7 ms·

This is the same Ubiquiti that's does not abide by the GPL for the modified linux kernel they use[1][2][3]. Which is really too bad as I had been ready to recom

This is the same Ubiquiti that's does not abide by the GPL for the modified linux kernel they use[1][2][3]. Which is really too bad as I had been ready to recommend their gear to a couple of businesses. [1] https://sfconservancy.org/blog/2019/oct/02/cambium-ubiquiti-gpl-violations/ https://sfconservancy.org/blog/2019/oct/02/cambium-ubiquiti-... [2] https://news.ycombinator.com/item?id=9331512 https://news.ycombinator.com/item?id=9331512 [3] http://web.archive.org/web/20170317174847/http://libertybsd.net/ubiquiti/ http://web.archive.org/web/20170317174847/http://libertybsd....

dleslie 7y ago
Damn, I like their gear; who's the next best?
- steve19 7y ago
  Mikrotik is pretty nice although the gui is not user friendly as ubiquiti.
  - disiplus 7y ago
    not even close that user friendly, and they had pretty serious security problems, i also use them, because they are powerful and cheap. https://nvd.nist.gov/vuln/detail/CVE-2018-14847 https://nvd.nist.gov/vuln/detail/CVE-2018-14847
    - funnybeam 7y ago
      Just want to point out that the fact that there are CVEs does not mean they are insecure. All kit has security issues but the important thing is how open the manufacturer is about the issues and how quickly they fix them, and Mikrotik have always been very good in this area, regularly releasing updates Also, as all their devices run the same software, even devices that are years old will still be updated I often see people saying “Mikrotik is insecure” but this seems to be based solely on the fact that there are published security issues which they have patched. In my opinion that is the opposite of insecure Agree on the user friendliness though - I use them at home for personal stuff, but for work it is Unifi
      - disiplus 7y ago
        the one linked is especially bad, i allows anybody to read the admin password. the problem is also that a lot of them are running old versions because the update process is not as straightforward as ubiquitu for example. i also run mikrotik at home and have deployed mikrotik and ubiquiti at out different offices. for the price you can hardly beat mikrotik and once you "get into it" it's fairly simple.
        funnybeam 7y ago
        Yes, that’s bad but note that even unpatched it is only an issue if the GUI management port has been left open - which seems to be the case with all the security issues people highlight with Mikrotik I wouldn’t disagree that management ports should probably be locked down out of the box but I would expect anyone reading this to apply some basic lockdown when setting up any device I just want to offer a counterpoint to an assertion that I often see here claiming they are insecure which I don’t think is justified Certainly if you are not into networking and want something that just works then Unifi is great, but if you want something with bucketloads more functionality and don’t mind getting your hands dirty then don’t be put off Mikrotik due to security concerns
        hackmiester 7y ago
        You just upload a file and reboot... that seems like a pretty simple procedure to me...?
        xeeeeeeeeeeenu 7y ago
        There's also the automatic upgrade option, so you don't have to upload anything manually: https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Automatic_upgrade https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Aut...
        milankragujevic 7y ago
        Yes, and IMO its less likely to "ruin" the device (i.e. reset all settings on a roof-mounted CPE that you are upgrading remotely) than Unifi updates for LiteBeam... Though I have only used MikroTik SXT and SXTsq and Ubiquiti LiteBeam M5 so I am not the best to judge.
    - stiray 7y ago
      This one was for management port and was fixed before the CVE came out. There are two points: opening management interface to the internet is... Lets say... Weird. The second one, they are extremely responsive to security issues.
    - tgsovlerkhgsel 7y ago
      Disabling (access to) WinBox should be the first thing to do on a Mikrotik. Most of their serious security issues are in WinBox. The Web UI seems to be a perfect equivalent if you want a GUI to manage your one box at home, and SSH should do the trick for automation. Is there any reason to use their proprietary (Windows-only) software to configure the router?
      - garaetjjte 7y ago
        WebFig is just clunky and slow. Winbox is so much better, faster, with MDI, and works fine on Wine.
  - jimnotgym 7y ago
