16 ms·
Ubiquiti vs. Krebs
- danbruc 5y agoCan I not write in my blog whatever I want? Who says that I can not spread lies [1] about companies? Freedom of speech? [1] I have no idea which side is correct, I am just amusing Ubiquiti's claims are correct.
- anamexis 5y agoI mean, no, defamation laws are a thing.
- InTheArena 5y agoNot really. not in the USA. The laws are very very weak here.
- danbruc 5y agoSure, I was more interested in the response from the other side of the debate, why I should be able to write whatever I want. Admittedly the way I worded it probably achieves the opposite.
- jffry 5y ago> Who says that I can not spread lies about companies? Many countries have laws specifically outlawing this behavior. If you're curious specifically about the intersection of those laws and the rights afforded by the First Amendment in the United States, read https://en.wikipedia.org/wiki/Defamation_and_the_First_Amendment_to_the_United_States_Constitution https://en.wikipedia.org/wiki/Defamation_and_the_First_Amend...
- blantonl 5y agoYou can write whatever you want in your blog. No one is going to stop you. However, that doesn't mean there aren't consequences for your actions. Defamation can occur, and can be pursed legally against you, if you publish a blog where you knowingly proclaim something false that damages someone's reputation.
- rossdavidh 5y agoQuick summary: https://en.wikipedia.org/wiki/Defamation#United_States https://en.wikipedia.org/wiki/Defamation#United_States "Defamation law in the United States is much less plaintiff-friendly than its counterparts in European and the Commonwealth countries. A comprehensive discussion of what is and is not libel or slander under United States law is difficult, as the definition differs between different states and is further affected by federal law." ...but, there is such a thing as defamation/libel/slander in US law.
- ecmascript 5y agoCan someone tl;dr this for me and others? Thanks in advance!
- wil421 5y agoKrebs disclosed a breach of Ubiquiti. Turns out it was a key employee who was disgruntled. Ubiquiti claims there was no breach an employee with access did bad stuff. Same employee might have been Krebs secret source about the “breach”. Courts please make Krebs say it wasn’t a breach.
- lbriner 5y agoThe tricky part is that insider information leaked to outside is still a breach and still needs to be mitigated against.
- InTheArena 5y agoThe damage was not the breach - or at least it wasn't the biggest factor. The damage was the second claim that Krebs made in a later article that it was being covered up.
- PennRobotics 5y agohttps://news.ycombinator.com/item?id=30851102 https://news.ycombinator.com/item?id=30851102
- danesparza 5y agoI'm rapidly loosing respect for Ubiquiti. This is the wrong approach. Security by obscurity is not security. More information: https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
- BeefWellington 5y agoThis is not actually related to what's going on in this case. They're basically suing because he didn't retract or update and clarify his (really false) initial story. Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage. Should they have handled the situation better? Sure. Will they win their lawsuit? Unclear; they've got a big hill to climb to it seems unlikely. Is this in any way "silencing" discussion about it? No, it is doing the opposite, and it's not as though Ubiquiti is unfamiliar with this, given their history.
- antattack 5y ago"Really false" according to Ubiquiti - it seems KREBS disagrees.
- saalweachter 5y agoDoes bringing this suit open up Ubiquiti to discovery?
- _delirium 5y agoYes, if it gets that far without being settled or dismissed in some other way. One defense to defamation is to claim that the statements are actually true (or substantially true). If the case ends up turning on a factual disagreement over whether the statements are true, both parties can ask for discovery of evidence that would help shed light on that.
- warmwaffles 5y agoOf course it does.
- kowlo 5y agoFun to see web ads in the PDFs submitted as evidence (e.g. exhibit A)
- throwaway5752 5y agoSeems pretty close to textbook SLAPP in a jurisdiction - Virginia - that has strong anti-SLAPP laws [correction: https://news.ycombinator.com/item?id=30867948 https://news.ycombinator.com/item?id=30867948 notes this is federal, and it has not been established if VA SLAPP laws apply] and and precedent for their use. I am a fan of Ubiquiti gear but I hope they lose, pay Krebs' costs, and pay a multiple of the costs as damages. https://twitter.com/QuinnyPig/status/1509374736903507974 https://twitter.com/QuinnyPig/status/1509374736903507974 is just an example of how well this is going over.
