[RF_Savage]

It is because of FCC certification requirements. Usually, if the end user can modify the lowlevel radio firmware on the device, the device looses it's FCC certification and cannot be sold in USA.

It also seems that Espressif has bought their wifi IP, so their contracts and licensing terms with the IP vendor likely prevent any sharing.

But FCC is the reason for closed binary blob firmware for all wifi radios out there these days.

[dariosalvi78]

I don't understand how the license affects certification TBH. As this post clearly shows users can implement their own stack if they really want to, it's not that the license is going to prevent them. Why can't one have an open source stack with specific builds that are approved, tested and certified?

[johannes1234321]

They can, but they lose their certification. Same if you don't use a certified board your antenna might need new certification of your device. It may work, but if authorities find out it may become quite expensive.

I can also remove my lights and breaks from my car and it will still work, but if authorities find out I might be in trouble.

[RF_Savage]

They could, but somebody would have to write that FOSS wifistack. You could not run selfcompiled versions of the stack on any hardware that has been FCC certified, because if you could, the certs would be gone once again.

Wifi is shared spectrum and devices using are licenced to make sure they conform to the local regulations. One size does not fit all. For example 2.4GHz wifi channel 13 is legal in EU, but in USA it falls on a govt owned band. This is why companies like Mikrotik or Ubiquiti have specific hardware versions for USA. So that they verifiably cannot be set on illegal channels by the enduser.

[dariosalvi78]

So it's perfectly feasible to have an open source Wifi, or Bluetooth or any other RF, stack, but only certain compiled versions are actually certified. I understand that the openness in this case would be limited: you lose the freedom to modify and run the software as you wish (unless you want to risk to break the law), but you can still help bugfix, improve the software and verify that there no backdoors / spying features.

The reason sometimes given by vendors that "FCC demands the code to be proprietary" is an excuse.

[PeterisP]

The law does state that "an intentional or unintentional radiator must be constructed such that the adjustments of any control that is readily accessible by or intended to be accessible to the user will not cause operation of the device in violation of the regulations" (https://www.law.cornell.edu/cfr/text/47/15.15 )

So if the manufacturer makes a device where changing the firmware is "readily accessible" to the user and there is an open source firmware available that can circumvent the FCC transmission restrictions (for example, change the power limits or channel limits for wifi physical layer), then that could be grounds for FF refusing to certify that device, as it is not permitted to make, import or sell general unrestricted transmitters to the general public (there are certain exceptions for licensed operators, ham radio, experimental use by manufacturers etc).

It's similar to other clauses that prohibit manufacturers from making it easy for the user to modify the equipment - e.g. 15.203 (https://www.law.cornell.edu/cfr/text/47/15.203) "the use of a standard antenna jack or electrical connector is prohibited." so that the user can't easily replace the antenna with a different one from what was certified.

[wkat4242]

Is that really why? I know many devices where I can just set whatever country I want :)

This is handy sometimes because in the EU it's the opposite, the 5 and 6 GHz bands are much smaller.

[calamari4065]

FCC certification is for the entire system, firmware included.

The reason the modules with integrated antenna are so popular is that the module carries its own certification, so you don't need to do it yourself.

If you use the module with an antenna connector instead of integrated, you must get your own FCC certification. It's for the entire system.

> Why can't one have an open source stack with specific builds that are approved, tested and certified?

Mainly because it's heinously expensive and difficult.

[wkat4242]

Expressif also block some cool packet injection things like sending malformed packets in their firmware. Which is not illegal to offer. They probably are afraid of getting a bad reputation.

This is why open firmware can be really handy for the security community.

[rfoo]

Given that they are originated from China, I'm not surprised.

For a while (not any more though) you can't sell an ACR122U RFID card reader online in China, just because mfoc [1] supports it nicely and it got a reputation of "smart card cloner".

[1] https://github.com/nfc-tools/mfoc