4 ms·

Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of

Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. It's true that his reporting probably caused stress for Ubiquity. I'm curious what people think is a fair system to compensate for that, without wiping out independent, generally high accuracy reporters like Krebs

curiousgal 4y ago
He has a history of doxxing people who have nothing to do with his pieces so yeah excuse my negativity.
- GordonS 4y ago
  IIRC, he never even apologised for it - just straight up said nothing, like he was pretending it never happened. I haven't followed Krebs' articles since then, he totally lost my trust.
PragmaticPulp 4y ago
> What is Krebs' false positive rate? What's more important is how those false positives are handled. In this case, it feels like it was swept under the rug and he avoided addressing for as long as possible. If he had simply addressed the problem head-on as the news came out and the FBI information became public, it would have been a different story. The way he rushed to report accusations from an anonymous source (who was actually the perpetrator) felt asymmetric relative to the minimal reporting on the extortion scandal and ensuing FBI investigation. IMO, the story about someone extorting their employer and then abusing security reporters as leverage was more interesting than the original story. Yet Krebs did very little reporting on the latter, likely because he knew he was central to making it all happen in the first place.
- dewey 4y ago
  > What's more important is how those false positives are handled. Is it really though? If there's a company that has to defend / apologize often (Facebook/Meta maybe) I'd be way more critical of their apology than if one guy who didn't have a case like that before apologying a bit too late for some people or not in the way they wish he would. There's also a lot of information we don't know yet, we don't know what happend behind the scenes and when he was provided with the final verdict and facts.
- rovr138 4y ago
  > If he had simply addressed the problem head-on as the news came out and the FBI information became public, it would have been a different story. Isn’t that what caused the issue in the first place? He talked before all the info was out and he could verify all of it.
- wlesieutre 4y ago
  I wonder if the delay in addressing it was at the advice of his lawyer so that they could negotiate with the "oops" blog post as part of a settlement
washadjeffmad 4y ago
Well, we don't know. How many times has he been either the willing accomplice or unwitting patsy in stock manipulation or corporate sabotage? Does he even know?
de6u99er 4y ago
Yeah, but publishing information as quickly as possible to surf on the first big clicks-wave can cost people their jobs. Because it can result in someone deciding to go with an other company. A friend who is looking for a easier to manage network for his wife's doctors office let me know that there's reports about security issues after I recommended to him to evaluate if Ubiquity could be a good option. Not sure what exactly he was referring to. Nevertheless, I sent him now the link to this article.
thesausageking 4y ago
Ubiquiti lost $4B in market cap based on this one, poorly sourced post Krebs wrote. He then waited 9 months after he knew it was lies to correct and only does it in the most muted, begrudging way possible. This is completely unethical behavior for a writer.
- ganoushoreilly 4y ago
  I don't think it's fair to attribute their losses directly to Krebs. While this instance is in their favor, Ubiquiti have been doing plenty on their own to alienate their client base. Half backed software updates, pushing products in new verticals without delivering on existing prodcuts. It's clear that there are still issues within Ubiquiti that aren't washed away by this "breach". They're attempting to be enterprise and barely delivering in the Prosumer market.
  - thesausageking 4y ago
    It went down by $4B the day after he published his post. A one day drop isn't about their products or how they treat their customers.
    - LilBytes 4y ago
      The thing is even with Kreb's article, and subsequent reports from both sources at Ubiquiti and their partners from current and past employees in prior conversations on HN (can't recall the ex-employees handle but I spoke to an ex-staff member at Ubiqitui on HN a while back, it's in my comment history, found the comments see [1]) Ubiquiti had a part to play in their compromise, their products have demonstrably gotten worse and it was clear from everything that came out in the wash. Ubiquiti's market value has gone down for a multitude of reasons. Sure, Krebs has a part to play in being socially engineered to push a criminals MO. But Ubiquti's market cap also went down because: * Ubiquti are huge, and it's clear they don't have a good engineering culture, or have one at all and that had a part to play in their compromise with or without Krebs being a willing participant in it at all * For a several billion dollar company, they don't have appropriate risk strategies or security controls in place that are expected of a business of their size * Their products have gotten significantly worse over the years and as a consequence of the Covid-19 pandemic and supply chain markets, they haven't got product out the door as quickly as prior The question isn't if they deserved to lose $4B as a consequence of the hack, it's a question of how much of that $4B market loss is because they're not a well ran business as evident by the hack. Vs. how much of that $4B loss was directly because of Krebs? That's a much harder line to define. [1] https://news.ycombinator.com/item?id=29455730 https://news.ycombinator.com/item?id=29455730
phoboslab 4y ago
> What is Krebs' false positive rate? You only ever hear about it when he gets high profile cases wrong. When my project was targeted by him, he ended up going down some conspiracy rabbit hole and doxed all the wrong people. This forced me to issue a correction - mission accomplished, I guess. During his "investigation" he accidentally sent an email that was meant for his business partner to some of my friends. It offered a glimpse into his sensationalist mindset. I don't have much respect for that guy.
modriano 4y ago
I had been looking to improve my home network and was about to buy a Unifi Dream Machine Pro-SE and some access points when I read Krebs initial article on Ubiquiti being compromised (coupled with HN commenters really dogpiling on Ubiquiti). Since then, I must have spent 40 hours trying to find a comparable alternative before my discomfort with the opacity of my prior setup drove me to surrender and buy what I had planned out a year ago. I still think highly of Krebs, but I'm pretty irritated that he wasted so much of my time by reporting something so poorly sourced.
BeefWellington 4y ago
> What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. Pretty damned high. From doxxing completely incorrect people over Twitter beef to over-trusting sources like this, he's had a number of controversies over the years and has demonstrated his unreliability as a source of information. > There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. Actually he carefully does not own up to the error: > Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press. By including "which includes providing false information to the press" he's effectively saying it wasn't his fault. Did other press report on it? Did other press ignore the follow-up for nearly a year after it became apparent the source of this information was the person committing the crimes? It would seem to me that owning up to the error wouldn't look so devoid of any responsibility. He then writes: > As a result of the new information that has been provided to me, I no longer have faith in the veracity of my source or the information he provided to me. I always endeavor to ensure that my articles are properly sourced and factual. > This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website. "This time, I [failed to ensure my articles are properly sourced and factual], and as a result, I would like to extend my sincerest apologies to Ubiquiti, and have decided to remove those articles from my website." The paraphrasing I've done is a more direct way of taking responsibility than Krebs has done. Note in his version the complete lack of ownership, passive voice, and key -- the separation of the problem from where the failure occurred by a paragraph. That's all designed to essentially shirk responsibility here. Given Krebs' other tendency to get things really wrong, I think it's time people actually viewed him as an unreliable reporter. Especially given he seemingly ignored/dug his heels in about being taken for a ride on this and that then begs the question: How many other instances like this are there that we just haven't heard of or seen?

