer child. Disclaiming these possible avenues of liability is the main goal of clickwrap "terms of service".

        • longislandguido 1 hour ago
          Are you asking me if I have the master list of naughty and nice router manufacturers?

          No, I don't have it but you may check with Santa Claus.

      • cowpig 1 hour ago
        What was the company, and what did they inject?
      • mindslight 37 minutes ago
        And who hasn't seen American software companies where crap security practices are later leveraged by the same company to run exploits? It's of course always phrased in Orwellian terms of business practices, terms of service, "security", etc but we can still call a spade a spade.
    • khana 25 minutes ago
      [dead]
  • adrianmonk 1 hour ago
    This part of the press release seems pretty crucial:

    > Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations.

    In other words, foreign-made consumer routers are banned by default. But if you are a manufacturer, you can apply to get unbanned ("Conditional Approval").

    In the FAQ (https://www.fcc.gov/faqs-recent-updates-fcc-covered-list-reg...), they even include guidance on how to apply: https://www.fcc.gov/sites/default/files/Guidance-for-Conditi...

    If you (a manufacturer) apply, they want information regarding corporate location, jursidiction, and ownership. They want a bill of materials with country of origin and a justification for why any foreign-sourced components can't be domestic. They want information about who provides software and updates. And they want to hear your plan to increase US domestic manufacturing and progress toward that goal.

    So, foreign-made consumer routers can still be sold, but they are going to look at them with a fine-tooth comb, and they are going to use FCC approval as leverage to try to increase domestic manufacturing.

    • OneLeggedCat 1 hour ago
      > foreign-made consumer routers can still be sold, but they are going to look at them with a fine-tooth comb, and they are going to use FCC approval as leverage to try to increase domestic manufacturing

      That is not what's going to happen. What's going to happen is that anyone coughing up payola to the current executive in chief's people will get approved, and anyone that doesn't will remain blocked. This practice is currently widespread, in the form of tariffs.

    • vineyardmike 56 minutes ago
      > If you (a manufacturer) apply, they want information regarding corporate location, jursidiction, and ownership. They want a bill of materials with country of origin and a justification for why any foreign-sourced components can't be domestic. They want information about who provides software and updates. And they want to hear your plan to increase US domestic manufacturing and progress toward that goal.

      Wow NGL this sounds great if you ignore the reality that it'll be used as a partisan backdoor to enriching the administration.

    • wahern 1 hour ago
      > So, foreign-made consumer routers can still be sold, but they are going to look at them with a fine-tooth comb, and they are going to use FCC approval as leverage to try to increase domestic manufacturing.

      You're assuming a non-partisan technocratic process, which this administration has amply shown is neither capable nor willing to provide. This requirement becomes another opportunity for Pay-to-Play, either in cash or quid pro quo, to the government directly (see, e.g., NVidia and AMD export allowances) or to Trump's inner circle (see, e.g., crypto venture regulation, merger approvals).

      • dcrazy 1 hour ago
        This is the problem with erosion of norms. We’ve all known for decades that consumer routers have shit security. We’ve all known about the risk of implants or intentional backdoors in the supply chain. And now when the FCC appears to be finally doing something about it, there’s a massive cloud of mistrust hanging over the whole idea.
        • mindslight 24 minutes ago
          The mistrust comes from those doing it, and the clearly corrupt ways they are operating. The maggot movement is basically rooted in a lot of very real frustrations from very real longstanding problems, but the only thing it offers as solutions is performative vice signalling.

          People who care about the problems of digital security are not going to lean into the idea of simply banning devices based on where they were manufactured. Rather they would work at general standards and solutions to actually solve the problems - things like untying the markets for hardware/firmware/services, requiring firmware source escrow, mandating LAN protocols and controllers so every single IoT device isn't backhauling to its own mothership, and so on.

          Likewise people who care about domestic manufacturing first and foremost are not going to champion applying steep blanket tariffs two decades after all of that industry has already left, or using regulatory agencies to shake down manufacturers for unrelated concessions.

      • adrianmonk 20 minutes ago
        > You're assuming a non-partisan technocratic process

        No, of course I'm not assuming that. That's not the administration's pattern of behavior, so it would be a crazy assumption.

        I agree it'll be abused. I just didn't feel it necessary to state the obvious.

    • giantrobot 1 hour ago
      Any router made by a company that "donates" (bribes) to Trump's "ballroom" or other vanity projects will get approved. Irrespective of anything else. This is just another grift.
  • patrakov 3 minutes ago
    Prediction: there will appear new "Made in the USA" routers that differ from some Chinese model only by the label. Already the case in Russia for e.g. powerbanks.
  • Someone1234 1 hour ago
    Considering this is after Loper Bright Enterprises v. Raimondo (2024), it will be interesting to see if this holds up to judicial scrutiny.