    I have used Mikrotik at work and have been alarmed at how often professional network engineers make mistakes with them. I found some serious errors through testing (and some exploitation), and when putting them right I could see why the engineers had made that mistake. I caution against them. They don't just have a clunky gui they have a model of the network that people seem to find hard to understand. Shame on Unifi over GPL, but their kit is very good
  - izacus 7y ago
    I'm sorry, but asking someone to switch from Ubiquiti to a Mikrotik is like asking someone to go from macOS to 1990's Linux. The user interface is beyond atrocious and even basic features you'd need in smaller/home setup need digging through Wikis to get the arcane settings you need to click. Basic things like NAT loopback or basic VPN setup. OpenVPN is still neutered and broken. What's even worse - the defaults are all wrong. There's no simple "enable firewall" switch for basic use-cases like other equipment has. Instead you need to manually configure firewall rules in chains like working with raw IP tables and if you do a small misstep, you'll drill a hole in your network easily. Or make your internet horribly slow because you need to be careful about fasstrack rules and lack of NAT acceleration. It's really about the most disappointing piece of hardware I bought in last few years and doesn't come close to niceness of Ubiquitis management. Sadly it's also the only company that makes a compact router with SFP and PoE+ to power Ubiquities.
    - hackmiester 7y ago
      RouterOS is basically designed for network engineers. From our perspective, NAT loopback is extremely complex and has many implications, which RouterOS doesn't hide from you. And we typically don't run a VPN concentrator on the same device as a router. I think it's just a matter of different practices in different industries. ETA: > What's even worse - the defaults are all wrong. There is a new-ish thing in the web UI called "QuickSet" for these use cases.
      - izacus 7y ago
        Yes, I fully understand that it was built for company admins to have fun and cover their use-cases. But unfortunately I constantly see those admins recommend them for prosumer, unmanaged small business and home use-cases. In those cases they're horrible to manage and lack features users expect.
        stiray 7y ago
        What features? I have heard a lot of complaining over mikrotik, but lack of features was typically not one of them.
  - oliwarner 7y ago
    Their last source dump appears to be 4yo too.
  - chewyland 7y ago
    Dealing with this exactly at this moment. Using Winbox is like using Windows 3.0. No no... It's way worse than that.
- auslander 7y ago
  > Damn, I like their gear; who's the next best? Linux / OpenBSD with open source wifi drivers, if that is even a thing. Snatch some Atheros or Realtek chips before they disappear. https://en.wikipedia.org/wiki/Comparison_of_open-source_wireless_drivers https://en.wikipedia.org/wiki/Comparison_of_open-source_wire...
  - zamadatix 7y ago
    If all you're looking to do is avoid Ubiquiti breaking GPL not necessarily binary blobs/100% open I'd recommend just using the Intel AX200. It's 20 bucks, will have longer support, supports AX, and supports more features/extensions on older versions of Wi-Fi than e.g. their AC chip does to boot.
- pqb 7y ago
  Maybe pfSense/openwrt based on APU2[0] platform? I don't personally anybody who has used it. If on HN there is someone who would like to share his opinion about it, I'd be grateful. Edit: Also, Turris MOX or Turris Omnia [1] might be an alternative. [0]: https://pcengines.ch/apu2.htm https://pcengines.ch/apu2.htm [1]: https://www.turris.cz/en/ https://www.turris.cz/en/
  - bronco21016 7y ago
    I’m running an APU2C4 for my router, no wireless. It has pfSense running with OpenVPN and a DNS sinkhole for ads. My wireless is through an UAP AC Pro. The APU works fine but after upgrading to a gigabit connection I’m a bit disappointed. It won’t saturate the connection on a single thread. (Yes over Ethernet) Maybe 400 Mbps max. Apparently it has something to do with pfSense not multithreading connections and the single cores of the CPU not being fast enough on their own. I can run 1 Gbps over multiple connections though so I suppose it mostly fulfills it’s purpose. I also want a WireGuard server but I might end up just deploying that in a VM. pfSense doesn’t currently have that option. When I learned of these limitations I gave some consideration to the the Ubiquiti USG but found it isn’t exactly super beefy either and requires turning