5 ms·

I used to work on a product for secure small-biz Wifi, and so dogfooded my own product in my house. When that was over and I took that out of my house, I had m

I used to work on a product for secure small-biz Wifi, and so dogfooded my own product in my house. When that was over and I took that out of my house, I had my eyes on Ubiquiti, and it is an impressive ecosystem. But as others have said, it's out of stock all the time, and Ubiqiti are teasing people right now with their next-gen product which is available but also unobtainable. Eventually I picked the Asus ZenWifi system, and honestly it works great (I have no affiliation with Asus). There's no cloud account to create when you install it. The app is acceptable. There are various security things you can turn on which seem to require cloud assistance, but the core product seems to work very nicely. Any time you try to turn on something which might cause the system to share extra data, a popup appears to explain that to you. It's so powerful, Wifi-wise, that I bought three nodes and only deployed two. I use it with Ethernet backhaul but it has a dedicated radio for wireless backhaul. It has ethernet LAN ports on each node, and each node is identical to every other node (i.e. there is no "base" and "satellite"). I went from spotty Wifi throughout my 2,000 sq ft house to very strong Wifi throughout. I wrung my hands for a long time because I gave up VLANs and some other things I wanted, and then said the heck with it.

formerly_proven 5y ago
Ubiquiti seems to have turned into a complete shit-show in the last five years.
- nullwarp 5y ago
  Yeah easily the most annoying hardware we have to manage to the point where we will no longer use it.
  - InTheArena 5y ago
    Its gotten much much better over the last six months or so. The transition to generic linux for their router line was rough, but the worst seems to be over.
- donmcronald 5y ago
  Subscriptions are coming I bet. The whole ui.com account thing where they force you to create an account and link new devices like the UDM Pro are the writing on the wall IMO. They back-peddled on adding it to the v2 firmware of Cloud Key's IIRC, but the end game is likely to get everyone paying per device per month. The last time they had a pay per device per month service it started at $1/device/month and then they bumped it to $10/device/month. Somehow they thought the one time cost of a device should become an annual cost and that people would adopt it. Obviously that flopped. Now think of the same scenario, but everyone's gotten complacent and are getting dependent on their devices that are linked back to ui.com. They might not blatantly flip the switch, but now that they have a hook for licensing checks they can start shifting development so new features are licensed for a monthly fee rather than getting them free forever when you buy a device. IMO as soon as the all-in-one devices that perform management (ex: UDM Pro) while being linked to a ui.com account get enough adoption they'll shift to some kind of feature licensing or simply release new devices / revisions that require "cloud licensing" or something similar. They're also very flippant when it comes to breaking devices in a way that prevents a connection to the controller. They think SSHing into broken devices to fix them is reasonable and it's not if you have to deal with many sites / devices.
dhess 5y ago
I've heard good things about TP-Link's Omada EAP series. Did you happen to look into that platform?
- InTheArena 5y ago
  I tried it when Unifi was in bad straits last year. It's a poor copy of the Ubiquti interface. They copied the worst aspects of that UX.
  - discardedrefuse 5y ago
    One of the nice things about the Omada AP's is that it can run (and be configured) in standalone mode without the need of a controller. I bought one to replace the single Ubiquiti I had and its been solid; better even!
ok_dad 5y ago
This sounds like a good plan for me, thanks for the information, I will put this on my list of things to research more.
dont__panic 5y ago
I'm not sure I would call Ubiquiti "impressive" after their recent bout of security breaches: https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b... Not exactly what I want to see in the device that can literally compromise all of my other devices. Am I missing something -- did this turn out to be nothing, or did folks decide that Ubiquiti has bounced back? This seemed really really serious at the time and turned me completely off from ever purchasing one of their products.
- ksec 5y ago
  And that breach was from an insider? https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/ https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
- dangoor 5y ago
  As noted in the update to the article, Ubiquiti was a victim of an extortion attempt from an employee. This is a pretty difficult attack to prevent.
  - dont__panic 5y ago
    Ah, that's a fair point. I guess at some level a sufficiently privileged employee can manage this in almost any system. But there's also some discussion of backdoors and inadequate access control in Ubiquiti's backend here that could concern privacy-minded folk.
  - raesene9 5y ago
    this is true but if the details in this post https://news.ycombinator.com/item?id=29456593 https://news.ycombinator.com/item?id=29456593 and others in that thread are to be believed, they have some serious security problems.
- InTheArena 5y ago
  Turns out this story was planted by the perp to tank the stock after Unifi refused to give in to his "anonymous" ransom demand. Not great - but more classic insider attack, then security breach.
ksec 5y ago
>and Ubiqiti are teasing people right now with their next-gen product which is available but also unobtainable. Any links or reference. Cant find anything with a quick Google Search.
- InTheArena 5y ago
  Unifi Dream Router. You must create a account on store.ui.com, then enable pre-release hardware in the menu options.
  - ksec 5y ago
    Thx, it is the same UDR with Wifi 6.
- InTheArena 5y ago
  There is also the classic UDM. Also purchaseable on store.ui.com. For people who want a prosumer alternative to the crappy routers that telcos/cables give, this is a great option. Highly recommend, but it also a gateway drug.
  - gorkish 5y ago
    Unfortunately the UDR which replaces the UDM costs a mere $79 and delivers more functionality including Wifi 6. UDM is kind of a poison pill at the moment.
duffyjp 5y ago
I went from AirPort Extreme -> Google Wifi -> Asus RT-AX86U. They all have their pros and cons but the Asus is immensely more powerful. I love that it can mount a large USB drive as Time Machine, and the wireless is so fast it's actually usable. When there's a 2.5G WAN port you know they mean business.