- thesausageking 5y agoKrebs was pretty unethical in this case. He published articles based on quotes from a Ubiquiti insider who it later turned out was actually the hacker who was extorting them at the time. Krebs has never (as far as I know) addressed this or even acknowledged it. If Krebs had just been a rube who was used by the hacker, I'd agree with you. But by not updating the record, he's continuing to further lies that he knows aren't true and are/will hurt Ubiquiti's reputation. Given that, I don't think it's as simple as "this gets dismissed as a SLAPP".
- InTheArena 5y agoMore to the point - he has doubled down on his reporting being correct, but failed to acknowledge that he - himself - was the weapon that the attacker used to inflict damage on Ubiquiti - their employees, users and shareholders. Krebs got taken. Pure and simple. I can see why he might not want to acknowledge that, or do any soul searching on it, but when you were part of the problem, you have a responsibility to fix your part in it, even if it was a unwitting accomplice.
- OrvalWintermute 5y ago(From a questioning perspective) If a source happens not to be who they claimed to be, hiding for whatever reason, but the information in the story is newsworthy, credible, verifiable, and authenticated, does that mean the story should not go forward then?
- T3RMINATED 5y ago
- nojito 5y agoTitle is incredibly misleading and should be corrected. They are suing for defamation because Krebs failed to retract anything after more information was revealed.
- trollied 5y agoPrevious discussion: https://news.ycombinator.com/item?id=30850416 https://news.ycombinator.com/item?id=30850416
- pkilgore 5y agoAh, the Streisand Effect[1] Anyone else here who would have remained ignorant of this all absent this lawsuit? [1] https://en.m.wikipedia.org/wiki/Streisand_effect https://en.m.wikipedia.org/wiki/Streisand_effect
- cyral 5y agoTheir stock tumbled like 20% when this happened, it was pretty well known at the time.
- skilled 5y agoIf you could just go ahead and win this for us, Krebs. Yeah, that'd be great. Ubiquiti must have solid ground to be dragging themselves into this mess? I mean, from one side - it looks like a lot of people are on Krebs side, awesome. But, from another - no one at Ubiquity expected some kind of a pushback?
- jokowueu 5y agoThe below comment seems like solid ground to me but I don't think it will stick https://news.ycombinator.com/item?id=30850416#30851334 https://news.ycombinator.com/item?id=30850416#30851334
- lbriner 5y ago> Ubiquiti must have solid ground to be dragging themselves into this mess? Not as much as you might expect. There are so many times when I have seen cases made purely to save face or to be offensive as the best form of defence. I can't say whom but a Solicitor I know has told me of a number of cases she didn't expect she could possibly win in Court but the client had the money to pursue it to make some kind of point and didn't care whether they would actually win or not. Not saying Ubiquiti don't have a good reason, just that they don't necessarily have one.
- dylan604 5y agoPutin thought he was on solid ground that taking over Ukraine would be simple as well. This is one of the problems of having those that report to you to be too scared to tell you the truth vs what they think you want to hear. I could see where the board/c-suite of Ubiquity are all so pissed about the situation that they cannot hear or are not being told that this lawsuit is having and will continue to have a worse negative impact than just leaving it alone.
- drfuchs 5y agoIf I understand correctly, there's a real edge case going on here: Everything Krebs reported was simply what he was told by a then high-ranking employee of the company. True, Krebs didn't know this at the time, but I would think it completely exonerates him (otherwise, it would be easy for corporations to destroy journalists they didn't like by having an executive give them false information which they then dutifully report). Any legal eagles here who can clarify this aspect? Is "I was just repeating what your executive told me" a get-out-of-jail-free card?
- cyral 5y agoI believe their complaint is that Krebs has never issued a retraction or clarified that his original article is false and that his source was the hacker. Even in his update article he uses wording to make it sound like his source and the guy arrested were two different people.
