8 ms·

I own and operate Ubiquiti hardware. If this doesn't go opt in, I will not be buying more and I will stop recommending it to others. Please don't do this. Fir

I own and operate Ubiquiti hardware. If this doesn't go opt in, I will not be buying more and I will stop recommending it to others. Please don't do this. Firewalling access points, good practice or not, should not be necessary. You're not a dodgy IP cam manufacturer. People buy your equipment precisely because they want to trust their network hardware.

thijsvandien 7y ago
Indeed, this is not about anything technical. It's about their attitude.
ploxiln 7y ago
I think "analytics" has become a no-brainer among product managers at all tech companies. It seems like no company, not even GitLab, can escape the irresistible urge by management to add analytics. Arguments against it within the company are useless, it is just so obvious to management that this is the way to go, it's what all big successful companies do. Only massive public outrage can turn the accepted wisdom of analytics around, and only sometimes. High quality products were made for many years with no analytics, just by thoughtful design, using the product yourself, and gathering some feedback from users manually. Even without statistically representative data from some large target population, you can use your brain to figure out what goes wrong and how to make a good product. And I think lots of products today are quite annoying because of bad decisions based on flawed analytics data. It's hard work to run a good experiment and avoid confounding correlations and plain bugs that throw off the results, and practically nobody today does the hard work. They just run the analytics, get some flawed buggy numbers, interpret them without sufficient care and thoughtfulness, and push through bad design changes. We're data-driven! We're just not looking at the road.
- nextos 7y ago
  This is my biggest concern about present and future technology. For example, many car manufacturers are sharing real-time sensor data from their vehicles, including GPS, with third parties. There's no clear opt out. Is it anonymized? Can it get misused? Sadly yes. The freedom and transparency we got from PCs where you can always know what is going on, with some caveats, is missing from all other platforms. And it's really worrying.
  - deleted 7y ago
    [deleted]
  - arminiusreturns 7y ago
    If we let them they will do it to PC's eventually too. We have to fight for our rights. I think cell phones have normalized it for far too many people.
    - mtsr 7y ago
      What do you mean, eventually? You haven't followed the Windows analytics debacle?
      - stallmanite 7y ago
        Win10 analytics (and forced updates) is what finally pushed me to exclusively using linux after many years of dual-booting. There are still choices thankfully (for now).
      - arminiusreturns 7y ago
        We still have gnu/linux for the time being. I went linux only many years ago and have loved every minute of it.
  - Silhouette 7y ago
    Since the mandatory telemetry in Windows 10 (and the backports to Windows 7 onwards if you trusted Microsoft and installed their recommended updates) we don't even have that transparency on PCs, sadly. But I agree, it's a serious problem. The abuse has become so widespread that I am now in favour of heavyweight statutory regulation and severe penalties for violations. I don't see any other way we come back from this situation now. Competition in the market has utterly failed.
    - iforgotpassword 7y ago
      If you really care, use Linux.
- dillonmckay 7y ago
  “And I think lots of products today are quite annoying because of bad decisions based on flawed analytics data.” I agree with this, and it seems to create a self-fulfilling prophecy. I believe this to be responsible for the decline in Apple’s various device OSs.
- 9HZZRfNlpR 7y ago
  My theory is that they hunt like lunatics this engagement and time spent number. My engagement increased with new Gmail because it's slow as fuck. Of course I click around like a clown and wait, probably product manager happy that people use their product for longer now.
  - srrr 7y ago
