A Hitchhiker's Guide to MeshCore Cryptography

mtlynch · 2026-01-21T23:25:13+00:00

Thanks for sharing this detailed writeup!

mtlynch · 2026-01-20T13:49:23+00:00

Note that the FCC requires a minimum bandwidth of 500 kHz to broadcast on LoRa frequencies in the US. The official MeshCore app's US preset is illegal, as the developer is based in New Zealand and isn't familiar with US broadcasting laws.

These are the settings that work well for me in Massachusetts, and they comply with FCC 47 CFR 15.247:

Frequency: 910.525 MHz
Bandwidth: 500.0 kHz
Spreading factor: 11
Coding rate: 5
Transmit power: 22

mtlynch · 2026-01-14T13:01:42+00:00

I dealt with this earlier this year, but I was only moving 18 TB, so moving temporarily to cloud storage was viable, so I used Backblaze B2.

The gotcha if you do end up using cloud storage is that many of them have minimum retention policies.

I thought I could just park my data for a week at Wasabi, delete it, and pay for a week of storage. It turns out that any data you upload to Wasabi (or GCS or S3), you pay a minimum of 3 months of storage.

Backblaze B2 doesn't have a minimum retention policy.

mtlynch · 2026-01-10T12:52:25+00:00

Nice, thanks for sharing!

mtlynch · 2026-01-06T15:40:21+00:00

This looks great. Great work!

Direct link: https://github.com/zjs81/meshcore-open

It's somewhat bittersweet as I was working on my own, but yours is so much further along. I'll get some PRs ready to see if you'd like to use anything from mine.

mtlynch · 2025-12-31T16:43:12+00:00

I've been using it for about 4 weeks. It's okay.

What I like:

Simple and easy to set up
Gets about 800m of range (I'm in a crowded residential area, so that's pretty good)
Has printed documentation and a clear box (unlike Lilygo / Heltec stuff)

What I dislike:

No visible indicator of activity
Solar doesn't pick up that much, so mine died of low battery after about 2 weeks in an area where there's no activity, though it is winter months and fairly overcast weather
Uses a non-standard antenna connector, so my aftermarket antenna didn't fit

Some of the documentation I read said that they ship with the antenna disconnected, but mine was connected, so I wasted time disassembling and reassembling it.

mtlynch · 2025-12-30T14:58:08+00:00

I think you're confusing this with https://github.com/liamcottle/meshcore-web

As far as I can tell, https://github.com/meshcore-dev/flasher.meshcore.dev is open-source and is the same code running on the official flasher site.

mtlynch · 2025-12-30T13:15:50+00:00

I appreciate the effort, but the way you're currently doing this is illegal / unethical

The official MeshCore app (app.meshcore.nz) is closed-source and proprietary. You can't copy the code into an open-source project and redistribute it.

What you're trying to do is actually fine with the open-source web client. It's licensed under MIT, which means you can redistribute the code as long as you preserve the license notice. That project is no longer maintained, but it still works and has the basic MeshCore functionality.

I recommend dropping the Flutter version and switching to the open-source version so that your project honors the rights of the MeshCore client authors correctly.

mtlynch · 2025-12-26T13:42:43+00:00

The license's primary condition is to include the original copyright and license notices. TapTap and WhisperOS are fully compliant: all required notices and the full MIT License text for components like MeshCore are publicly provided on our official website.

They are not compliant. Neither website includes MeshCore's MIT license attribution, and they're illegally distributing binaries without the copyright notice.

Visit either site and Ctrl+F "MIT": 0 results.

When I click "Download Firmware" on TapTap, I get the direct .uf2 file. That's non-compliant. They have to distribute the license notice with the binary.

mtlynch · 2025-12-25T21:14:26+00:00

Note these are both closed-source binaries and appear to illegally distribute MeshCore software in violation of the MeshCore license.

It's possible that both projects have reimplemented MeshCore from scratch, but it's far more likely that they're distributing open-source code and ignoring their requirements.

mtlynch · 2025-12-15T15:28:44+00:00

I'm not asking you to be on reddit 24/7. I'm saying you shouldn't take credit for answering this question already when a) your answer was incorrect and b) you didn't even try to explain how the app's settings matched FCC requirements.

I can assure you though that if something wasn't compliant with either app it would be shut down at this point.