features off to get 1 Gbps. I’m debating building something similar to the ArsTechnica guide [0]. Overall, I’ve been satisfied with my setup and in particular the UAPs. I’ve deployed multiple UAPs and Edgerouter X’s at friends and family’s houses and have had essentially 0 support requests. The stuff just works and performs. I just had a party last night and even with 20+ clients, streaming music and YouTube TV for football, I had zero complaints or hiccups. All on a single UAP. I haven’t used any recent consumer gear but I know e consumer gear I used to buy would have definitely been choking on that kind of load. I’m pretty disappointed to see this turn in events with UBNT. I’ve kinda seen it coming for awhile now since they’ve been moving towards these cloud services but I was really hoping they would resist the lures of Surveillance Capitalism. [0] https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/ https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...
    - oil25 7y ago
      I also experienced the gigabit performance issue (Debian 9 and 10, APU4C4); estimate a bandwidth cap of about 400 Mbps, too. I don't actually have a need to exceed that speed on my home network, so I'm still happy. But also curious if anyone has built a beefier, more capable open source hardware router that also isn't a power hog.
- amq 7y ago
  The next beast is OpenWRT + any modern hardware supported by it.
fiter 7y ago
Not only are they violating the GPL, but they've been doing it for over 4 years? Thanks for the links, this resets my opinion on Ubiquity.
Jonnax 7y ago
Can't the FSF do something? They're quite big.
- gonzo 7y ago
  Only if they hold copyright.
  - Wowfunhappy 7y ago
    Isn't the copyright holder in this case "anyone who has contributed to the Linux kernel"? I have to imagine that includes the FSF. Anyway, one of the GGP's (great grandparent's) links indicate the software freedom conservatory did open a lawsuit just last month. https://sfconservancy.org/blog/2019/oct/02/cambium-ubiquiti-gpl-violations/ https://sfconservancy.org/blog/2019/oct/02/cambium-ubiquiti-...
    - gonzo 7y ago
      Link actually says, "As such, we have today opened (at this point, non-litigation) GPL enforcement actions against both companies." that's a letter, not a lawsuit. not yet, anyway.
      - Wowfunhappy 7y ago
        Oops, apparently I wasn't reading carefully enough! Thank you!
tgsovlerkhgsel 7y ago
Doesn't violating the GPL (for v2) or ignoring a notice that they violate the GPL for 30 days (for v3) result in permanent loss of the rights to use the software? Wouldn't at this point a copyright holder (e.g. anyone who contributed to the kernel) + a donation campaign for legal costs be able to force them to either fix it within 30 days, or (once the legal process is over) to indefinitely maintain a patched version of the kernel removing that copyright holder's code?
AnIdiotOnTheNet 7y ago
One can draw from this that the GPL is quite toothless. If even the biggest most important GPL'd software in history can't or won't defend itself, then why should anyone care about the GPL?
- zamadatix 7y ago
  Or one can draw that looking at a single violation on a single piece of software is a poor way to come to a conclusion for every violation on every piece of software. D-Link comes to mind as a similar situation where GPL prevailed. Perhaps in this case nobody cares enough, either way doesn't mean GPL is useless and nobody should care about it.
- syshum 7y ago
  As with all licenses if the people that hold them do not enforce them than all licenses are Toothless the Linux Foundation has been notoriously anti-litigation, their corporate masters do not want any litigation at all, and more or less treat Linux as if it was BSD licensed instead of GPL
DanAtC 7y ago
They also sue their own customers for using custom firmware https://www.mtin.net/blog/ubnt-vs-cambium/ https://www.mtin.net/blog/ubnt-vs-cambium/ https://www.courtlistener.com/docket/7616021/ubiquiti-networks-inc-v-cambium-networks-inc/ https://www.courtlistener.com/docket/7616021/ubiquiti-networ...
- heavyset_go 7y ago
  I was considering going all in on Ubiquiti gear for my next move, but this along with their GPL violations changed my mind. Thanks for pointing this out.
nominated1 7y ago
I was aware of Ubiquity’s past GPL violations and it was the only reason I avoided them. According to Wikipedia they settled a GPL violation in 2017 but I wasn’t aware of the recent issue. Looks like their Wikipedia page could use an update. https://en.wikipedia.org/wiki/Ubiquiti_Networks https://en.wikipedia.org/wiki/Ubiquiti_Networks