- OrvalWintermute 5y agoIs it his job to authenticate the source, or, to authenticate, verify and validate the information in the story?
- Hamuko 5y agoConsidering he considers his work "independent investigative journalism", I'd say that it is.
- boeingUH60 5y agoOf course, the story was posted on his blog. That's 100% his duty, or at least if he wants to maintain his reputation as a journalist.
- vel0city 5y agoThe standard for defamation is: . knew that the statement was false and defamatory, or . acted with reckless disregard of the truth or falsity of the statement in making the statement, or . acted negligently in failing to ascertain whether the statement was true or false before making it. Not vetting your sources can be seen as acting in reckless disregard of the truth or acting negligently in failing to ascertain whether the statements were true.
- ruph123 5y agoI read in another HN thread that Ubiquiti was actually not hacked but that a former employee leaked information and tricked Krebs into believing he was a whistleblower. Is there a more detailed write-up somewhere about what happened exactly?
- kmlx 5y agowait. they didn't actually get hacked, and because Krebs didn't actually check his sources the stock fell 20%? and they're only suing him now?
- InTheArena 5y agohttps://www.techtarget.com/searchsecurity/news/252510411/Former-Ubiquiti-engineer-arrested-for-inside-threat-attack https://www.techtarget.com/searchsecurity/news/252510411/For... Basically, insider used his credentials as a highly trusted resource to access internal repositories. He then anonymously blackmailed the company, threatening to go public as a "external actor" if the company didn't pay him. The company instead got the FBI involved - which Sharp was aware of because of his role at Ubiquiti. He then lied to Krebs at least once (probably twice) claiming first that a external actor had breached ubiquiti and the company was deliberately covering it up.
- fredoralive 5y agoThe Department of Justices indictment (https://www.justice.gov/usao-sdny/pr/former-employee-technology-company-charged-stealing-confidential-data-and-extorting https://www.justice.gov/usao-sdny/pr/former-employee-technol...) give a fair amount of detail about what they allege happened, although it doesn't go into much details of the interaction between Krebs and the accused.
- gzer0 5y agoI'm honestly not sure how Ubiquiti felt this was a smart idea; defamation lawsuits are notoriously difficult to win and in the vast majority of cases, result in greater damage to the plaintiff's image than before filing the lawsuit. Waste of everyone's time and money.
- Enginerrrd 5y agoYup... it seems like everyone has turned on ubiquiti lately, but I wasn't totally convinced. I was holding out despite some of the irksome changes, but this move right here is a nail in the coffin for me.
- Someone1234 5y agoI'm on the same page. We just need to see a compelling alternative appear, and they'll lose their segment pretty quickly. Meraki could have been that until the Cisco acquisition and now $$$$ (and they make it extremely hard for SMBs/ProSumers to buy in). Some say that Aruba's "Instant On" stuff is one to keep your eye on as a direct replacement. Ever since they fired their domestic development staff and shipped those jobs overseas it has been getting worse and worse. And it isn't because foreign developers cannot develop, it is because the company then and since has prioritized cost (and flash half-baked features) over quality.
- oseityphelysiol 5y agoNo-one shipped jobs overseas. m of the teams at UI have always been and remain located in the EU.
- heffer 5y ago> Meraki could have been that until the Cisco acquisition and now $$$$ (and they make it extremely hard for SMBs/ProSumers to buy in). Meraki competes against Ubiquiti and Aruba InstantOn with Meraki Go, not mainline Meraki.
- Lightbody 5y agoI'm in the same boat. The issue is... what great alternatives are there? I'm not interesting in investing the time required with pfsense / custom stuff. I want a similar experience to Ubiquity... does it exist?
- user3939382 5y agoFrom their complaint: >Krebs intentionally disregarded these facts It's easy to miss something when you're not directly involved in a case, even more so when you're also not a lawyer (me) but from what I understand: Success for Ubiquiti here requires an ability to prove not only that statements he was making (as reported to him by a disgruntled Ubiquiti employee) were false, but that Krebs knew the claims were false. Ubiquiti seems to be arguing that, "because we said these claims were false, that proves he knew they were." That's a non sequitur IMHO.
