[imglorp]

Since you need a DOCSIS modem box and a router, I would suggest people put a router box you fully control behind your ISP's DOCSIS brick, and just assume the latter is compromised continuously.

I use pfsense on a usb stick in a little box with 2 ethernets.

[sliverstorm]

Which, frankly, isn't even a paradigm shift. It just means the transition from trusted to untrusted is in your living room instead of on the street corner outside in the cable box.

[Igglyboo]

What is a DOCSIS modem and why can't an open source one be built? Also, how does putting your router behind your DOCSIS modem help?

Genuinely curious, don't know much about networking.

[bri3d]

DOCSIS is the standard for IP networking over cable TV infrastructure. An open source modem can't be built because there's a huge certification / documentation fee from CableLabs and part of the requirements involve the cable carrier being able to control/update the modem at their whim.

Putting your router behind the DOCSIS modem lets you firewall the modem the same way you'd firewall the Internet at large - that is, an attacker who compromises the modem wins the ability to specifically monitor your traffic, but does not immediately gain free access to your local network.

[Igglyboo]

Would it be possible to just fake the cert or generate your own, in the same way that some people self sign SSL certificates instead of paying Verisign?

[blinkingled]

Parent wasn't talking about SSL certificates - you need to certify both hardware and software and pay a fee and the ISPs generally don't let you run your own firmware on the cable modem - heck they don't let the OEM update it either.

[Spooky23]

The cable companies need to be able to push firmware and settings to maintain the network and avoid abuse. So they have certification standards and you need to pay to play.

For example, with DOCSIS 2 modems, you could spoof the MAC address and make some config changes and get anonymous internet access at the highest service tier.

[plonh]

Why does cable company need special powers that my DSL provider does not need?

[aftbit]

Because cable is a shared RF resource, and your DSL line is (nominally) a point to point link.

[Spooky23]

It's a completely shared infrastructure from the demarc in your home to the local cable node. It's not very secure and pretty trivial to abuse. Remember this was an infrastructure originally implemented to distribute TV signal.

Because of that TV heritage and the way they grew (on a town by town franchise basis), cable networks were usually a patchwork of really shitty networks up until fairly recently. My (limited) understanding is that on relatively modern cable systems, there is fiber connectivity to the local nodes, and then coax from that device to the homes in the area.

DSL is a switched network of sorts, and provisioning happens on the switch in the CO. Ditto for fiber.

[e40]

Yeah, no need to trust these things as firewalls.

[gregwtmtno]

What model box do you use? I've been looking for something affordable for the job.

[mwpmaybe]

If you can splurge a little, this little guy is awesome and includes support from the pfSense team:

https://store.pfsense.org/SG-2440/

Or you can buy one of these and flash it to pfSense yourself:

http://store.netgate.com/ADI/RCC-VE-2440.aspx

[imglorp]

Cheap fanless motherboard with 2 NIC's: https://www.amazon.com/gp/product/B006ICQ3FK/ref=oh_aui_deta... ... pay attention to the power supply brick, you might need a little adapter dongle for the mobo.

and a cheap case: https://www.amazon.com/gp/product/B003DXI288/ref=oh_aui_deta...

No hard drive, just a usb stick to boot the OS off and save his settings. PFsense in my case, a BSD variant.