    Maybe your "engagement" increased, but in this case your "time to task completion" did not. In most cases analytics is much more nuanced than you might think. And the reason why something got worse for you is because it got better for someone else.
    - finnthehuman 7y ago
      >your "time to task completion" did not So they're driving down the time it takes to do what they magically infer I'm trying to do. Is this why whenever I try to organize my gmail box I give up 10 minutes in because the UI is slow and bullshit? Because it's good for metrics that I can't make my gmail account anywhere near as useful as my work email?
  - distances 7y ago
    It's amazing how slow Google products are becoming. Firebase is my own pet peeve: opening a single crash report takes easily 20-30 seconds. It's unbelievable. Should be a split second for fluid workflow. Aren't they using their own products? How is this acceptable to any engineer or manager? I'd use anything else for the slowness alone if I could decide the tools at work myself.
    - crdoconnor 7y ago
      Are you using Firefox or Chrome?
      - Jamwinner 7y ago
        I am going to report it is slow on both, when the bs is disabled. Especially slow on other browsers. You know there are other browsers right? Google seems confused and angered when I dont use one of the 2 they own. Firefox is only around because they fund it discreetly to avoid antitrust, while is still sends them nearly all the same tracking metrics.
- VadimPR 7y ago
  Ever asked designers of those high quality products if they would have loved data analytics on their products? I bet they'd say they would have.
  - TeMPOraL 7y ago
    Would I love an extra thousand dollars per month on my account? Sure I would. Doesn't mean I'm going to cheat people to get it, even though I could.
    - gonzo 7y ago
      But if there was an opportunity to do so, and it required some work, would you?
  - Silhouette 7y ago
    The data you are likely to get from this sort of spyware is typically less useful than even a few sessions watching real users actually using your product and actively collecting their voluntary feedback. Source: I am basically the person you are talking about, in one of my current roles.
  - deleted 7y ago
    [deleted]
- Sharlin 7y ago
  Analytics seems to be a given even among developers. Something you ”obviously” put in just because it might be useful at some point.
- microcolonel 7y ago
  It seems that product quality is often lowest in products with the most analytics.
- paulie_a 7y ago
  The amazing thing is all that data is worthless. It hasn't improved things, ads are still stupid, products are just as slow and broken.
- cookiecaper 7y ago
  This is also why everything is mobile-first now. So many web-based applications insist that users install a mobile app for half of the functionality because that gives them a much stickier place to attach. On a browser, it's drive-by, and your ability to track users is gone once they leave your site, especially with vendors like Mozilla and Apple implementing third-party cookie blockers by default and the ubiquity of adblock. On a phone, if you install something, you'll probably leave it for at least a few days, and if you watch logcat, you'll notice that many of these apps are anything but patiently waiting for the user to decide open it up again.
  - Xelbair 7y ago
    >On a browser, it's drive-by, and your ability to track users is gone once they leave your site, especially with vendors like Mozilla and Apple implementing third-party cookie blockers by default and the ubiquity of adblock. There is a way to hijack the back button, i have no idea if it has been fixed, there are also tracking cookies so they can track you cross sites anyway.
consumer451 7y ago
If you have the spare time, OpenWRT supports Ubiquiti hardware. https://openwrt.org/toh/ubiquiti/start https://openwrt.org/toh/ubiquiti/start
- rixrax 7y ago
  And OpenBSD/octeon[0][1] appears to run on UniFi Security Gateway. Just ~ two weeks a go I finally retired my old OpenBSD based gateway in favor of USG. But no, I guess I'm back to putting OpenBSD on USG, and maybe OpenWRT on APs. Is there a working replacement OS for Ubiquiti PoE switches? [0] https://www.openbsd.org/octeon.html https://www.openbsd.org/octeon.html [1] https://codeghar.com/blog/openbsd-on-ubiquiti-usg.html https://codeghar.com/blog/openbsd-on-ubiquiti-usg.html