dleslie 7y ago

Damn, I like their gear; who's the next best?

steve19 7y ago
Mikrotik is pretty nice although the gui is not user friendly as ubiquiti.
- disiplus 7y ago
  not even close that user friendly, and they had pretty serious security problems, i also use them, because they are powerful and cheap. https://nvd.nist.gov/vuln/detail/CVE-2018-14847 https://nvd.nist.gov/vuln/detail/CVE-2018-14847
  - funnybeam 7y ago
    Just want to point out that the fact that there are CVEs does not mean they are insecure. All kit has security issues but the important thing is how open the manufacturer is about the issues and how quickly they fix them, and Mikrotik have always been very good in this area, regularly releasing updates Also, as all their devices run the same software, even devices that are years old will still be updated I often see people saying “Mikrotik is insecure” but this seems to be based solely on the fact that there are published security issues which they have patched. In my opinion that is the opposite of insecure Agree on the user friendliness though - I use them at home for personal stuff, but for work it is Unifi
    - disiplus 7y ago
      the one linked is especially bad, i allows anybody to read the admin password. the problem is also that a lot of them are running old versions because the update process is not as straightforward as ubiquitu for example. i also run mikrotik at home and have deployed mikrotik and ubiquiti at out different offices. for the price you can hardly beat mikrotik and once you "get into it" it's fairly simple.
      - funnybeam 7y ago
        Yes, that’s bad but note that even unpatched it is only an issue if the GUI management port has been left open - which seems to be the case with all the security issues people highlight with Mikrotik I wouldn’t disagree that management ports should probably be locked down out of the box but I would expect anyone reading this to apply some basic lockdown when setting up any device I just want to offer a counterpoint to an assertion that I often see here claiming they are insecure which I don’t think is justified Certainly if you are not into networking and want something that just works then Unifi is great, but if you want something with bucketloads more functionality and don’t mind getting your hands dirty then don’t be put off Mikrotik due to security concerns
      - hackmiester 7y ago
        You just upload a file and reboot... that seems like a pretty simple procedure to me...?
        xeeeeeeeeeeenu 7y ago
        There's also the automatic upgrade option, so you don't have to upload anything manually: https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Automatic_upgrade https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS#Aut...
        milankragujevic 7y ago
        Yes, and IMO its less likely to "ruin" the device (i.e. reset all settings on a roof-mounted CPE that you are upgrading remotely) than Unifi updates for LiteBeam... Though I have only used MikroTik SXT and SXTsq and Ubiquiti LiteBeam M5 so I am not the best to judge.
  - stiray 7y ago
    This one was for management port and was fixed before the CVE came out. There are two points: opening management interface to the internet is... Lets say... Weird. The second one, they are extremely responsive to security issues.
  - tgsovlerkhgsel 7y ago
    Disabling (access to) WinBox should be the first thing to do on a Mikrotik. Most of their serious security issues are in WinBox. The Web UI seems to be a perfect equivalent if you want a GUI to manage your one box at home, and SSH should do the trick for automation. Is there any reason to use their proprietary (Windows-only) software to configure the router?
    - garaetjjte 7y ago
      WebFig is just clunky and slow. Winbox is so much better, faster, with MDI, and works fine on Wine.
- jimnotgym 7y ago
  I have used Mikrotik at work and have been alarmed at how often professional network engineers make mistakes with them. I found some serious errors through testing (and some exploitation), and when putting them right I could see why the engineers had made that mistake. I caution against them. They don't just have a clunky gui they have a model of the network that people seem to find hard to understand. Shame on Unifi over GPL, but their kit is very good
- izacus 7y ago
  I'm sorry, but asking someone to switch from Ubiquiti to a Mikrotik is like asking someone to go from macOS to 1990's Linux. The user interface is beyond atrocious and even basic features you'd need in smaller/home setup need digging through Wikis to get the arcane settings you need to click. Basic things like NAT loopback or basic VPN setup. OpenVPN is still neutered and broken. What's even worse - the defaults are all wrong. There's no simple "enable firewall" switch for basic use-cases like other equipment has. Instead you need to manually configure firewall rules in chains like working with raw IP tables and if you do a small misstep, you'll drill a hole in your network easily. Or make your internet horribly slow because you need to be careful about fasstrack rules and lack of NAT acceleration. It's really about the most disappointing piece of hardware I bought in last few years and doesn't come close to niceness of Ubiquitis management. Sadly it's also the only company that makes a compact router with SFP and PoE+ to power Ubiquities.