    The FCC's power just got substantially nerfed, and "we've decided to slow lane all foreign-made routers" feels like that may have been beaten on the old, higher, standard. Let alone the new one that gives the FCC almost no power.

  • WarOnPrivacy 1 hour ago
    If we wanted secure products, we wouldn't ban devices. We'd mandate they open their firmware to audits.
    • vetrom 44 minutes ago
      You will first probably need Congress to legislate away the long standing prohibitions against offering (easily) user-modifiable RF devices on the market.

      Self ownership and full 'right to repair' has carve-outs in the FCC's regulations in the name of limiting unintentional broadcasting/radiation. Maybe a challenge to those would survive in the post-Chevron environment. I wouldn't expect any Congress in the last 25 years to pass a law which would go against the incumbent telecom lobbyist interests though, and I'd expect such a hole if it did hit case law, to get 'patched' fairly quickly.

      About the only way to really solve that would be to embarrass vendors enough to open their moats.

    • clcaev 1 hour ago
      It'd be great if open firmware could be commercially viable. Finding a business model is hard.

      The OpenWRT One [1] sponsored by the Software Conservancy [2] and manufactured by Banana Pi [3] works lovely.

      [1] https://openwrt.org/toh/openwrt/one

      [2] https://sfconservancy.org/activities/openwrt-one.html

      [3] https://docs.banana-pi.org/en/OpenWRT-One/BananaPi_OpenWRT-O...

      • sophrosyne42 1 hour ago
        Open firmware would become commercially viable when IP is abolished
        • AshamedCaptain 49 minutes ago
          How do you see firmware becoming more open without copyright exactly?
          • amlib 24 minutes ago
            Not prosecuting people trying to reverse engineer any kind of software would be a great start...
        • mindslight 14 minutes ago
          I'm no fan of imaginary property, but you're going to have to lay out your reasoning here. Firmware security is such crap precisely because most hardware manufacturers see it as nothing but a cost center they wish they could avoid.

          The difficulty of installing OpenWRT or Linux in general on hardware comes from that hardware not being documented, or having straightforward APIs like BIOS/EFI.

          Or for some devices, community distributions that dubiously remix manufacturer-supplied binaries are available. But we generally see that as soon as the manufacturer stops their updates, the community versions start lagging behind as well.

    • dmitrygr 1 hour ago
      problem is: how do you prove the firmware in the flash chip matches source? And I do not mean me, with a disassembler and a pi pico to read out the flash chip. I mean the 70-yaer-old corner shop owner that buys this router to provide free WiFi for customers?
      • WarOnPrivacy 1 hour ago
        > how do you prove the firmware in the flash chip matches source?

        Trusted, qualified independent experts: Ala Underwriters Laboratories.

        • dmitrygr 1 hour ago
          • actionfromafar 1 hour ago
            Someone did go to jail, so there's at least that.
            • dmitrygr 1 hour ago
              Yes. But a lot of people still got cars that were not as represented. So if we follow the same pattern, somebody will go to jail, but most routers will not be running verified or safe code.
              • Snafuh 46 minutes ago
                Do you apply the same scrutiny to the food you eat?

                Some trust has to be created through testing standards and the law, but generally we do believe what the label says in day to day life.

              • actionfromafar 45 minutes ago
                The routers thing? That's probably just a scam to get donations to the Trump Family Bunker/Ballroom in DC or other pet project.
      • gbin 1 hour ago
        A trusted website that compiles it from source and a way for you to go to a webpage and flash from there automatically. The FPV community does that all the time with a set of websites for their ESC, flight controllers, radio, all open source. You can add signatures etc but just a trusted website goes a long way vs a random blob preinstalled
        • dmitrygr 1 hour ago
          That proves that the one they checked, had the correct firmware. It does not prove that the one from the next batch that you bought did. We are all technical people here we and understand that there isn’t really an easy way to do this that a random non-technical person could actually understand and use.
          • PickledHotdog 1 hour ago
            Isn't the person you're replying to suggesting people can update the firmware to the trusted version via a website? So it doesn't matter if you get one from 'the next batch' - provided you're on top of updating the firmware.
            • dmitrygr 1 hour ago
              If only somebody could make a firmware that claims to have accepted the update, but then proceeds to not actually update itself. Read out the version string from the update and save it. Show that when asked what your version is.
      • megous 1 hour ago
        There's no solution to that other than having knowledge and researching the code/device yourself. You can pick apart modern Linux/busybox based IoTs fairly quickly, so effort needed is not really a huge issue.