  - zaroth 7y ago
    Or just block the outgoing connection? What am I missing? It’s not like it doesn’t already have a firewall built into it.
    - rixrax 7y ago
      But here lies the dilemma: do I trust them? If I put in a rule to block their telemetrics, would USG honor that rule? Not just now, but after some firmware update that 'breaks' something. Or maybe I have to put another box in front of USG that I actually trust to be certain that call home got blocked. And even if I block this call home, maybe it changes to something else in next version or the next that now needs to be blocked as well. And maybe the data being sent home changes to more draconian over time as the marketing department gets greedier. And so it goes. When I buy [network] equipment, it is my expectation that since I own the HW, I am to a certain degree in control of what they do and to whom they 'talk to'. And call-home / telemetrics without at least opt-out just doesn't sit well with me here.
      - gonzo 7y ago
        Maybe read the Ubiquiti EULA. You don’t own the software.
pentae 7y ago
I discovered when trying to place an order for some of their networking gear for my vacation home in Thailand they simply refused to allow the order to go through because I wasn't in the US - Even though I was ordering to my US Address. It wasn't even due to fraud, they refused to sell something that might be used out of the US for 'legal reasons'. So why have I been able to order networking hardware from every other manufacturer with no problem? When I buy an iPhone, does Apple forbid me from using it as a hotspot outside of the country I bought it from? No of course not, that would be ridiculous.
- kyrra 7y ago
  I'm a bit confused by your wording. Are you saying your billing and shipping address were in the US, but your ip was in Thailand?
- kube-system 7y ago
  There’s a ton of legal reasons why they might be specifically concerned about exporting there and Apple isn’t. * Maybe there’s an export restriction on a component and they lack the license to export to that country. * Maybe they have not submitted their product for regulatory testing in that region. * Maybe the product doesn’t operate within legally available spectrum in that country. * Maybe the product presents an IP rights concern in the laws of that country. * Maybe they simply haven’t paid a lawyer licensed to practice law in that region to confirm they wouldn’t have any legal concerns.
- tinus_hn 7y ago
  Try buying an iPhone from the US store and have it shipped internationally. Or try buying one of their products that have only been released in the US, abroad.
  - pentae 7y ago
    You just described how I bought my last 3 iPhones so I don't really understand your point. If you use a US address its fine.
bostik 7y ago
> Firewalling access points, good practice or not, should not be necessary. It is now, it seems. Having seen what kinds of data crash reports in other domains include (the richer the call chain trace, the better) I expect this to be a subtle security problem. In regulated or otherwise highish-security networks one can expect to see user authentication when accessing wifi (EAP). Simple scenario: AP crashes during client auth stage. A full crash trace may easily contain the credentials used for EAP, and if those are sent to mothership, your access point has just leaked out the necessary information to successfully access your secure network. Worse, when EAP is used, the login is likely bound to domain credentials, which are practically guaranteed to allow access to all sorts of internal services. To state the obvious: best practice with crash traces is to filter out or mask high-value KV pairs. But then again, best practices also disallow leaking credentials in the first place. For my part, I will now consider Unifi APs as rogue devices.
- noodlesUK 7y ago
  This is exactly the sort of scenario that scares people like me when I read about telemetry being baked in. It’s just totally unnecessary risk.
  - namibj 7y ago
    Which is why I never allow error reporting. Mild UI-features-usage-statistics in anon form are allowed, but rare.
TwoNineA 7y ago
Ever since MS shoved telemetry down our throat, everyone is doing it.

