Making the OpenWrt One

In a keynote on the final day of SCALE 22x, Denver Gingerich said that he wanted to talk "a little bit about a router and also the big picture around that router". Gingerich is the director of compliance at the Software Freedom Conservancy (SFC), which is the organization behind the OpenWrt One router that LWN looked at back in November. The router is, of course, based on firmware from the OpenWrt project, which got its start because of GPL-enforcement activities and is a member project at the SFC.

He started by asking the question: "Why are we here?" He did not mean the much larger, existential question, but was focused on SCALE. People came to the conference to learn and talk about "cool technology". The accompanying image (from his slides; YouTube video is also available) was of the printing press, which was a technology that came about a few hundred years ago and changed many things. One of those things was "power; a lot of people who didn't previously have power" gained a lot because they could read and learn things they previously could not.

Power

Shifts in technology lead to shifts in power, but power is difficult to quantify, which means it is tricky to optimize. On an individual level, having power means being able to control one's life, which often translates to being able to control one's technology, he said. For devices, that largely comes down to whether an owner can repair it, modify it, and install new code on it.

Gingerich went through some of the history of devices, noting that early PCs allowed new software, including operating systems, to be installed on them. Some more recent systems, including iPhones and some Android devices, do not allow installing alternative systems. Others, such as the Nokia N900, were created using FOSS for the most part and were explicitly designed to allow alternative systems to be installed by users. That kind of control gives users agency, thus power, to customize their technology for their needs.

A more recent example of "computers" is televisions. His slide showed a Vizio TV that was installing an update, though not one chosen by the owner, but one forced on them by the manufacturer. One problem with the firmware that TV vendors provide is that it spies on the users' viewing habits in order to sell that data onward. That, like other examples of devices that remove power from users, is an example of unethical technology, he said.

Because most of our devices get their functionality from software, the path to ethical technology is via free software. The SFC has multiple initiatives on that front that are trying to ensure that users have the freedom they need. He said that he would be talking about three of those initiatives, starting with the most recent: building hardware.

Hardware

The OpenWrt One is a wireless router; it was ubiquitous at SCALE because the SFC was the network sponsor for the conference. It has a 2.5Gbps Ethernet port with power over Ethernet and a USB C connector for power, rather than needing some custom cable, along with "a lot of other neat features". Inside, there is an M.2 connector for adding storage and a mikroBUS connector for adding peripherals.

There are a number of reasons that the SFC decided to build hardware, starting with a statement that wireless-router maker TP-LINK posted on its web site. The company decided that an FCC ruling gave it the ability to "claim that you could not install what you wanted on the routers that they sold". The SFC wanted to see if that interpretation of the ruling was, in fact, true. The statement he showed was from the Wayback Machine, but he said that router manufacturers still make that claim in private to the SFC.

Another reason was that when the organization would receive firmware releases from vendors, there would often be problems in building the firmware following the vendors' instructions. "Instructions for how to compile it would tell us to run make, we would do so and then we would get an error." He showed two examples of those kinds of problems in his slides, but he could have shown hundreds; "I chose to not bore you with those today". So the SFC wanted to see if it was really that hard to provide a full source release that would actually build.

There are also problems with support life cycles in the router market. He showed a $400 router that was released in 2019, which the maker declared to be end of life in 2023. So after four years, a fairly expensive router was no longer being updated. In addition, there is often a need to get access to a serial port on routers in order to update and debug them, but many manufacturers make it quite difficult to access that port—often requiring modifying the hardware itself. Those anti-features were things that the SFC believed could be fixed in its own hardware device.

Finally, the SFC has noticed that court cases take a long time to resolve. So, the organization wanted to see if it could "perhaps make a router a little bit faster than it took for a lawsuit to happen", he said to audience laughter.

The project started with vote among OpenWrt members on whether to build hardware using the project's name. That was in January 2024 and by "black Friday" (the day after US Thanksgiving) in November, it was released. The initial units sold out in a week, which showed everyone involved in the project that there is a market for these kinds of devices—ones that give owners agency in their hardware.