- hx833001 5y agoActually the claims Ubiqiti are making relate to the news article Krebs wrote After everyone knew that Krebs used the criminal as his source. For some reason, Krebs chose not to disclose this in his follow up article. That’s the defamation. Krebs knowingly posted false information not in the original article, but in the follow up.
- ghostoftiber 5y agoHe's probably protected because of qualified privilege: https://www.law.cornell.edu/wex/defamation https://www.law.cornell.edu/wex/defamation They would have to prove that he was malicious in writing the article and since it's his job to write articles about security, they're going to have a real hard time doing that.
- smorgusofborg 5y agoReading the article of December 2nd it seems accurate to me. Ubiquiti was wrong about the scope, that the incident was external. It says the suspect was pretending to be a whistleblower. It sounds to me like the suspect wasn't a liar when whistleblowing so what would Krebs retract?
- deleted 5y ago[deleted]
- fuzzy2 5y agoIs the guy a criminal though? He's been charged, that doesn't mean he's guilty.
- alias_neo 5y agoI may be missing something here, English _is_ my first language after all, but regarding the screenshot of the "ad" on page 3 of the complaint; they suggest Krebs refers to "the employee" as an employee in one sentence and a "former employee" in the next. The complaint reads to me like the person who put it together doesn't understand the English language, or, reading or writing at all, for that matter. "In March, a Ubiquiti employee warned that the company had drastically understated the scope ... claim was a fabrication. On Wednesday, a former Ubiquiti employee was arrested..." I'm pretty sure this is junior school level writing, but full stop means end of sentence, and then you start another. There is nothing in the screenshot's text which suggest the former is referring to the same person as the latter; in fact, I read it as expressly making a potential distinction. "6. Krebs altered his description of Sharp, first he described Sharp as a current employee. He then described Sharp as a..." Who wrote this beautiful pair of sentences in the complaint, immediately after? Two sentences which clearly should have been one. If this is the basis of their complaint, I worry for Ubiquiti as a company.
- danachow 5y ago> There is nothing in the screenshot's text which suggest the former is referring to the same person as the latter; in fact, I read it as expressly making a potential distinction. Yes, precisely. You proved the complaint’s point. You think they might be distinct, and the complaint is pointing out that since they were the same person, this writing is intentionally misleading. > If this is the basis of their complaint, I worry for Ubiquiti as a company. Slow your roll. You just demonstrated the complaints point. Regardless of the merits of the case as a whole, #6 is a fair point. As for the grammar. It’s not Pulitzer level. But there are complete thoughts in each sentence, so it’s not wrong either.
- alias_neo 5y ago> the complaint is pointing out that since they were the same person, this writing is intentionally misleading I disagree (with the complaint, not with you). For one, if Sharp _was_ an employee in March and not at the time of writing, it is accurate to write it as-is, is it not? The ad makes a couple of statements of fact, which parse true by my reckoning regardless of whether or not that person is one and the same. I'm interested to see what comes of this, it feels to me like desperate swinging looking for something to make contact with. Having filled my home, and recommended to many colleagues Ubiquiti gear, I have been nothing but disappointed with their output of late, so much so that I recently began switching away from their gear, there is _something_ going on within Ubiquiti and it smells off.
- boeingUH60 5y agoLawsuit aside, I consider Ubiquiti's founder, Robert Pera [1], to be a fascinating individual. He runs an $18B company where he owns like 90% [2] of the shares (pretty high?). Also owns an NBA club (Memphis Grizzlies). I just think he's pretty under-the-radar for his kind of success. 1 - https://en.wikipedia.org/wiki/Robert_Pera https://en.wikipedia.org/wiki/Robert_Pera 2- https://www.fool.com/investing/2021/09/28/3-stocks-with-78-percent-or-greater-ceo-ownership/ https://www.fool.com/investing/2021/09/28/3-stocks-with-78-p...
