3 ms·

Disturbing, easy to fix, but disturbing. Ironically blocking various widgets from spying on me was why I bought ubiquiti hardware. I was noticing regularly ou

by sliken 7y ago

Disturbing, easy to fix, but disturbing. Ironically blocking various widgets from spying on me was why I bought ubiquiti hardware. I was noticing regularly outbound network connections from my TV, turns out it was finger printing what I watched and reporting back to the mothership. It no longer gets network access of any kind. I was tired of playing the OpenWRT/DDWRT flavor of the week (korg) on hardware that wasn't really well supported (netgear R7000). I hated the disposable nature of configuring the routers and having to largely throw away that configuration with each major upgrade. Even getting Comcast's /60 handled was painful (a bug in dhcpd6c or similar). I also wanted to handle WIFI APs well and not have a painful upgrade process. I have a Ubiquiti NanoHD, EdgeRouter 6p, and a PoE EdgeSwitch 8xp. Nice GUI, you can fall back gracefully to command line, and backup your device state in a human readable config file you can keep in version control. Upgrades are typically press a button in the web UI and wait a few minutes. They handle my moderately complex home network. Comcast gives in a /60, I split that into a /64 per 4 router ports. Lets me split the trusted stuff (desktops and laptops I manage) from the untrusted. I can even login over ssh to manage them with a key. It's been very handy. If one of my PoE cameras freak out, I can bounce them remotely. If various android apps have anti-social behaviors to avoid DNS based blocking I can track them on IPv4, IPv6, and block them when they try to skip my name servers. Took me a bit to block all IPv6/IPv4 DNS traffic to force anything on my network to actually use my nameservers. I'm not looking forward to DNS over TLS which despite the promises seems like will inevitably make things harder to filter. Anyone know of a Ubiquiti competitor that's better about handling privacy and security and not trying to install spyware?

tjoff 7y ago
Easy to fix for whom? How do you fix the trust issue? What to do when they add this to their other products, such as routers?
- sliken 7y ago
  It's easy to block devices from calling home. The trust issue is harder. I think the real fix is to move to a different company until they change their minds. Ubiquiti does seem like a generally good company, just seems like someone decided more feedback on failures was a good idea and added the remote debugging... without thought on opt-in. After all I get a few similar reports a day (x failed... report home?), but they are of course opt-in.
  - SteveNuts 7y ago
    I think OP's point is if Ubiquiti decided to roll this up through their networking stack, they could theoretically silently still send the updates through to their collectors, no matter how many blocks you put in place (assuming you use Ubnt switches/routers/firewalls/APs). This would be easy to discover if you mixed brands, but the point is how would you trust them anymore?
    - zaroth 7y ago
      The entire product line is specifically designed to give you insight into what packets are going where, and the ability to control which ones you let through. You can argue that this should have been opt-in but it’s absurd to say that anyone cannot trivially opt-out. I don’t understand the point of speculating that they are going to break iptables to get crash reporting, other than spreading FUD.
      - mtgx 7y ago
        Microsoft broke local search completely on latest Windows 10 updates if you've ever tried to block Cortana. They count this as a non-issue because from their point of view you're not supposed to block Cortana/web search. I've hated this "just block it" mentality around Windows 10 from day one because it was obvious to me it would be a losing game for the user in the long term. You can't fight the software developer forever on this and with each update they send. Eventually if they really want that tracking feature they're going to integrate it into some other core feature that will stop working if you try to disable the tracking.
  - tomasato 7y ago
    If you block it, it leaks memory until it crashes the device
    - unwind 7y ago
      No, the reply from the Ui employee specifically mentions in which fw release that bug was fixed.
wtallis 7y ago
> I was tired of playing the OpenWRT/DDWRT flavor of the week (korg) on hardware that wasn't really well supported (netgear R7000). I should think so. Broadcom doesn't want their hardware to be properly supported by open-source software, so you were never going to be entirely successful in your quest to find good third-party firmware for that particular router. In the long run, it's always worth returning any such hardware and spending a bit more time shopping around for a router or AP that uses Qualcomm, Mediatek or Marvell chipsets (Ubiquiti APs use Qualcomm). And if you don't like the flavor of the week mess for firmware distributions, stay away from DD-WRT and prefer OpenWRT, which actually does clearly-identified stable releases.

by sliken 7y ago

tjoff 7y ago

Easy to fix for whom? How do you fix the trust issue? What to do when they add this to their other products, such as routers?

sliken 7y ago
It's easy to block devices from calling home. The trust issue is harder. I think the real fix is to move to a different company until they change their minds. Ubiquiti does seem like a generally good company, just seems like someone decided more feedback on failures was a good idea and added the remote debugging... without thought on opt-in. After all I get a few similar reports a day (x failed... report home?), but they are of course opt-in.
- SteveNuts 7y ago
  I think OP's point is if Ubiquiti decided to roll this up through their networking stack, they could theoretically silently still send the updates through to their collectors, no matter how many blocks you put in place (assuming you use Ubnt switches/routers/firewalls/APs). This would be easy to discover if you mixed brands, but the point is how would you trust them anymore?
  - zaroth 7y ago
    The entire product line is specifically designed to give you insight into what packets are going where, and the ability to control which ones you let through. You can argue that this should have been opt-in but it’s absurd to say that anyone cannot trivially opt-out. I don’t understand the point of speculating that they are going to break iptables to get crash reporting, other than spreading FUD.
    - mtgx 7y ago
      Microsoft broke local search completely on latest Windows 10 updates if you've ever tried to block Cortana. They count this as a non-issue because from their point of view you're not supposed to block Cortana/web search. I've hated this "just block it" mentality around Windows 10 from day one because it was obvious to me it would be a losing game for the user in the long term. You can't fight the software developer forever on this and with each update they send. Eventually if they really want that tracking feature they're going to integrate it into some other core feature that will stop working if you try to disable the tracking.
- tomasato 7y ago
  If you block it, it leaks memory until it crashes the device
  - unwind 7y ago
    No, the reply from the Ui employee specifically mentions in which fw release that bug was fixed.

wtallis 7y ago

> I was tired of playing the OpenWRT/DDWRT flavor of the week (korg) on hardware that wasn't really well supported (netgear R7000). I should think so. Broadcom doesn't want their hardware to be properly supported by open-source software, so you were never going to be entirely successful in your quest to find good third-party firmware for that particular router. In the long run, it's always worth returning any such hardware and spending a bit more time shopping around for a router or AP that uses Qualcomm, Mediatek or Marvell chipsets (Ubiquiti APs use Qualcomm). And if you don't like the flavor of the week mess for firmware distributions, stay away from DD-WRT and prefer OpenWRT, which actually does clearly-identified stable releases.