        Maybe trusted community of people could do it for everyone, but there's currently all kinds of potential legal trouble brewing in that approach. Complete and public reverse engineering of every aspect of any device would have to be made completely legal, so that people could freely publish all artifacts extracted from a device and produced during reverse engineering and collaborate on them without any fear of repercussions. Also HW manufacturers would have to be prohibited from NDAing documentation for SoCs, etc.

        Side benefit would be that this would also serve as a documentation for freeing the device and developing alternative firmwares with modernized sw/reduced attack surface.

        • dmitrygr 1 hour ago
          We are in violent agreement. And precisely because there is no simple solution to it, half-measures like what is proposed here do absolutely no good, and often times do harm.
  • buzer 2 hours ago
    > all consumer-grade routers produced in foreign countries

    Are there even consumer-grade routers that are produced in the USA...?

    • amluto 1 hour ago
      But we can still buy old models:

      > As outlined below, today’s action does not impact a consumer’s continued use of routers they previously acquired. Nor does it prevent retailers from continuing to sell, import, or market router models approved previously through the FCC’s equipment authorization process. By operation of the FCC’s Covered List rules, the restrictions imposed today apply to new device models.

      I’m sure plenty of US factories are capable of importing boxes that look like routers but are actually just switches (because the router firmware is missing) and re-flashing them here…

    • kbumsik 2 hours ago
      Right? Even enterprise routers, e.g. Cisco, are not produced in USA.
    • cozzyd 1 hour ago
      Are there any consumer-grade routers that aren't produced in Taiwan?
      • jordand 1 hour ago
        Even MikroTik routers have a supply chain scattered around the world
    • Mistletoe 1 hour ago
      Time for the made in USA tin can and a string.
      • daemonologist 1 hour ago
        Hey, let's not undersell America's high-tech manufacturing capability. We could easily produce morse code keys and copper wire, for a price of course.
  • jscheel 1 hour ago
    And exactly how many consumer routers are not foreign made?
  • kemotep 25 minutes ago
    Does anyone even have a list of US produced routers? Like does installing OpenWRT or OPNSense or VyOS matter?

    I can’t think of a complete start to finish, OS to mosfets, computer that is 100% manufactured in the United States.

  • freedomben 30 minutes ago
    So... What are the options now for American consumers? What brands are left and available?
  • bibimsz 1 hour ago
    I'd gladly buy an American-made router if one existed!
  • analog31 30 minutes ago
    Ask HN: Is there a list of preferred routers for security?
  • giantg2 13 minutes ago
    Are there consumer grade routers made in the US?
  • razorbeamz 20 minutes ago
    I'm sure people will get right on buying American-made routers.
  • Schnitz 1 hour ago
    So router prices in the US will go up a lot, great!
  • weightedreply 2 hours ago
    Will this impact the Mono Gateway[0]?

    [0] https://mono.si/

    • dfc 1 hour ago
      It looks like it probably won't matter. The site says you can preorder a DevKit "Shipping between June and September 2025."

      The fact that they haven't updated that webpage with new information since October 1st 2025 seems to indicate bad news...

    • mzajc 1 hour ago
      It's hard to tell considering there is absolutely no company/ownership information on the site, but a .si (Slovenia) domain coupled with EUR being an accepted currency has me thinking they're Europe-based, and therefore foreign-made.

      ... at the same time, I don't think I'd send $100 to a site with no contact/ownership/company info to begin with.

  • kittikitti 32 minutes ago
    Because of this, I'm going to plan my next network upgrade based on open source hardware like Banana Pi. My setup is based on WiFi 7 so this might not apply for a few years. From my understanding, the hardware from proprietary manufacturers is sufficiently advanced to do some advanced surveillance and spyware, whereas previous generations didn't require advanced processing to achieve fiber optic speeds. Back to the original statement, it's clear that the threat of surveillance exists.

    Personally, I don't make the distinction between foreign and domestically produced routers in America. In fact, I trust foreign produced routers more because the likelihood that they can act upon their surveillance is significantly lower than the current American regime's oppressive and malicious tactics. Therefore, open source routers provides enough transparency to effectively eliminate spyware threats from all angles while being compliant.

    I'm especially excited about the Banana Pi because of the transparency and potential of modular upgrades. Whenever there's a network issue, I have to consider whether the manufacturer (American or not) is doing something nefarious. With a Pi based router, I have much more peace of mind with network debugging issues.

  • mrsssnake 47 minutes ago
    What is a router?