Results

Gingerich showed the certification that the OpenWrt One received from an FCC testing lab, which meant that the FCC had no problem with the device. "We had been telling router manufacturers for a while that this was not a problem. And now we had the proof."

The OpenWrt One also showed that you can provide the software and instructions on how to build and install it on the device. Pointing router makers at that simple set of instructions can perhaps help steer them toward doing something similar for their devices.

In terms of support, there is no specific timeline for the OpenWrt One, but community support for distributions like Debian and OpenWrt are generally quite long. Debian still supports the Pentium 4, which came out 25 years ago and OpenWrt currently supports routers that were released 14 years ago. He expects the OpenWrt One to have at least ten years of support, if not 20 or 30 years. "We think we should be measuring support life cycles in decades, not just a few years."

The device also solves the serial-port problem. On the front of the OpenWrt One, there is a USB C serial port connector, so no soldering or other modification is required. That was popular with the audience, which cheered and applauded. Meanwhile, it took about 11 months from conception to shipping for hardware; a recent lawsuit that looks to be winding down will end up taking around 47 months, perhaps more. Both approaches are important, however, as people should not have to buy new hardware to get agency in their devices.

There is, unfortunately, still a binary blob or two in the OpenWrt One, however. These are bits of proprietary code that run on the wireless chip and the Ethernet controller; there is another blob for RAM calibration as well. Those are needed because of "power that we don't have yet".

One way to solve that problem is to find hardware that does not require blobs; such hardware does exist, at least for now, but only for networking protocols that are 20 years old. If the features that are provided by that hardware are sufficient, he suggested buying routers from ThinkPenguin, which has devices without blobs that are also "very much compliant with the copyleft licenses".

The SFC decided to take the approach that it did to try to get new hardware to the same blob-free place. There are two main ways to fix the problem of blobs in today's hardware. The first is to reverse-engineer the existing blobs and replace them with free-software equivalents; the device was designed with the ability to replace the blobs, rather than putting them into an unchangeable ROM. The second mechanism is by gaining market power; selling more free devices like the OpenWrt One will show the part manufacturers that there is a problem that needs to be fixed.

There is still more work to be done to have more devices that will respect our freedoms, Gingerich said. A vote is coming to a close in the OpenWrt community on building an OpenWrt Two. It would be a different kind of device, with two 10Gbps ports, several 2.5Gbps ports, and Wi-Fi 7. That will likely be available in late 2025; the OpenWrt One will still be available once that starts shipping. The SFC is exploring other device classes where it might be sensible for it to make its own hardware.

Member projects

The SFC is also in the business of making "humanity-first software" by way of the member projects that it shepherds; "we do a lot of work for them to make sure they are successful in what they do". The idea is that humanity-first software should be putting its users first by giving them agency. He highlighted some of the "few dozen" member projects that call the SFC home.

The Reproducible Builds project is working toward the ability for multiple parties to create bit-for-bit identical binaries from source code. This will be useful for ensuring license compliance among many other uses. OpenWrt is another member project, which is part of why the SFC has worked with it to produce its hardware. OpenWrt came about when Linksys released code for one of its routers after a compliance lawsuit.

The Wine project "allows people to get incrementally more agency in their computing" because they can move to a new operating system without leaving all of their Windows applications behind. The SFC is also the home for Git, so that it can continue to be "free and accessible to people and is not controlled by any particular for-profit entity". Two other distributed version-control systems, Mercurial and Darcs, are also member projects.

The Etherpad project is a "community collaboration tool" that allows collaborative document editing like that found in Google Docs, "but with a lot more freedom". The SFC runs an Etherpad instance that can be used, or, of course, you can run your own, he said.

Lastly, Gingerich called out Outreachy, which provides internships in FOSS. There has been a push recently against the importance of diversity, equity, and inclusion (DEI) initiatives, but the SFC believes that in order to have computing freedom for everyone, those working on FOSS "need to be representative of society as a whole". That was met with a resounding round of applause.

