6 ms·

You have a loosely defined term: "bad." It suggests "inaccurate" but perhaps you mean "unkind." In either case, you assert "Krebs was wrong" a couple times but

by xbar 5y ago

You have a loosely defined term: "bad." It suggests "inaccurate" but perhaps you mean "unkind." In either case, you assert "Krebs was wrong" a couple times but you skirt the topic of the twitter thread, the comments, and the lawsuit: that Krebs intentionally misled readers in order to drive traffic for ad revenue. Do you think Krebs did this? Krebs got the big story exactly right: Ubiquiti had a bad security problem and flubbed the handling of it.

gonehome 5y ago
Krebs certainly did not get the story “exactly right” nor did he take responsibility for how wrong he was (and how he was used by the attacker).
- deleted 5y ago
  [deleted]
- harry8 5y ago
  Maybe? You aren't presenting any evidence for "how wrong he was" and "how he was used by the attacker." You're sure of it? Why? What other explanations are possible here? None?
  - gonehome 5y ago
    There was a lot of discussion at the time this stuff went down: https://www.theverge.com/2021/12/1/22812761/ubiquiti-data-breach-aws-doj-indictment-inside-job https://www.theverge.com/2021/12/1/22812761/ubiquiti-data-br... The HN comment majority also changed from when I made my first comment. At the time I was pushing back against the overwhelming sentiment here and on Twitter that Ubiquiti was going after a journalist just for reporting a breach. The story is way more mixed than that and from the stuff I remember reading at the time Brian wasn't in the right. I don't want to be overconfident (I don't really know the specifics), but I did want to push back against the overwhelming overconfidence I saw arguing the other direction.
    - harry8 5y ago
      Yeah that's fine but just stating things like that as incontrovertible fact with absolutely no supporting evidence, none, which is what you did, isn't useful. It made me pretty suspicious of an astroturf for example. 9 times in 10 it isn't that but it always looks really bad. It's also tantamount to saying "everyone here is either an idiot or acting in bad faith" and has no reason at all to believe a thing that you are now pointing is is wrong and so clearly wrong that it's the same as stating water is wet. I note now you're providing evidence you're walking it back a bit, which shows the worth of doing so. It's very common elsewhere. Just keep repeating a thing until it is accepted but it really isn't how things are supposed to be in sensible discussion.
      - gonehome 5y ago
        I think that's an unfair characterization. I was replying to someone who said Krebs was "exactly right" - that's what I was pushing back on. My first comment was also more nuanced. The evidence exists for those who care to look and I think what I wrote is inline with it.
        harry8 5y ago
        If you'd provided any support with that statement at all, or said /why/ you believe that, it's completely fine. Doesn't even have to be correct! We all get stuff wrong. If you believe you provided the support in a different comment, cite it. "I'm right, go find the evidence if you dare doubt me." Not so useful.
        gonehome 5y ago
        If that standard is applied equally that’s fine with me.
        harry8 5y ago
        Well we're trying, huh? You and me both and I appreciate it.
icelancer 5y ago
> Krebs got the big story exactly right: Ubiquiti had a bad security problem and flubbed the handling of it. This can be true while still being massively exposed to legal liability. The court of public opinion is one thing, the law is another.
- kilpatds 5y ago
  (Except in the US, the law is very biased toward allowing people to say stuff on matters of public interest, and the legal liability from the complaint appears to be limited to paying a lawyer to make it to, and file for summary judgement. https://anti-slapp.org/virginia https://anti-slapp.org/virginia)
sssilverman 5y ago
Regardless of his reporting at the time, Krebs has known since December when Sharp was arrested that: - the supposed hacker was the goddamn Unifi Head of Cloud, using the access keys needed to do their job - the initial internal investigation into the hack and ransom was being conducted by the attacker - that the whistleblower account is a complete fabrication by the internal attacker and his reporting on a coverup are false Ubiquiti aren't suing him for reporting on it, they're suing him for not retracting it properly once it was revealed how false it was. As per the filing: 70. Ubiquiti brings this litigation because of Krebs’s refusal to do the right thing and retract the March 30 article or the December 2, 2021 update, which continue to malign Ubiquiti’s reputation, damage its relationships with its stockholders, and disrupt its business operations. Krebs and Corey are _way_ wrong on this. There is plenty to be said and very valid criticisms about how Ubiquiti dropped the ball and handled the situation. The attack being an insider does not excuse them. But it invalidates much of the reporting. Krebs was specifically and personally targetted by the attacker as a method of spreading false statements to damage the company and, by keeping the articles up, remains complicit and liable.
- stormbrew 5y ago
  It might be more convincing if all the things you listed don't make ubiquiti look really bad for a company that needs you to trust them, given their gear is very cloud-y. From my perspective this lawsuit looks like they've Streisand Effected the fact that they let their internal security be even worse than the initial accusations. It's like finding out your financial advisor had all your money stolen, which is bad enough, and then it turns out it's because they gave their gardener the password to your bank account.
  - deleted 5y ago
    [deleted]
- james_in_the_uk 5y ago
  Where's the proof that Krebs knew that the whistleblower account was a fabrication? Genuine question. It seems to me that Krebs might be in a position to claim: 1. He honestly reported the facts as were made available to him. 2. Either: A. He didn't know his original source was Sharp (quite feasible that Sharp disguised this) Or B. He did know his original source was Sharp, but felt compelled to continue to protect his source despite charges having been brought (innocent until proven guilty). 3. He took the view was that nothing in the revelation of this hack as an inside job casts doubt on his initial reporting, which was about Ubiquity's response to the incident not the attacker's identity. We should at least wait to read the defence before drawing any conclusions.