- deleted 5y ago[deleted]
- throwaway5752 5y agoHe doesn't just run Ubiquiti. He founded it on his own credit cards, based on his own product ideas. He built Ubiquiti from nothing, essentially. Also, prior to "WSB" phenomenon, Ubiquiti was the subject of short campaigns and had really high short interest levels (https://www.fool.com/investing/2019/12/02/how-you-can-profit-from-ubiquiti-war-wall-street.aspx https://www.fool.com/investing/2019/12/02/how-you-can-profit...) which they clearly overcame. Really fascinating story.
- mc32 5y agoI’m of two minds: On the one hand we need openness with regards to reporting breaches. On the other hand we need truth in reporting. Krebs seems to be teetering at the edges. I’d rather have solid reporting without the drama.
- sneak 5y agoKrebs also doxxes people he doesn't like, and threatens people who leave negative reviews of his products. He's a dark cloud over infosec and I wish people would stop linking him.
- Hamuko 5y agoI stopped giving Krebs any kind of respect after he argued against GDPR protections on WHOIS records just because it makes his job (of doxxing people, I guess) harder. Sorry, but I can't see the privacy and physical security of millions of honest domain owners as a good trade-off for the work of "anti-abuse and security professionals". I was also not amused when he started defending anonymous shell companies by saying "Not everyone who uses shell companies is trying to launder $$. Some people just really value their privacy." https://twitter.com/briankrebs/status/1336487678301364226 https://twitter.com/briankrebs/status/1336487678301364226 I'm guessing that in addition to third-party WHOIS privacy, Krebs also has a shell company. Privacy for me, but not for thee.
- DannyBee 5y agoAs a lawyer, i've read this entire filing and it seems like nonsense at a glance. Krebs mentions the person was arrested. Ubiquiti claims first that he doesn't point out the person he sourced it from what arrested, and that he tries to mislead people by not saying repeatedly that the person is basically felon, and that being arrested makes him an invalid source of evidence, etc. They also claim he describes him as a current employee. This is all nonsense AFAICT 1. Krebs mentions the person was arrested. 2. Krebs says "In March, a ubiqitui employee said X". That was accurate at the time (AFAIK, and ubiquiti cites no real evidence I see that Krebs should have known it was not true). 3. Krebs carefully points out the arrested person claims x and y (which is accurate). 4. The filing says Sharp made false claims, and spends a paragraph explaining them. 5. The filing says Krebs made them too, but ironically, for all of its bluster, doesn't cite where and when (that I can see), and which exact claims, they are claiming Krebs said that were false. 6. The filing cites no evidence that Krebs knew or should have known, in March, that the claims were false. They get into some weird arguments about their 10-q filing but it's hard to understand the point they are trying to make. It apperas they are trying to claim that krebs should have known they notified the public but i think that's kind of a silly argument - krebs is clearly talking about their users, and most users do not read 10-q's. Saying you notified the public because you put it in a 10-q is like saying you notified the public because you put it in a classified ad section. It's dumb wordplay. 7. The December blog post they say he "doubled down on" seems again, carefully written to say what Sharp claims, not what Krebs claims. I could go on. The whole thing is, IMHO, not written very well. It's very emotionally written for a pleading, and you will be hard pressed to find a judge who will get themselves worked up over that kind of writing. Instead they mostly roll their eyes and wish that someone gave them a clear and convincing pleading instead. Put another way - if there is a case here, it isn't visible on this pleading. This feels like "throw a bunch of emotional stuff at a wall and hope it sticks", where you really want "here is an open and shut case of why this person defamed us"
- daniel-cussen 5y agoHe can countersue.
- deleted 5y ago[deleted]
- JaimeThompson 5y agoI'm not sure, given their history of flat out lying / misleading in regards to product features, that Ubiquiti wants the same sort of reasoning to apply to their own misstatements.