thijsvandien 7y ago

Indeed, this is not about anything technical. It's about their attitude.

ploxiln 7y ago

I think "analytics" has become a no-brainer among product managers at all tech companies. It seems like no company, not even GitLab, can escape the irresistible urge by management to add analytics. Arguments against it within the company are useless, it is just so obvious to management that this is the way to go, it's what all big successful companies do. Only massive public outrage can turn the accepted wisdom of analytics around, and only sometimes. High quality products were made for many years with no analytics, just by thoughtful design, using the product yourself, and gathering some feedback from users manually. Even without statistically representative data from some large target population, you can use your brain to figure out what goes wrong and how to make a good product. And I think lots of products today are quite annoying because of bad decisions based on flawed analytics data. It's hard work to run a good experiment and avoid confounding correlations and plain bugs that throw off the results, and practically nobody today does the hard work. They just run the analytics, get some flawed buggy numbers, interpret them without sufficient care and thoughtfulness, and push through bad design changes. We're data-driven! We're just not looking at the road.

nextos 7y ago
This is my biggest concern about present and future technology. For example, many car manufacturers are sharing real-time sensor data from their vehicles, including GPS, with third parties. There's no clear opt out. Is it anonymized? Can it get misused? Sadly yes. The freedom and transparency we got from PCs where you can always know what is going on, with some caveats, is missing from all other platforms. And it's really worrying.
- deleted 7y ago
  [deleted]
- arminiusreturns 7y ago
  If we let them they will do it to PC's eventually too. We have to fight for our rights. I think cell phones have normalized it for far too many people.
  - mtsr 7y ago
    What do you mean, eventually? You haven't followed the Windows analytics debacle?
    - stallmanite 7y ago
      Win10 analytics (and forced updates) is what finally pushed me to exclusively using linux after many years of dual-booting. There are still choices thankfully (for now).
    - arminiusreturns 7y ago
      We still have gnu/linux for the time being. I went linux only many years ago and have loved every minute of it.
- Silhouette 7y ago
  Since the mandatory telemetry in Windows 10 (and the backports to Windows 7 onwards if you trusted Microsoft and installed their recommended updates) we don't even have that transparency on PCs, sadly. But I agree, it's a serious problem. The abuse has become so widespread that I am now in favour of heavyweight statutory regulation and severe penalties for violations. I don't see any other way we come back from this situation now. Competition in the market has utterly failed.
  - iforgotpassword 7y ago
    If you really care, use Linux.
dillonmckay 7y ago
“And I think lots of products today are quite annoying because of bad decisions based on flawed analytics data.” I agree with this, and it seems to create a self-fulfilling prophecy. I believe this to be responsible for the decline in Apple’s various device OSs.
9HZZRfNlpR 7y ago
My theory is that they hunt like lunatics this engagement and time spent number. My engagement increased with new Gmail because it's slow as fuck. Of course I click around like a clown and wait, probably product manager happy that people use their product for longer now.
- srrr 7y ago
  Maybe your "engagement" increased, but in this case your "time to task completion" did not. In most cases analytics is much more nuanced than you might think. And the reason why something got worse for you is because it got better for someone else.
  - finnthehuman 7y ago
    >your "time to task completion" did not So they're driving down the time it takes to do what they magically infer I'm trying to do. Is this why whenever I try to organize my gmail box I give up 10 minutes in because the UI is slow and bullshit? Because it's good for metrics that I can't make my gmail account anywhere near as useful as my work email?
- distances 7y ago
  It's amazing how slow Google products are becoming. Firebase is my own pet peeve: opening a single crash report takes easily 20-30 seconds. It's unbelievable. Should be a split second for fluid workflow. Aren't they using their own products? How is this acceptable to any engineer or manager? I'd use anything else for the slowness alone if I could decide the tools at work myself.
  - crdoconnor 7y ago
    Are you using Firefox or Chrome?
    - Jamwinner 7y ago
      I am going to report it is slow on both, when the bs is disabled. Especially slow on other browsers. You know there are other browsers right? Google seems confused and angered when I dont use one of the 2 they own. Firefox is only around because they fund it discreetly to avoid antitrust, while is still sends them nearly all the same tracking metrics.
VadimPR 7y ago
Ever asked designers of those high quality products if they would have loved data analytics on their products? I bet they'd say they would have.
- TeMPOraL 7y ago
  Would I love an extra thousand dollars per month on my account? Sure I would. Doesn't mean I'm going to cheat people to get it, even though I could.
  - gonzo 7y ago
    But if there was an opportunity to do so, and it required some work, would you?
- Silhouette 7y ago
  The data you are likely to get from this sort of spyware is typically less useful than even a few sessions watching real users actually using your product and actively collecting their voluntary feedback. Source: I am basically the person you are talking about, in one of my current roles.
- deleted 7y ago
  [deleted]
Sharlin 7y ago
Analytics seems to be a given even among developers. Something you ”obviously” put in just because it might be useful at some point.
microcolonel 7y ago
It seems that product quality is often lowest in products with the most analytics.
paulie_a 7y ago
The amazing thing is all that data is worthless. It hasn't improved things, ads are still stupid, products are just as slow and broken.
cookiecaper 7y ago
This is also why everything is mobile-first now. So many web-based applications insist that users install a mobile app for half of the functionality because that gives them a much stickier place to attach. On a browser, it's drive-by, and your ability to track users is gone once they leave your site, especially with vendors like Mozilla and Apple implementing third-party cookie blockers by default and the ubiquity of adblock. On a phone, if you install something, you'll probably leave it for at least a few days, and if you watch logcat, you'll notice that many of these apps are anything but patiently waiting for the user to decide open it up again.
- Xelbair 7y ago
  >On a browser, it's drive-by, and your ability to track users is gone once they leave your site, especially with vendors like Mozilla and Apple implementing third-party cookie blockers by default and the ubiquity of adblock. There is a way to hijack the back button, i have no idea if it has been fixed, there are also tracking cookies so they can track you cross sites anyway.

