So it's official now. Monday the president signed S.J.Res. 34, which kills the FCC broadband privacy rules that would've made ISPs ask before selling your browsing history to advertisers. The rules hadn't even taken effect yet, they were supposed to kick in later this year, but Congress killed them first (House vote was 215-205, more or less a party-line thing) and now they're just gone. Cox, Comcast, Verizon, whoever you pay every month for the privilege of loading Reddit, can bundle up where you go online and sell it. No opt-in required.
I've been putting off writing anything about this because every tech site on earth has already done the "what this means for you" post, complete with the ominous stock photo of a padlock. I don't want to write that post. What I actually did was spend most of Saturday afternoon in my garage, on the floor, with my laptop and an Asus router that I bought two years ago and never once touched the settings on beyond changing the wifi password from the default.
Turns out flashing Merlin firmware onto an RT-AC68U is not the fifteen-minute job the forum posts made it sound like. It's closer to ninety minutes if you're doing it for the first time and you're paranoid about bricking a $140 router. I bricked it once, actually, had to hold the reset button for thirty seconds and do the whole thing over. My cat sat on the router box the entire time like she was supervising. She was not helpful.
The reason I wanted custom firmware in the first place is that stock Asus software doesn't let you run OpenVPN client mode at the router level, only server mode, which is backwards from what I needed. I want everything in the house routed through a VPN before it ever hits Cox's equipment, not a VPN so I can dial into my own house from outside, which is the thing router manufacturers assume you want. Once Merlin was on there it took maybe ten minutes to get Private Internet Access configured, $39.95 for the year if you pay upfront, which works out to about $3.33 a month. Cheaper than the coffee I bought while researching this.
Here's my actual opinion, since apparently I have to have one: I think most of the outrage this week is a little theatrical, because ISPs were already doing plenty of shady stuff under the old FCC rules and everyone kind of shrugged. But I also think "well it was already bad" is a lazy reason to shrug off it getting worse, and this does make it worse, in a very concrete and legal way now. My actual browsing history is not that interesting. I read a lot of camera review sites and I have looked up "how long can chicken sit out" more times than I'd like to admit. But that's not really the point. The point is a company I have basically no other option for (Cox is it, in my neighborhood, unless I want DSL at 6 Mbps) gets to profit off cataloging my habits and I don't get a say.
Anyway. This blog has been running off a home connection since November 2011, through at least three different routers and two ISPs, and it's a little strange to think that every dumb post I've ever written, every 2am typo I fixed the next morning, was theoretically visible to whoever was watching the pipe the whole time. Doesn't change much practically. I'm not doing anything more interesting now than I was in 2012. I just don't love that it's for sale.
If you're thinking about doing something similar, skip the whole router-flashing part unless you specifically want whole-house coverage or you enjoy yelling at a laptop on your garage floor. Installing a VPN client directly on your phone and laptop gets you 90% of the benefit with none of the risk of turning your $140 router into a paperweight. I just happen to like doing things the hard way apparently.