formerly_proven 5y ago

Ubiquiti seems to have turned into a complete shit-show in the last five years.

nullwarp 5y ago
Yeah easily the most annoying hardware we have to manage to the point where we will no longer use it.
- InTheArena 5y ago
  Its gotten much much better over the last six months or so. The transition to generic linux for their router line was rough, but the worst seems to be over.
donmcronald 5y ago
Subscriptions are coming I bet. The whole ui.com account thing where they force you to create an account and link new devices like the UDM Pro are the writing on the wall IMO. They back-peddled on adding it to the v2 firmware of Cloud Key's IIRC, but the end game is likely to get everyone paying per device per month. The last time they had a pay per device per month service it started at $1/device/month and then they bumped it to $10/device/month. Somehow they thought the one time cost of a device should become an annual cost and that people would adopt it. Obviously that flopped. Now think of the same scenario, but everyone's gotten complacent and are getting dependent on their devices that are linked back to ui.com. They might not blatantly flip the switch, but now that they have a hook for licensing checks they can start shifting development so new features are licensed for a monthly fee rather than getting them free forever when you buy a device. IMO as soon as the all-in-one devices that perform management (ex: UDM Pro) while being linked to a ui.com account get enough adoption they'll shift to some kind of feature licensing or simply release new devices / revisions that require "cloud licensing" or something similar. They're also very flippant when it comes to breaking devices in a way that prevents a connection to the controller. They think SSHing into broken devices to fix them is reasonable and it's not if you have to deal with many sites / devices.

dhess 5y ago

I've heard good things about TP-Link's Omada EAP series. Did you happen to look into that platform?

InTheArena 5y ago
I tried it when Unifi was in bad straits last year. It's a poor copy of the Ubiquti interface. They copied the worst aspects of that UX.
- discardedrefuse 5y ago
  One of the nice things about the Omada AP's is that it can run (and be configured) in standalone mode without the need of a controller. I bought one to replace the single Ubiquiti I had and its been solid; better even!

ok_dad 5y ago

This sounds like a good plan for me, thanks for the information, I will put this on my list of things to research more.

dont__panic 5y ago

I'm not sure I would call Ubiquiti "impressive" after their recent bout of security breaches: https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b... Not exactly what I want to see in the device that can literally compromise all of my other devices. Am I missing something -- did this turn out to be nothing, or did folks decide that Ubiquiti has bounced back? This seemed really really serious at the time and turned me completely off from ever purchasing one of their products.

ksec 5y ago
And that breach was from an insider? https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/ https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
dangoor 5y ago
As noted in the update to the article, Ubiquiti was a victim of an extortion attempt from an employee. This is a pretty difficult attack to prevent.
- dont__panic 5y ago
  Ah, that's a fair point. I guess at some level a sufficiently privileged employee can manage this in almost any system. But there's also some discussion of backdoors and inadequate access control in Ubiquiti's backend here that could concern privacy-minded folk.
- raesene9 5y ago
  this is true but if the details in this post https://news.ycombinator.com/item?id=29456593 https://news.ycombinator.com/item?id=29456593 and others in that thread are to be believed, they have some serious security problems.
InTheArena 5y ago
Turns out this story was planted by the perp to tank the stock after Unifi refused to give in to his "anonymous" ransom demand. Not great - but more classic insider attack, then security breach.

ksec 5y ago

>and Ubiqiti are teasing people right now with their next-gen product which is available but also unobtainable. Any links or reference. Cant find anything with a quick Google Search.

InTheArena 5y ago
Unifi Dream Router. You must create a account on store.ui.com, then enable pre-release hardware in the menu options.
- ksec 5y ago
  Thx, it is the same UDR with Wifi 6.
InTheArena 5y ago
There is also the classic UDM. Also purchaseable on store.ui.com. For people who want a prosumer alternative to the crappy routers that telcos/cables give, this is a great option. Highly recommend, but it also a gateway drug.
- gorkish 5y ago
  Unfortunately the UDR which replaces the UDM costs a mere $79 and delivers more functionality including Wifi 6. UDM is kind of a poison pill at the moment.

duffyjp 5y ago

I went from AirPort Extreme -> Google Wifi -> Asus RT-AX86U. They all have their pros and cons but the Asus is immensely more powerful. I love that it can mount a large USB drive as Time Machine, and the wireless is so fast it's actually usable. When there's a 2.5G WAN port you know they mean business.