4 ms·

I'm rapidly loosing respect for Ubiquiti. This is the wrong approach. Security by obscurity is not security. More information: https://en.wikipedia.org/wiki/

I'm rapidly loosing respect for Ubiquiti. This is the wrong approach. Security by obscurity is not security. More information: https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity

BeefWellington 5y ago
This is not actually related to what's going on in this case. They're basically suing because he didn't retract or update and clarify his (really false) initial story. Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage. Should they have handled the situation better? Sure. Will they win their lawsuit? Unclear; they've got a big hill to climb to it seems unlikely. Is this in any way "silencing" discussion about it? No, it is doing the opposite, and it's not as though Ubiquiti is unfamiliar with this, given their history.
- antattack 5y ago
  "Really false" according to Ubiquiti - it seems KREBS disagrees.
  - saalweachter 5y ago
    Does bringing this suit open up Ubiquiti to discovery?
    - _delirium 5y ago
      Yes, if it gets that far without being settled or dismissed in some other way. One defense to defamation is to claim that the statements are actually true (or substantially true). If the case ends up turning on a factual disagreement over whether the statements are true, both parties can ask for discovery of evidence that would help shed light on that.
    - warmwaffles 5y ago
      Of course it does.
  - lovingCranberry 5y ago
    Krebs disagrees a lot. Sometimes he's wrong though. Anyone remembers when Krebs doxxed the admin of cock.li because they disagreed with Krebs on spamhaus' black listing policy? [1] (Spamhaus just blacklists all TCP SYNs, which can be easily spoofed since it's not the complete handshake) I don't know. I believe that Krebs has usually good intentions, but sometimes he is just presenting his findings in a very malicious way. [1] https://twitter.com/_mg_/status/1121316639637528576 https://twitter.com/_mg_/status/1121316639637528576 [2] https://www.youtube.com/watch?v=h8WCVwyZyg0 https://www.youtube.com/watch?v=h8WCVwyZyg0
    - mschuster91 5y ago
      > Anyone remembers when Krebs doxxed the admin of cock.li because they disagreed with Krebs on spamhaus' black listing policy? I don't shed a tear for that person though, as someone who has gotten about three dozens of murder threats that were sent through their service. cock.li is an awful service that serves no legitimate purpose other than enabling people to cause harm. The admin should have been arrested at 36c3 by the police instead of simply been booted out for his neo-Nazi domain names, but unfortunately our police is incredibly incompetent.
      - lovingCranberry 5y ago
        Sorry, but just no. Just because someone abuses a service, it doesn't mean that it "serves no legitimate purpose". You see, people are using Tor to buy drugs and to share child porn. Does that make tor a tool "that serves no legitimate purpose other than enabling people to cause harm"? I am a happy user of cock.li, because it's one of the only few email providers, which don't require my phone number (unlike gmail, outlook etc). I don't mind that they also offer domains joke domains such as "hitler.rocks", since I know what a joke is.
        klibertp 5y ago
        > since I know what a joke is. https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law Not judging one way or the other, just saying that it's incredibly risky to make jokes like this, especially in the current climate, where the narrative and emotional response matters more than facts and rationality.
  - washadjeffmad 5y ago
    "False" in this case means different things to different parties. To Krebs, false means he did not accurately report the information as presented to him. In that way he is correct. To Ubiquiti, false means the information was willfully inaccurate, should not have been deceptively presented to a notable authority in the tech field, and this should not have been published. Ubiquiti has to sue Krebs to show that the damage to their reputation was related his reporting which they can tie back to Sharp. Krebs has to defend his standpoint to show he was not complicit in Sharp's planned sabotage. I expect they'll settle once the sides are fully aired.
    - CrazyStat 5y ago
      Krebs has an easy win here, I'll be very surprised if he settles. The bar to show defamation in a case like this is very high. Ubiquiti isn't going to meet it.
  - swashboon 5y ago
    The FBI also seems to disagree seeing as they arrested Krebs source indicating that there never was any third party hacker, just that individual insider.
- gvb 5y ago
  Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage. To clarify the phrasing, the disgruntled employee caused the damage to Ubiquiti. He was the one who "hacked" Ubiquiti (actually he misused his credentials), was the "whistleblower" that fed Krebs information of his own "hack", and tried to blackmail Ubiquiti. All while he was a Ubiquiti employee... assigned to investigate the "hack." Ref: https://thenextweb.com/news/ubiquiti-ex-employee-hacker-whistlblower-ransom https://thenextweb.com/news/ubiquiti-ex-employee-hacker-whis... https://www.securityweek.com/former-employee-accused-being-behind-ubiquiti-hack https://www.securityweek.com/former-employee-accused-being-b...
bigyellow 5y ago