consumer451 7y ago

If you have the spare time, OpenWRT supports Ubiquiti hardware. https://openwrt.org/toh/ubiquiti/start https://openwrt.org/toh/ubiquiti/start

rixrax 7y ago
And OpenBSD/octeon[0][1] appears to run on UniFi Security Gateway. Just ~ two weeks a go I finally retired my old OpenBSD based gateway in favor of USG. But no, I guess I'm back to putting OpenBSD on USG, and maybe OpenWRT on APs. Is there a working replacement OS for Ubiquiti PoE switches? [0] https://www.openbsd.org/octeon.html https://www.openbsd.org/octeon.html [1] https://codeghar.com/blog/openbsd-on-ubiquiti-usg.html https://codeghar.com/blog/openbsd-on-ubiquiti-usg.html
- zaroth 7y ago
  Or just block the outgoing connection? What am I missing? It’s not like it doesn’t already have a firewall built into it.
  - rixrax 7y ago
    But here lies the dilemma: do I trust them? If I put in a rule to block their telemetrics, would USG honor that rule? Not just now, but after some firmware update that 'breaks' something. Or maybe I have to put another box in front of USG that I actually trust to be certain that call home got blocked. And even if I block this call home, maybe it changes to something else in next version or the next that now needs to be blocked as well. And maybe the data being sent home changes to more draconian over time as the marketing department gets greedier. And so it goes. When I buy [network] equipment, it is my expectation that since I own the HW, I am to a certain degree in control of what they do and to whom they 'talk to'. And call-home / telemetrics without at least opt-out just doesn't sit well with me here.
    - gonzo 7y ago
      Maybe read the Ubiquiti EULA. You don’t own the software.

pentae 7y ago

I discovered when trying to place an order for some of their networking gear for my vacation home in Thailand they simply refused to allow the order to go through because I wasn't in the US - Even though I was ordering to my US Address. It wasn't even due to fraud, they refused to sell something that might be used out of the US for 'legal reasons'. So why have I been able to order networking hardware from every other manufacturer with no problem? When I buy an iPhone, does Apple forbid me from using it as a hotspot outside of the country I bought it from? No of course not, that would be ridiculous.

kyrra 7y ago
I'm a bit confused by your wording. Are you saying your billing and shipping address were in the US, but your ip was in Thailand?
kube-system 7y ago
There’s a ton of legal reasons why they might be specifically concerned about exporting there and Apple isn’t. * Maybe there’s an export restriction on a component and they lack the license to export to that country. * Maybe they have not submitted their product for regulatory testing in that region. * Maybe the product doesn’t operate within legally available spectrum in that country. * Maybe the product presents an IP rights concern in the laws of that country. * Maybe they simply haven’t paid a lawyer licensed to practice law in that region to confirm they wouldn’t have any legal concerns.
tinus_hn 7y ago
Try buying an iPhone from the US store and have it shipped internationally. Or try buying one of their products that have only been released in the US, abroad.
- pentae 7y ago
  You just described how I bought my last 3 iPhones so I don't really understand your point. If you use a US address its fine.

bostik 7y ago

> Firewalling access points, good practice or not, should not be necessary. It is now, it seems. Having seen what kinds of data crash reports in other domains include (the richer the call chain trace, the better) I expect this to be a subtle security problem. In regulated or otherwise highish-security networks one can expect to see user authentication when accessing wifi (EAP). Simple scenario: AP crashes during client auth stage. A full crash trace may easily contain the credentials used for EAP, and if those are sent to mothership, your access point has just leaked out the necessary information to successfully access your secure network. Worse, when EAP is used, the login is likely bound to domain credentials, which are practically guaranteed to allow access to all sorts of internal services. To state the obvious: best practice with crash traces is to filter out or mask high-value KV pairs. But then again, best practices also disallow leaking credentials in the first place. For my part, I will now consider Unifi APs as rogue devices.

noodlesUK 7y ago
This is exactly the sort of scenario that scares people like me when I read about telemetry being baked in. It’s just totally unnecessary risk.
- namibj 7y ago
  Which is why I never allow error reporting. Mild UI-features-usage-statistics in anon form are allowed, but rare.

TwoNineA 7y ago

Ever since MS shoved telemetry down our throat, everyone is doing it.