  - hackmiester 7y ago
    RouterOS is basically designed for network engineers. From our perspective, NAT loopback is extremely complex and has many implications, which RouterOS doesn't hide from you. And we typically don't run a VPN concentrator on the same device as a router. I think it's just a matter of different practices in different industries. ETA: > What's even worse - the defaults are all wrong. There is a new-ish thing in the web UI called "QuickSet" for these use cases.
    - izacus 7y ago
      Yes, I fully understand that it was built for company admins to have fun and cover their use-cases. But unfortunately I constantly see those admins recommend them for prosumer, unmanaged small business and home use-cases. In those cases they're horrible to manage and lack features users expect.
      - stiray 7y ago
        What features? I have heard a lot of complaining over mikrotik, but lack of features was typically not one of them.
- oliwarner 7y ago
  Their last source dump appears to be 4yo too.
- chewyland 7y ago
  Dealing with this exactly at this moment. Using Winbox is like using Windows 3.0. No no... It's way worse than that.
auslander 7y ago
> Damn, I like their gear; who's the next best? Linux / OpenBSD with open source wifi drivers, if that is even a thing. Snatch some Atheros or Realtek chips before they disappear. https://en.wikipedia.org/wiki/Comparison_of_open-source_wireless_drivers https://en.wikipedia.org/wiki/Comparison_of_open-source_wire...
- zamadatix 7y ago
  If all you're looking to do is avoid Ubiquiti breaking GPL not necessarily binary blobs/100% open I'd recommend just using the Intel AX200. It's 20 bucks, will have longer support, supports AX, and supports more features/extensions on older versions of Wi-Fi than e.g. their AC chip does to boot.
pqb 7y ago
Maybe pfSense/openwrt based on APU2[0] platform? I don't personally anybody who has used it. If on HN there is someone who would like to share his opinion about it, I'd be grateful. Edit: Also, Turris MOX or Turris Omnia [1] might be an alternative. [0]: https://pcengines.ch/apu2.htm https://pcengines.ch/apu2.htm [1]: https://www.turris.cz/en/ https://www.turris.cz/en/
- bronco21016 7y ago
  I’m running an APU2C4 for my router, no wireless. It has pfSense running with OpenVPN and a DNS sinkhole for ads. My wireless is through an UAP AC Pro. The APU works fine but after upgrading to a gigabit connection I’m a bit disappointed. It won’t saturate the connection on a single thread. (Yes over Ethernet) Maybe 400 Mbps max. Apparently it has something to do with pfSense not multithreading connections and the single cores of the CPU not being fast enough on their own. I can run 1 Gbps over multiple connections though so I suppose it mostly fulfills it’s purpose. I also want a WireGuard server but I might end up just deploying that in a VM. pfSense doesn’t currently have that option. When I learned of these limitations I gave some consideration to the the Ubiquiti USG but found it isn’t exactly super beefy either and requires turning features off to get 1 Gbps. I’m debating building something similar to the ArsTechnica guide [0]. Overall, I’ve been satisfied with my setup and in particular the UAPs. I’ve deployed multiple UAPs and Edgerouter X’s at friends and family’s houses and have had essentially 0 support requests. The stuff just works and performs. I just had a party last night and even with 20+ clients, streaming music and YouTube TV for football, I had zero complaints or hiccups. All on a single UAP. I haven’t used any recent consumer gear but I know e consumer gear I used to buy would have definitely been choking on that kind of load. I’m pretty disappointed to see this turn in events with UBNT. I’ve kinda seen it coming for awhile now since they’ve been moving towards these cloud services but I was really hoping they would resist the lures of Surveillance Capitalism. [0] https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/ https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...
  - oil25 7y ago
    I also experienced the gigabit performance issue (Debian 9 and 10, APU4C4); estimate a bandwidth cap of about 400 Mbps, too. I don't actually have a need to exceed that speed on my home network, so I'm still happy. But also curious if anyone has built a beefier, more capable open source hardware router that also isn't a power hog.
amq 7y ago
The next beast is OpenWRT + any modern hardware supported by it.

