6 ms·

This change is a firmware update that was likely automatically installed on unaware customers equipment. Very shady. They claim this is to "gather crashes and

This change is a firmware update that was likely automatically installed on unaware customers equipment. Very shady. They claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers? They are very barebone anyway, and were there to be any issues, they would be notified by the customer. Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set.

wil421 7y ago
They have a workaround until the firmware updated. You just need to put a firewall rule to block the url they are sending crash data to. I have so many other devices that are snooping and constantly sending data (phones) that I don’t really care about my USG sending crash data.
- prepend 7y ago
  I think commercial routers have a different standard to be held up to than consumer phones and iot devices. The workaround is really lame and and blocks all traffic to the data leak domains. I don’t want to send crash data. I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. They claim it’s only crash data, but I don’t know. They can also change it at any time as they’ve lost my trust by adding data leaks to a firmware update I accepted without knowing it.
  - delfinom 7y ago
    >I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. Do you compile the source and replace any preshipped binaries with your own? Do you audit said source yourself instead of assuming some mystery person in the open does?
- tinus_hn 7y ago
  You can just block any connection from the access points to the internet. They can connect to the controller and that's all the access they get. Access points have no need to connect to or be accessible from the outside world.
  - spockz 7y ago
    Ok. I get that it is best practice to give devices the least amount of access they need. But why does being able to block traffic make it okay that Ubiquity enables telemetry like this, without informed consent?
deleted 7y ago
[deleted]
jasongill 7y ago
The article doesn't list which product lines are impacted, but as far as my experience goes with UniFi stuff, it doesn't auto update by default. You can turn it on in the controller but even that is unreliable at best (and not recommended, as the updates can sometimes be touchy - not to mention that the gear is offline during the update)
basch 7y ago
Wireless modems and routers were one of the more problematic pieces of tech in peoples lives. You used to have to reboot that stuff constantly. If theres any device that I want sending crash logs back to make the firmware better, its a router. What piece of non mobile/pc tech do you run firmware upgrades on more often than a router?
- BubRoss 7y ago
  Once I flashed my router with tomato I never had any problems with it again. It just works and needs nothing. Now that I set up a pi-hole I have to worry a lot less about telemetry from TVs and rogue devices. Good technology doesn't need to be updated all the time.
  - 0b0001 7y ago
    Do you know if the ancient Linux kernel on your router has any security issues? Do you receive any notification if there's ever an issue found? Is there even a centralised tracker for security issues affecting the router software? Sometimes, things need to be updated. And consumers can't be bothered to flash a firmware image.
    - AnIdiotOnTheNet 7y ago
      It's a home router, who cares. Chances are any security issue it has can only be realistically exploited on the local network. Is it really worth the trouble of constant software updates to bother to prevent? I don't think it is.
      - chopin 7y ago
        It's not that easy: There could be a XSS vulnerability in the management interface. There could be a vulnerability in any component which is internet facing. The router is handling packets. There might be a vulnerability in that logic allowing for maliciously crafted packets (in the answer of a request).
vlan0 7y ago
Your post has made it quite apparent that you have no experience managing these devices in a real world scenario. >automatically installed on unaware customers equipment. No. >they claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers? Also apparent you have not used their IPv6 stack nor their fq_codel implementation. >Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set. This move certainly made me scratch my head a little. Especially when Ubiquiti should know their customer base would be less than thrilled.
robbyt 7y ago
Have you owned or managed any ubiquiti hardware? The firmware is updated monthly, and there's always a detailed changlog.

wil421 7y ago

They have a workaround until the firmware updated. You just need to put a firewall rule to block the url they are sending crash data to. I have so many other devices that are snooping and constantly sending data (phones) that I don’t really care about my USG sending crash data.

prepend 7y ago
I think commercial routers have a different standard to be held up to than consumer phones and iot devices. The workaround is really lame and and blocks all traffic to the data leak domains. I don’t want to send crash data. I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. They claim it’s only crash data, but I don’t know. They can also change it at any time as they’ve lost my trust by adding data leaks to a firmware update I accepted without knowing it.
- delfinom 7y ago
  >I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. Do you compile the source and replace any preshipped binaries with your own? Do you audit said source yourself instead of assuming some mystery person in the open does?
tinus_hn 7y ago
You can just block any connection from the access points to the internet. They can connect to the controller and that's all the access they get. Access points have no need to connect to or be accessible from the outside world.
- spockz 7y ago
  Ok. I get that it is best practice to give devices the least amount of access they need. But why does being able to block traffic make it okay that Ubiquity enables telemetry like this, without informed consent?

deleted 7y ago

[deleted]

jasongill 7y ago

The article doesn't list which product lines are impacted, but as far as my experience goes with UniFi stuff, it doesn't auto update by default. You can turn it on in the controller but even that is unreliable at best (and not recommended, as the updates can sometimes be touchy - not to mention that the gear is offline during the update)

basch 7y ago

Wireless modems and routers were one of the more problematic pieces of tech in peoples lives. You used to have to reboot that stuff constantly. If theres any device that I want sending crash logs back to make the firmware better, its a router. What piece of non mobile/pc tech do you run firmware upgrades on more often than a router?

BubRoss 7y ago
Once I flashed my router with tomato I never had any problems with it again. It just works and needs nothing. Now that I set up a pi-hole I have to worry a lot less about telemetry from TVs and rogue devices. Good technology doesn't need to be updated all the time.
- 0b0001 7y ago
  Do you know if the ancient Linux kernel on your router has any security issues? Do you receive any notification if there's ever an issue found? Is there even a centralised tracker for security issues affecting the router software? Sometimes, things need to be updated. And consumers can't be bothered to flash a firmware image.
  - AnIdiotOnTheNet 7y ago
    It's a home router, who cares. Chances are any security issue it has can only be realistically exploited on the local network. Is it really worth the trouble of constant software updates to bother to prevent? I don't think it is.
    - chopin 7y ago
      It's not that easy: There could be a XSS vulnerability in the management interface. There could be a vulnerability in any component which is internet facing. The router is handling packets. There might be a vulnerability in that logic allowing for maliciously crafted packets (in the answer of a request).

vlan0 7y ago

Your post has made it quite apparent that you have no experience managing these devices in a real world scenario. >automatically installed on unaware customers equipment. No. >they claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers? Also apparent you have not used their IPv6 stack nor their fq_codel implementation. >Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set. This move certainly made me scratch my head a little. Especially when Ubiquiti should know their customer base would be less than thrilled.

robbyt 7y ago

Have you owned or managed any ubiquiti hardware? The firmware is updated monthly, and there's always a detailed changlog.