BeefWellington 5y ago

This is not actually related to what's going on in this case. They're basically suing because he didn't retract or update and clarify his (really false) initial story. Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage. Should they have handled the situation better? Sure. Will they win their lawsuit? Unclear; they've got a big hill to climb to it seems unlikely. Is this in any way "silencing" discussion about it? No, it is doing the opposite, and it's not as though Ubiquiti is unfamiliar with this, given their history.

antattack 5y ago
"Really false" according to Ubiquiti - it seems KREBS disagrees.
- saalweachter 5y ago
  Does bringing this suit open up Ubiquiti to discovery?
  - _delirium 5y ago
    Yes, if it gets that far without being settled or dismissed in some other way. One defense to defamation is to claim that the statements are actually true (or substantially true). If the case ends up turning on a factual disagreement over whether the statements are true, both parties can ask for discovery of evidence that would help shed light on that.
  - warmwaffles 5y ago
    Of course it does.
- lovingCranberry 5y ago
  Krebs disagrees a lot. Sometimes he's wrong though. Anyone remembers when Krebs doxxed the admin of cock.li because they disagreed with Krebs on spamhaus' black listing policy? [1] (Spamhaus just blacklists all TCP SYNs, which can be easily spoofed since it's not the complete handshake) I don't know. I believe that Krebs has usually good intentions, but sometimes he is just presenting his findings in a very malicious way. [1] https://twitter.com/_mg_/status/1121316639637528576 https://twitter.com/_mg_/status/1121316639637528576 [2] https://www.youtube.com/watch?v=h8WCVwyZyg0 https://www.youtube.com/watch?v=h8WCVwyZyg0
  - mschuster91 5y ago
    > Anyone remembers when Krebs doxxed the admin of cock.li because they disagreed with Krebs on spamhaus' black listing policy? I don't shed a tear for that person though, as someone who has gotten about three dozens of murder threats that were sent through their service. cock.li is an awful service that serves no legitimate purpose other than enabling people to cause harm. The admin should have been arrested at 36c3 by the police instead of simply been booted out for his neo-Nazi domain names, but unfortunately our police is incredibly incompetent.
    - lovingCranberry 5y ago
      Sorry, but just no. Just because someone abuses a service, it doesn't mean that it "serves no legitimate purpose". You see, people are using Tor to buy drugs and to share child porn. Does that make tor a tool "that serves no legitimate purpose other than enabling people to cause harm"? I am a happy user of cock.li, because it's one of the only few email providers, which don't require my phone number (unlike gmail, outlook etc). I don't mind that they also offer domains joke domains such as "hitler.rocks", since I know what a joke is.
      - klibertp 5y ago
        > since I know what a joke is. https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law Not judging one way or the other, just saying that it's incredibly risky to make jokes like this, especially in the current climate, where the narrative and emotional response matters more than facts and rationality.
- washadjeffmad 5y ago
  "False" in this case means different things to different parties. To Krebs, false means he did not accurately report the information as presented to him. In that way he is correct. To Ubiquiti, false means the information was willfully inaccurate, should not have been deceptively presented to a notable authority in the tech field, and this should not have been published. Ubiquiti has to sue Krebs to show that the damage to their reputation was related his reporting which they can tie back to Sharp. Krebs has to defend his standpoint to show he was not complicit in Sharp's planned sabotage. I expect they'll settle once the sides are fully aired.
  - CrazyStat 5y ago
    Krebs has an easy win here, I'll be very surprised if he settles. The bar to show defamation in a case like this is very high. Ubiquiti isn't going to meet it.
- swashboon 5y ago
  The FBI also seems to disagree seeing as they arrested Krebs source indicating that there never was any third party hacker, just that individual insider.
gvb 5y ago
Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage. To clarify the phrasing, the disgruntled employee caused the damage to Ubiquiti. He was the one who "hacked" Ubiquiti (actually he misused his credentials), was the "whistleblower" that fed Krebs information of his own "hack", and tried to blackmail Ubiquiti. All while he was a Ubiquiti employee... assigned to investigate the "hack." Ref: https://thenextweb.com/news/ubiquiti-ex-employee-hacker-whistlblower-ransom https://thenextweb.com/news/ubiquiti-ex-employee-hacker-whis... https://www.securityweek.com/former-employee-accused-being-behind-ubiquiti-hack https://www.securityweek.com/former-employee-accused-being-b...

bigyellow 5y ago