14 ms·

> Which network vendor has better security updates? I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper

> Which network vendor has better security updates? I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc) > Can you point to a specific example of them not fixing a security issue that was addresssd by others? I haven't looked recently, but when I last updated my ER-X I noticed that the latest available packages included a large number that were not up-to-date with the latest available security fixes. One of the problems is that the version of Debian that the hardware (MIPS) Ubnt uses is end-of-lifed on the old version of Debian that EdgeOS is based on. Where most vendors could simply track the official Debian repositories, Ubnt is stuck rolling their own packages. If Ubnt has finally moved on to an officially supported version of Debian then this is less of an issue. This is one of those I wish I had a better solution moments. For the home user this may not pose a challenge, but in a business environment I'd say that it's probably worth spending the big bucks on a vendor with a better track record. That's not to say there aren't other bad vendors, but it is to say that Ubnt gear does not belong outside of a home lab. I haven't evaluated Mikrotek because the Ubnt stuff works well enough (but certainly not great) for me in the two locations I've got it deployed.

walterbell 8y ago
Cisco has not been having a good year, https://www.bleepingcomputer.com/news/security/hardcoded-password-found-in-cisco-enterprise-software-again/ https://www.bleepingcomputer.com/news/security/hardcoded-pas... Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.
- twunde 8y ago
  This is actually good news. Cisco has been doing real security audits, where they go through the source code with a fine tooth comb and look for hidden backdoors. And even better they're actually telling us about them instead of turning them off silently. You can bet that a significant number of competitors have similar issues with backdoors. This is a case where a vendor is actively looking for security problems and putting in place processes to prevent them vs the normal vendors who just respond to security reports.
  - IcePic 8y ago
    Oh please. The issue has more than one dimension. Apart from them being nice and auditing now, there is still the fact that their internal processes have allowed (and probably encouraged) stashed passwords in such a manner that 6 of them has been found in a really short time. Unless your process is total garbage you don't end up with 6 backdoor passwords like that without knowing it. So for any company that prides themselves with having a device in the middle of LOTS of networks, its a very poor track record to figure out security and backdoors don't really mix in 2018.
- inferiorhuman 8y ago
  > Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD. The ER-L is what I spoke of when I referred to the chronic overheating problems. From a different reply to my comment it sounds like there may be other Ubnt devices that suffer the same fate. The ER-L also has issues with reordering UDP packets.
zifnab06 8y ago
The downside of the vendors you listed (and Cisco) is they require a support contract for software updates. If you lack said contract, you do not receive security updates. Imo ubiquiti works fine for smaller offices. If you don't have enough people to justify an IT org it makes sense.
- inferiorhuman 8y ago
  > If you don't have enough people to justify an IT org it makes sense. Disagree, and not just because of the GPL violations and security issues. There are enough subtle bugs (e.g. data corruption with hardware acceleration) and design flaws (e.g. overheating) that you are setting yourself up for intermittent bugs (a.k.a. trouble) if you don't have someone well versed in diagnosing network issues. It's powerful enough to do fun things in a home lab, but it's way too complex for a professional setting where there's nobody around with the skills to troubleshoot it. Enterprise gear is expensive, yes.
microcolonel 8y ago
> I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc) Whatever you do, don't use Cisco Meraki. Their edge equipment didn't correctly implement STP until like... a couple years ago; and it is known to stall inbound TCP, while leaving those same sockets open for outbound traffic, randomly and frequently.

walterbell 8y ago

Cisco has not been having a good year, https://www.bleepingcomputer.com/news/security/hardcoded-password-found-in-cisco-enterprise-software-again/ https://www.bleepingcomputer.com/news/security/hardcoded-pas... Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.

twunde 8y ago
This is actually good news. Cisco has been doing real security audits, where they go through the source code with a fine tooth comb and look for hidden backdoors. And even better they're actually telling us about them instead of turning them off silently. You can bet that a significant number of competitors have similar issues with backdoors. This is a case where a vendor is actively looking for security problems and putting in place processes to prevent them vs the normal vendors who just respond to security reports.
- IcePic 8y ago
  Oh please. The issue has more than one dimension. Apart from them being nice and auditing now, there is still the fact that their internal processes have allowed (and probably encouraged) stashed passwords in such a manner that 6 of them has been found in a really short time. Unless your process is total garbage you don't end up with 6 backdoor passwords like that without knowing it. So for any company that prides themselves with having a device in the middle of LOTS of networks, its a very poor track record to figure out security and backdoors don't really mix in 2018.
inferiorhuman 8y ago
> Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD. The ER-L is what I spoke of when I referred to the chronic overheating problems. From a different reply to my comment it sounds like there may be other Ubnt devices that suffer the same fate. The ER-L also has issues with reordering UDP packets.

zifnab06 8y ago

The downside of the vendors you listed (and Cisco) is they require a support contract for software updates. If you lack said contract, you do not receive security updates. Imo ubiquiti works fine for smaller offices. If you don't have enough people to justify an IT org it makes sense.

inferiorhuman 8y ago
> If you don't have enough people to justify an IT org it makes sense. Disagree, and not just because of the GPL violations and security issues. There are enough subtle bugs (e.g. data corruption with hardware acceleration) and design flaws (e.g. overheating) that you are setting yourself up for intermittent bugs (a.k.a. trouble) if you don't have someone well versed in diagnosing network issues. It's powerful enough to do fun things in a home lab, but it's way too complex for a professional setting where there's nobody around with the skills to troubleshoot it. Enterprise gear is expensive, yes.

microcolonel 8y ago

> I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc) Whatever you do, don't use Cisco Meraki. Their edge equipment didn't correctly implement STP until like... a couple years ago; and it is known to stall inbound TCP, while leaving those same sockets open for outbound traffic, randomly and frequently.