curiousgal 4y ago

He has a history of doxxing people who have nothing to do with his pieces so yeah excuse my negativity.

GordonS 4y ago
IIRC, he never even apologised for it - just straight up said nothing, like he was pretending it never happened. I haven't followed Krebs' articles since then, he totally lost my trust.

PragmaticPulp 4y ago

> What is Krebs' false positive rate? What's more important is how those false positives are handled. In this case, it feels like it was swept under the rug and he avoided addressing for as long as possible. If he had simply addressed the problem head-on as the news came out and the FBI information became public, it would have been a different story. The way he rushed to report accusations from an anonymous source (who was actually the perpetrator) felt asymmetric relative to the minimal reporting on the extortion scandal and ensuing FBI investigation. IMO, the story about someone extorting their employer and then abusing security reporters as leverage was more interesting than the original story. Yet Krebs did very little reporting on the latter, likely because he knew he was central to making it all happen in the first place.

dewey 4y ago
> What's more important is how those false positives are handled. Is it really though? If there's a company that has to defend / apologize often (Facebook/Meta maybe) I'd be way more critical of their apology than if one guy who didn't have a case like that before apologying a bit too late for some people or not in the way they wish he would. There's also a lot of information we don't know yet, we don't know what happend behind the scenes and when he was provided with the final verdict and facts.
rovr138 4y ago
> If he had simply addressed the problem head-on as the news came out and the FBI information became public, it would have been a different story. Isn’t that what caused the issue in the first place? He talked before all the info was out and he could verify all of it.
wlesieutre 4y ago
I wonder if the delay in addressing it was at the advice of his lawyer so that they could negotiate with the "oops" blog post as part of a settlement

washadjeffmad 4y ago

Well, we don't know. How many times has he been either the willing accomplice or unwitting patsy in stock manipulation or corporate sabotage? Does he even know?

de6u99er 4y ago

Yeah, but publishing information as quickly as possible to surf on the first big clicks-wave can cost people their jobs. Because it can result in someone deciding to go with an other company. A friend who is looking for a easier to manage network for his wife's doctors office let me know that there's reports about security issues after I recommended to him to evaluate if Ubiquity could be a good option. Not sure what exactly he was referring to. Nevertheless, I sent him now the link to this article.

