Broadband Forum, Munich, 25–27 June 2025. Recording. I also sat on the open-source CPE roundtable at the same event.
The reason so many devices in the field run old software is not that operators are careless. It is that the unit of change is wrong. A broadband portfolio runs to hundreds of variants across gateways, access points and fixed wireless, and the traditional way to fix anything is to build, qualify and ship a whole firmware image per variant. Small fixes cost the same as large ones, so small fixes wait.
Modular package management is the way out of that. Alpine and APK let a component or a container be updated on its own without rebuilding the image around it. The benefit I did not expect to matter as much as it does is the bill of materials: APK tells you what is actually inside a given image, so dependency tracking, open-source license compliance and vulnerability response become a lookup rather than an investigation. With the Cyber Resilience Act reporting obligations arriving, that stops being a convenience.
The management plane has to be standards-based for the same reason the packaging does. USP, the Broadband Forum’s TR-369, is what makes remote configuration, monitoring and troubleshooting work across devices you did not build, and every operator estate of any size is multi-vendor. prplLCM covers the lifecycle half. The discipline worth keeping there is to run the open implementation as it is rather than fork it, because a fork has to be carried against every upstream change afterwards.
The part I would push hardest on is security. Running privileged containers on a device in someone’s home is not an acceptable end state. What it has to become is unprivileged execution by default, access control lists bounding what an application can reach on the host, and signed images so the device can verify what it has been asked to run. None of that is exotic. It is ordinary practice everywhere else in the industry, and the edge has been slow about it.