Lawsuits

The final SFC initiative that he talked about was lawsuits, which he labeled with a :( frowning face on his slide. The organization is not at all sad that the legal avenue for enforcing users' rights exists, but it is unhappy that it has to use it at times. Those rights revolve around the source code that is covered by licenses like the GPLv2 that is used for Linux; users have the right to the code and "everything that you need to compile and install changes onto that device".

The first thing that companies need to do is to make users aware that they have those rights, which is done by placing an offer for the source code in the manuals or other materials accompanying the device. He showed a few examples, including the offer that is printed on the box of the OpenWrt One. The latter is different in that it actually encourages users to obtain and modify the software, but it is also different because it will truly provide the source code. For the others: "Unfortunately you do not get the complete source code, you get something incomplete that does not give you full freedom and agency".

The GPLv2 is effectively a bargain with the manufacturers of devices: they get a bunch of code that they can modify and ship on their device, but they must give all of the rights they got from the software developers to those who they sell or otherwise distribute the device to. "That is the bargain; it seems fairly simple to me", but companies sometimes do not want to do their part. "They want to alter the deal" (with a slide of the classic Star Wars scene), but the license does not allow them to do so.

There are steps that can be taken when that happens. The first step that the SFC takes is to nicely ask the manufacturer to fix the problems with their source release. So that anyone can check these source releases for themselves, the SFC has created the Use The Source web site, which has candidate source releases along with information about any problems found in them. He showed an entry for the OpenWrt One, which naturally showed that the source could be built and installed into the device. On the other hand, the entry for the Google Nest Hello has a detailed description of all of the different problems that were found in its source release.

After another example or two, he said that he would briefly talk about some of the lawsuits, though SFC policy fellow Bradley Kuhn was giving a talk just after that would be covering them in detail. One of the lawsuits was against AVM as an entry for its Fritz!Box 4020 router indicates. Sebastian Steck in Germany bought one of the routers and did not receive the full source code, even after asking for several years, so he sued with the help of the SFC and won. The outcome is that users can repair and reinstall the software in those routers. "It's very exciting that purchasers of the device have the ability to use the courts to get their rights." That, too, was met with applause.

The SFC bought a Vizio television in 2018, requested the source, and was unable to get it. The organization bought a new TV in 2021, thinking that the problems must have been solved by that point, but the new TV had the same problems, so a lawsuit was filed. The suit is being pursued as a purchaser of the device and is trying to obtain the source, in part to potentially start a project like OpenWrt but for televisions.

There have already been some wins in the Vizio suit, Gingerich said. A federal court judge agreed that the "cause of action" was legitimate, thus that purchasers do have the right to bring lawsuits to force companies into compliance with the licenses. He suggested that those interested could come to the trial in Santa Ana, California starting on September 15 to "cheer us on—please do so very silently and respectfully". The SFC expects the trial to take a week or more.

If people are interested in bringing their own compliance lawsuit, the SFC would be happy to coordinate and assist in that effort, so those who want to take that path should get in touch. There are simpler paths available as well, including reporting GPL violations to the organization. Source candidates can be uploaded to the Use The Source site, which will allow the SFC and others to help determine if the candidate is complete. People can comment on the candidates to describe problems that they found, but the hope in the long term is that people will use the site "to discuss the neat things they're able to do with all their rights" by being able to modify their devices. The site can also be used to upload pictures of offers for source code, which will allow the SFC to request the code; he suggested people look in the manuals and menus of their devices to find such offers.

It makes a big difference what you buy, he said; for example, if you are in the market for a router, the OpenWrt One is a great choice, with $10 of each purchase going to the SFC and OpenWrt project. As more of those device are sold, that increases the power that the SFC has to put pressure on manufacturers to provide more freedom-respecting parts and equipment. There are also lots of options for running OpenWrt on existing routers or ones that can be bought used, which will help reduce the e-waste problem; he pointed to a list of supported routers that will run the latest OpenWrt releases for that. Lastly, "what you don't buy also makes a big difference"; the SFC is a non-profit organization that relies on donations to fund its activities and he, naturally, encouraged people to help out.

[I would like to thank the Linux Foundation, LWN's travel sponsor, for funding to travel to Pasadena for SCALE.]