thesausageking 4y ago

Ubiquiti lost $4B in market cap based on this one, poorly sourced post Krebs wrote. He then waited 9 months after he knew it was lies to correct and only does it in the most muted, begrudging way possible. This is completely unethical behavior for a writer.

ganoushoreilly 4y ago
I don't think it's fair to attribute their losses directly to Krebs. While this instance is in their favor, Ubiquiti have been doing plenty on their own to alienate their client base. Half backed software updates, pushing products in new verticals without delivering on existing prodcuts. It's clear that there are still issues within Ubiquiti that aren't washed away by this "breach". They're attempting to be enterprise and barely delivering in the Prosumer market.
- thesausageking 4y ago
  It went down by $4B the day after he published his post. A one day drop isn't about their products or how they treat their customers.
  - LilBytes 4y ago
    The thing is even with Kreb's article, and subsequent reports from both sources at Ubiquiti and their partners from current and past employees in prior conversations on HN (can't recall the ex-employees handle but I spoke to an ex-staff member at Ubiqitui on HN a while back, it's in my comment history, found the comments see [1]) Ubiquiti had a part to play in their compromise, their products have demonstrably gotten worse and it was clear from everything that came out in the wash. Ubiquiti's market value has gone down for a multitude of reasons. Sure, Krebs has a part to play in being socially engineered to push a criminals MO. But Ubiquti's market cap also went down because: * Ubiquti are huge, and it's clear they don't have a good engineering culture, or have one at all and that had a part to play in their compromise with or without Krebs being a willing participant in it at all * For a several billion dollar company, they don't have appropriate risk strategies or security controls in place that are expected of a business of their size * Their products have gotten significantly worse over the years and as a consequence of the Covid-19 pandemic and supply chain markets, they haven't got product out the door as quickly as prior The question isn't if they deserved to lose $4B as a consequence of the hack, it's a question of how much of that $4B market loss is because they're not a well ran business as evident by the hack. Vs. how much of that $4B loss was directly because of Krebs? That's a much harder line to define. [1] https://news.ycombinator.com/item?id=29455730 https://news.ycombinator.com/item?id=29455730

phoboslab 4y ago

> What is Krebs' false positive rate? You only ever hear about it when he gets high profile cases wrong. When my project was targeted by him, he ended up going down some conspiracy rabbit hole and doxed all the wrong people. This forced me to issue a correction - mission accomplished, I guess. During his "investigation" he accidentally sent an email that was meant for his business partner to some of my friends. It offered a glimpse into his sensationalist mindset. I don't have much respect for that guy.

modriano 4y ago

I had been looking to improve my home network and was about to buy a Unifi Dream Machine Pro-SE and some access points when I read Krebs initial article on Ubiquiti being compromised (coupled with HN commenters really dogpiling on Ubiquiti). Since then, I must have spent 40 hours trying to find a comparable alternative before my discomfort with the opacity of my prior setup drove me to surrender and buy what I had planned out a year ago. I still think highly of Krebs, but I'm pretty irritated that he wasted so much of my time by reporting something so poorly sourced.

BeefWellington 4y ago

> What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. Pretty damned high. From doxxing completely incorrect people over Twitter beef to over-trusting sources like this, he's had a number of controversies over the years and has demonstrated his unreliability as a source of information. > There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. Actually he carefully does not own up to the error: > Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press. By including "which includes providing false information to the press" he's effectively saying it wasn't his fault. Did other press report on it? Did other press ignore the follow-up for nearly a year after it became apparent the source of this information was the person committing the crimes? It would seem to me that owning up to the error wouldn't look so devoid of any responsibility. He then writes: > As a result of the new information that has been provided to me, I no longer have faith in the veracity of my source or the information he provided to me. I always endeavor to ensure that my articles are properly sourced and factual. > This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website. "This time, I [failed to ensure my articles are properly sourced and factual], and as a result, I would like to extend my sincerest apologies to Ubiquiti, and have decided to remove those articles from my website." The paraphrasing I've done is a more direct way of taking responsibility than Krebs has done. Note in his version the complete lack of ownership, passive voice, and key -- the separation of the problem from where the failure occurred by a paragraph. That's all designed to essentially shirk responsibility here. Given Krebs' other tendency to get things really wrong, I think it's time people actually viewed him as an unreliable reporter. Especially given he seemingly ignored/dug his heels in about being taken for a ride on this and that then begs the question: How many other instances like this are there that we just haven't heard of or seen?