    Really, do they have a definition?

    • protocolture 40 minutes ago
      Device that connects multiple networks? Layer 3 of the OSI model? Consumer ones tend to have more than that, but the more specific definition would work fine.

      Yeah conceivably you could use this to ban any network device that is capable of routing between interfaces, so lots of switches with new firmware could do it, often terribly, as well as PCs with multiple interfaces. But its probably going to involve intention.

  • raphman 1 hour ago
    Does the router ban really only pertain to consumer-grade networking devices?

    > For the purpose of this determination, the term “Routers” is defined by National Institute of Science and Technology’s Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems. ¹

    > A “consumer-grade router” is a router intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems. Throughout this document, the term “router” is used as a shorthand for “consumer-grade router.” ²

    There doesn't seem to be a general ban for foreign-made professional routers, just for some Chinese manufacturers, right³?

    Oh, and what does "produced by foreign countries" even mean? I couldn't find any definition. Is this meant to be the country of final assembly? Would importing a Chinese router and the flashing the firmware in the USA be sufficient to be exempt? Where is the line drawn usually?

    ¹) https://www.fcc.gov/sites/default/files/NSD-Routers0326.pdf

    ²) https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8425A.pdf

    ³) https://www.fcc.gov/supplychain/coveredlist

  • sam345 1 hour ago
    If you actually read the notice, it exempts models that have been approved. So this just seems to require approvals by DOH or DHS ,": Routers^ produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS." I take this to mean it is just adding security approvals for this type of thing to DOw and DHS. It is not a ban of all future models. It's just saying explicitly that instead of having to review models already in the market and determine that they should be removed because of nation state or other security concerns they are reviewing them before they go to market. Would be nice if people actually read it instead of hyperventilating.
    • danso 1 hour ago
      Why shouldn’t people have a reaction to a policy that mandates a new approval process on a large class of consumer products?
      • wtallis 37 minutes ago
        Especially since the announcement provides no information about how the DoD or DHS will be evaluating what to approve, and it's unlikely that they have the resources to do any meaningful security evaluation on that many products.
  • anonym29 1 hour ago
    What the fuck?! I did not sign up to live in some third world shithole where I can't get first-world networking equipment. I do not want some piece of shit closed-source proprietary netgear ameritrash. FUCK! Give me back my god damn chinese routers!

    Chinese citizens have more computing freedom than American citizens at this point. What the fuck happened to the land of the free?

    • vsgherzi 15 minutes ago
      I understand the anger but I wouldn't go as far as that last part... the GFW is the ultimate censorship tool. For the record I run tp-link aps
    • 0cf8612b2e1e 1 hour ago
      I doubt anything will be pulled from the market. This is instead notice to the companies that now is the time for a donation to the administration’s ballroom.
      • anonym29 54 minutes ago
        Right now, the way this is currently worded, every single foreign-made consumer router has already been pulled from the market, and has to request permission to be reintroduced. The only consumer routers not currently affected are those that are either already purchased (some good, but won't last forever) or are American-made (overpriced, underpowered dogshit)
    • 0xy 31 minutes ago
      The computing freedom = a plausibly deniable backdoor.

      https://nvd.nist.gov/vuln/detail/CVE-2023-1389

    • mx7zysuj4xew 1 hour ago
      Why wasn't anyone notified about this being in the works? What bulletins did I fail to notice. WHAT THE HELL IS GOING ON HERE
  • supernetworks 2 hours ago
    [flagged]
    • tomhow 1 hour ago
      Please avoid low-substance, self-promotional comments like this on HN. It's OK to mention your own product/service occasionally, but only if it's in context and as a part of a comment that makes a substantive, insightful contribution to the discussion.

      Also, we recommend using a username that seems human, rather than being based on a company/brand name, otherwise it seems like you are here primarily for promotional purposes rather than curious conversation. You can email us to change the username if you'd like – [email protected].

      • supernetworks 20 minutes ago
        Thanks Tom. This whole comment thread is a bit of a dumpster fire of opinions however we have been working on the wifi security problem for a long time and we have a lot to say about it. Router manufacturers competing into involution that ship RCE (much of which is triggerable from a web page) have created a substantial risk to consumers, in this case with a lens on the US market. We tackle hardware & software and prioritized network isolation as the first thing to resolve. We have tons on our blog and page about network security and have open source software.
        • tomhow 6 minutes ago
          > however we have been working on the wifi security problem for a long time and we have a lot to say about it

          Great, please share it with us! If what you've said is true, the kind of comment you're uniquely qualified to share is the very thing the thread most needs.