- flyinghamster 5y agoUgh. My EdgeRouter and APs have been nice, but between the increasing cloud BS and now a SLAPP suit, they've lost my business for good. No. My internal network infrastructure should NEVER depend on someone else's computer, ever.
- eyeareque 5y agoSuing a journalist is not a good look. I wonder what other vendors out there will take up some market share from them after this nonsense is over. Hopefully this in the end this turns into a net positive for Krebs.
- paxys 5y agoHere's an interesting fact – ~92% of Ubiquiti's shares are owned by its founder and CEO Robert Pera.
- mlissner 5y agoI'm the director of Free Law Project, the non-profit org that runs CourtListener. If anybody wants to get email or RSS alerts for this case, you can set them up here: https://www.courtlistener.com/alert/docket/new/?pacer_case_id=521759&court_id=vaed https://www.courtlistener.com/alert/docket/new/?pacer_case_i...
- incomingpain 5y agoThe lawsuit, it seems like a grey area. Report on something but then further facts come out and your story is literally outright false. You've been misled and abused by your source. I guess that's the job of a journalist to ensure what you are publishing is true. Flipside, there's a term named "Krebbed" for a reason. https://www.urbandictionary.com/define.php?term=krebbed https://www.urbandictionary.com/define.php?term=krebbed Krebs has a history of poor journalism to say the least. Frankly, it's best to ignore Krebs. I stopped reading him years ago. https://itwire.com/business-it-news/security/new-york-times-says-krebs-wrongly-implicated-briton-in-twitter-hack.html https://itwire.com/business-it-news/security/new-york-times-... https://itwire.com/business-it-news/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/business-it-news/security/infosec-researc... https://itwire.com/business-it-news/security/ex-wp-man-krebs-pulls-claims-of-russian-links-to-shadow-brokers.html https://itwire.com/business-it-news/security/ex-wp-man-krebs... 3 separate instances where Krebs got it wrong. Seems to happen a little too often. Seems clear to me, Ubiquiti got Krebbed.
- that_guy_iain 5y ago> I guess that's the job of a journalist to ensure what you are publishing is true. I remember having a stupid little blog about torrents and filesharing, it was basically a drama blog. People would go on and on about how I had to ensure things were correct and I wasn't a proper journalist because I didn't fact check and stuff. I kept replying, I wasn't a journalist, I was a dude with a blog who people kept telling stuff. So if I was getting that, I sure as hell expect a proper journalist to deal with the fall out if they got it wrong and it cost a company money. Like I would expect a newspaper or tv show to pay out if they cost me money and what not.
- incomingpain 5y ago>I remember having a stupid little blog about torrents and filesharing, it was basically a drama blog. People would go on and on about how I had to ensure things were correct and I wasn't a proper journalist because I didn't fact check and stuff. I feel like torrents and filesharing isn't going to need much fact checking. Unless you're perhaps talking about lawsuits or something where you might end up getting sued for your words. >So if I was getting that, I sure as hell expect a proper journalist to deal with the fall out if they got it wrong and it cost a company money. Like I would expect a newspaper or tv show to pay out if they cost me money and what not. I personally see Krebs as liable. Many other professions have to keep 'errors and omissions' insurance. Sometimes you just get it wrong. Nobody is perfect, you're going to make mistakes.
- bedhead 5y agoGood for Ubiquiti. Krebs' reporting on this was beyond scummy, just a total disgrace.
- kuon 5y agoWell. I realize that the original story got amplified but seeing that lawsuite is the last nail to the coffin of my view of ubnt. Telemetry, declining quality, outdated software (log4j was so old it was hard to patch), NVR discontinued, and now this. It's over for me. I will never sell ubnt again. I liked there positioning in the market, it was my goto solution for small to mid deployment, up to 20AP. A few days ago, a customer got their nvr hacked and it started (well, it tried) to mine crypto. I had told him it would happen eventually so I limited the nvr user permissions and resources to the strict minimum, which mitigated the attack. I ended up coding an in house solution, with a mix of ffmpeg rtsp->hsl bridges and motion for motion detection. Nothing fancy, a few scripts and a few html pages.