On Tue, 24 Mar 2026 at 23:31, John R. Levine via NANOG <nanog@lists.nanog.org> wrote:
Oh, absolutely, the software is awful and there's a lot we can and should do about it. But that's unrelated to where the box is physically assembled. I have a Ubiquiti Edgerouter which as far as I know is designed in the US, and runs software written in the US, but it's assembled in China so it's lucky I already have one.
Aren they mostly Taiwanese and eastern European developers? Someone mentioned India and AFAIK India does have domestic capabilities. Tejas Networks contracts some of their manufacturing to Optiemus Electronics, but silicon likely still comes from Taiwan and Korea. Of course all of this is ridiculous posturing, it doesn't matter where the developer sits, it doesn't make them lower or higher risk. Silicon Valley bigtech has teams who use Mandarin at the office because they're all first generation immigrants. Most people are happy to inject some code in git repo for money, and we have some security incidents which strongly suggest this vector in American firewall vendor. I was recently looking at Marvell Alaska and there is absolutely no way thing that complex could possibly be secure. And of course unlike your phone CPU and software which have very advanced defenses, these embedded things have nothing. I'm sure if network devices weren't so easy and cheap to pwn, anyone motivated could pwn your device if connected to it, via attacking the PHY and putting APT in the PHY, jumping to other PHYs on the box to propagate the attack further. This is not a specific complaint about Marvell Alaska, it's a fine product. Just that infosec is an absolute joke and we have no reasonable answer how to make it less so. Only thing we have are policies that reduce the motivation to attack, and stick is an incredibly inefficient policy. -- ++ytti