fiter 7y ago

Not only are they violating the GPL, but they've been doing it for over 4 years? Thanks for the links, this resets my opinion on Ubiquity.

Jonnax 7y ago

Can't the FSF do something? They're quite big.

gonzo 7y ago
Only if they hold copyright.
- Wowfunhappy 7y ago
  Isn't the copyright holder in this case "anyone who has contributed to the Linux kernel"? I have to imagine that includes the FSF. Anyway, one of the GGP's (great grandparent's) links indicate the software freedom conservatory did open a lawsuit just last month. https://sfconservancy.org/blog/2019/oct/02/cambium-ubiquiti-gpl-violations/ https://sfconservancy.org/blog/2019/oct/02/cambium-ubiquiti-...
  - gonzo 7y ago
    Link actually says, "As such, we have today opened (at this point, non-litigation) GPL enforcement actions against both companies." that's a letter, not a lawsuit. not yet, anyway.
    - Wowfunhappy 7y ago
      Oops, apparently I wasn't reading carefully enough! Thank you!

tgsovlerkhgsel 7y ago

Doesn't violating the GPL (for v2) or ignoring a notice that they violate the GPL for 30 days (for v3) result in permanent loss of the rights to use the software? Wouldn't at this point a copyright holder (e.g. anyone who contributed to the kernel) + a donation campaign for legal costs be able to force them to either fix it within 30 days, or (once the legal process is over) to indefinitely maintain a patched version of the kernel removing that copyright holder's code?

AnIdiotOnTheNet 7y ago

One can draw from this that the GPL is quite toothless. If even the biggest most important GPL'd software in history can't or won't defend itself, then why should anyone care about the GPL?

zamadatix 7y ago
Or one can draw that looking at a single violation on a single piece of software is a poor way to come to a conclusion for every violation on every piece of software. D-Link comes to mind as a similar situation where GPL prevailed. Perhaps in this case nobody cares enough, either way doesn't mean GPL is useless and nobody should care about it.
syshum 7y ago
As with all licenses if the people that hold them do not enforce them than all licenses are Toothless the Linux Foundation has been notoriously anti-litigation, their corporate masters do not want any litigation at all, and more or less treat Linux as if it was BSD licensed instead of GPL

DanAtC 7y ago

They also sue their own customers for using custom firmware https://www.mtin.net/blog/ubnt-vs-cambium/ https://www.mtin.net/blog/ubnt-vs-cambium/ https://www.courtlistener.com/docket/7616021/ubiquiti-networks-inc-v-cambium-networks-inc/ https://www.courtlistener.com/docket/7616021/ubiquiti-networ...

heavyset_go 7y ago
I was considering going all in on Ubiquiti gear for my next move, but this along with their GPL violations changed my mind. Thanks for pointing this out.

nominated1 7y ago

I was aware of Ubiquity’s past GPL violations and it was the only reason I avoided them. According to Wikipedia they settled a GPL violation in 2017 but I wasn’t aware of the recent issue. Looks like their Wikipedia page could use an update. https://en.wikipedia.org/wiki/Ubiquiti_Networks https://en.wikipedia.org/wiki/Ubiquiti_Networks