Re: FCC issues new rules about foreign made routers

[Saku Ytti via NANOG <nanog () lists nanog org>]

On Tue, 24 Mar 2026 at 23:31, John R. Levine via NANOG
<nanog () lists nanog org> wrote:

> Oh, absolutely, the software is awful and there's a lot we can and should
> do about it.  But that's unrelated to where the box is physically
> assembled.  I have a Ubiquiti Edgerouter which as far as I know is
> designed in the US, and runs software written in the US, but it's
> assembled in China so it's lucky I already have one.

Aren they mostly Taiwanese and eastern European developers?

Someone mentioned India and AFAIK India does have domestic
capabilities. Tejas Networks contracts some of their manufacturing to
Optiemus Electronics, but silicon likely still comes from Taiwan and
Korea.

Of course all of this is ridiculous posturing, it doesn't matter where
the developer sits, it doesn't make them lower or higher risk. Silicon
Valley bigtech has teams who use Mandarin at the office because
they're all first generation immigrants. Most people are happy to
inject some code in git repo for money, and we have some security
incidents which strongly suggest this vector in American firewall
vendor.

I was recently looking at Marvell Alaska and there is absolutely no
way thing that complex could possibly be secure. And of course unlike
your phone CPU and software which have very advanced defenses, these
embedded things have nothing. I'm sure if network devices weren't so
easy and cheap to pwn, anyone motivated could pwn your device if
connected to it, via attacking the PHY and putting APT in the PHY,
jumping to other PHYs on the box to propagate the attack further.
This is not a specific complaint about Marvell Alaska, it's a fine
product. Just that infosec is an absolute joke and we have no
reasonable answer how to make it less so. Only thing we have are
policies that reduce the motivation to attack, and stick is an
incredibly inefficient policy.


-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/4QRKC5KDN7OHY6YZV5IHWEYDJBDTAU3M/