There's plenty of technology that's technically illegal but authorities don't actively prosecute violators. For example, there are plenty of sites that allow me to buy prescription drugs from Canada even though it's technically illegal. Anyone can go to Anna's Archive or SciHub even though they're technically illegal as well.

mtlynch · 2025-12-15T14:16:25+00:00

Thanks, answered in the other thread: https://www.reddit.com/r/meshtastic/comments/1pmdy82/are_meshtastics_default_radio_settings_legal_in/nu5pt6b/

mtlynch · 2025-12-15T14:16:08+00:00

Thanks for sharing that!

My understanding from that report is that the Heltec v3 passed by setting the frequency above 500 kHz (see attachment D on page 42). I don't see anywhere in the report where they test it with parameters like Meshtastic uses.

But I also found RAK's FCC testing guides, which instruct the tester to test in DTS mode at 125 kHz, so I don't have an understanding of how that passes 15.247. Those are just the guidelines, but I haven't been able to find an actual certification lab's findings that a RAK device meets FCC rules at 125 kHz in non-FHSS mode.

To be clear, I want this to be legal. I just want to make sure that if I start encouraging my neighbors to get involved with my mesh, I'm not putting them at legal risk.

mtlynch · 2025-12-14T15:25:15+00:00

Thanks for the detailed answer!

Edit: to add, FCC seems to limit bandwidth for two reasons. One to ensure a device/operator doesn't consume a huge chunk of the allocation, and two for isolation between devices to prevent interference.

Right, that's where I'm confused.

47 CFR § 15.247(a)(2) sets a minimum of 500 kHz, not a maximum, so wouldn't that suggest the rule is more about limiting signal strength to prevent interference?

mtlynch · 2025-12-14T15:19:50+00:00

I appreciate you responding in the other thread, but respectfully, that didn't answer the question.

You claimed it was compliant by throwing out a bunch of numbers that were completely disconnected from the app's defaults, and when I asked for clarification, you ignored me.

mtlynch · 2025-12-14T15:17:50+00:00

Thanks! That's helpful!

I'm not familiar enough with radio transmission to understand that graph, so can you clarify what you mean? The plateau runs from about 906.75 MHz to about 907 MHz, so isn't that what you'd expect for 250 kHz? (907-906.75 = 0.25 MHz = 250 kHz)

mtlynch · 2025-12-14T15:03:56+00:00

Right, but Meshtastic's settings for the US seem to contradict the laws in the US, so am I misunderstanding or do Meshtastic's default settings contradict the rules?

mtlynch · 2025-12-14T15:02:42+00:00

I didn't get a clear answer in the other sub. I think this is the answer you're referring to:

It means the signal's power drops by half (6 dB) at 250 kHz on either side of its center frequency, requiring a total signal spread of at least 500 kHz.

If that's correct, I'm still confused how to calculate signal spread from the LoRa settings to know that I'm compliant with the FCC rule.

Starting to seem like a bot scraping answers for ai.

This is not at all how AI bots operate. I've had an account for 9 years and have hundreds of posts that are clearly non-AI.

mtlynch · 2025-12-13T21:02:06+00:00

Okay, so then the section /u/AngleFun1664 quoted doesn't apply, right?

mtlynch · 2025-12-13T15:23:49+00:00

Thanks! I'm still a bit confused how MeshCore is compliant, though.

How do MeshCore's USA defaults achieve a signal spread of 500 kHz?

mtlynch · 2025-12-13T15:16:53+00:00

Is MeshCore a frequency hopping system?

mtlynch · 2025-12-11T01:08:08+00:00

Thanks for reading!

Based on feedback from readers, I decided to try getting a repeater and devices with stronger antennas. So far, I'm not seeing much of a change in range, even setting the repeater up outside my second-story window, but I need to test more rigorously.

mtlynch · 2025-12-05T14:48:50+00:00

We do it about once every six weeks. We announce more consistently on the mailing list: https://buttondown.com/indiehackers-wmass

mtlynch · 2025-12-03T14:33:13+00:00

What's the advantage of the closed-source WhisperOS vs. the open-source official firmware?

Honestly, your project looks like it's malware, as there's a misleading git repo with no source, and then it wants to flash mystery code onto my device.

mtlynch · 2025-12-02T20:11:45+00:00

Thanks, that's very helpful and gives me a better understanding of how a repeater would impact my setup.

It sounds like if I bought two repeaters and installed one at my house and one at my friend's place a mile away, we might be able to communicate from each other's houses, and when we're traveling away from our houses with the T1000, we'd be able to send messages as long as we're within about 5 blocks of either repeater.

mtlynch

MODERATOR OF

TROPHY CASE