by xbar 5y ago

gonehome 5y ago

Krebs certainly did not get the story “exactly right” nor did he take responsibility for how wrong he was (and how he was used by the attacker).

deleted 5y ago
[deleted]
harry8 5y ago
Maybe? You aren't presenting any evidence for "how wrong he was" and "how he was used by the attacker." You're sure of it? Why? What other explanations are possible here? None?
- gonehome 5y ago
  There was a lot of discussion at the time this stuff went down: https://www.theverge.com/2021/12/1/22812761/ubiquiti-data-breach-aws-doj-indictment-inside-job https://www.theverge.com/2021/12/1/22812761/ubiquiti-data-br... The HN comment majority also changed from when I made my first comment. At the time I was pushing back against the overwhelming sentiment here and on Twitter that Ubiquiti was going after a journalist just for reporting a breach. The story is way more mixed than that and from the stuff I remember reading at the time Brian wasn't in the right. I don't want to be overconfident (I don't really know the specifics), but I did want to push back against the overwhelming overconfidence I saw arguing the other direction.
  - harry8 5y ago
    Yeah that's fine but just stating things like that as incontrovertible fact with absolutely no supporting evidence, none, which is what you did, isn't useful. It made me pretty suspicious of an astroturf for example. 9 times in 10 it isn't that but it always looks really bad. It's also tantamount to saying "everyone here is either an idiot or acting in bad faith" and has no reason at all to believe a thing that you are now pointing is is wrong and so clearly wrong that it's the same as stating water is wet. I note now you're providing evidence you're walking it back a bit, which shows the worth of doing so. It's very common elsewhere. Just keep repeating a thing until it is accepted but it really isn't how things are supposed to be in sensible discussion.
    - gonehome 5y ago
      I think that's an unfair characterization. I was replying to someone who said Krebs was "exactly right" - that's what I was pushing back on. My first comment was also more nuanced. The evidence exists for those who care to look and I think what I wrote is inline with it.
      - harry8 5y ago
        If you'd provided any support with that statement at all, or said /why/ you believe that, it's completely fine. Doesn't even have to be correct! We all get stuff wrong. If you believe you provided the support in a different comment, cite it. "I'm right, go find the evidence if you dare doubt me." Not so useful.
        gonehome 5y ago
        If that standard is applied equally that’s fine with me.
        harry8 5y ago
        Well we're trying, huh? You and me both and I appreciate it.

icelancer 5y ago

> Krebs got the big story exactly right: Ubiquiti had a bad security problem and flubbed the handling of it. This can be true while still being massively exposed to legal liability. The court of public opinion is one thing, the law is another.

kilpatds 5y ago
(Except in the US, the law is very biased toward allowing people to say stuff on matters of public interest, and the legal liability from the complaint appears to be limited to paying a lawyer to make it to, and file for summary judgement. https://anti-slapp.org/virginia https://anti-slapp.org/virginia)

sssilverman 5y ago

Regardless of his reporting at the time, Krebs has known since December when Sharp was arrested that: - the supposed hacker was the goddamn Unifi Head of Cloud, using the access keys needed to do their job - the initial internal investigation into the hack and ransom was being conducted by the attacker - that the whistleblower account is a complete fabrication by the internal attacker and his reporting on a coverup are false Ubiquiti aren't suing him for reporting on it, they're suing him for not retracting it properly once it was revealed how false it was. As per the filing: 70. Ubiquiti brings this litigation because of Krebs’s refusal to do the right thing and retract the March 30 article or the December 2, 2021 update, which continue to malign Ubiquiti’s reputation, damage its relationships with its stockholders, and disrupt its business operations. Krebs and Corey are _way_ wrong on this. There is plenty to be said and very valid criticisms about how Ubiquiti dropped the ball and handled the situation. The attack being an insider does not excuse them. But it invalidates much of the reporting. Krebs was specifically and personally targetted by the attacker as a method of spreading false statements to damage the company and, by keeping the articles up, remains complicit and liable.

stormbrew 5y ago
It might be more convincing if all the things you listed don't make ubiquiti look really bad for a company that needs you to trust them, given their gear is very cloud-y. From my perspective this lawsuit looks like they've Streisand Effected the fact that they let their internal security be even worse than the initial accusations. It's like finding out your financial advisor had all your money stolen, which is bad enough, and then it turns out it's because they gave their gardener the password to your bank account.
- deleted 5y ago
  [deleted]
james_in_the_uk 5y ago
Where's the proof that Krebs knew that the whistleblower account was a fabrication? Genuine question. It seems to me that Krebs might be in a position to claim: 1. He honestly reported the facts as were made available to him. 2. Either: A. He didn't know his original source was Sharp (quite feasible that Sharp disguised this) Or B. He did know his original source was Sharp, but felt compelled to continue to protect his source despite charges having been brought (innocent until proven guilty). 3. He took the view was that nothing in the revelation of this hack as an inside job casts doubt on his initial reporting, which was about Ubiquity's response to the incident not the attacker's identity. We should at least wait to read the defence before drawing any conclusions.