5 ms·

As the article points out its got the same realtek chip in it as any other brand.

by cavisne 4y ago

krasin 4y ago
Yes, but firmware backdoors are a thing. The same chip does not mean the same behavior.
- Someone1234 4y ago
  Let me see if I can nail down the argument here: - Chinese brand, with Chinese manufacturing: Backdoored. - Non-Chinese brand, with Chinese manufacturing: Safe. I mean, do people not realize that most "made in China" electronics is taken directly from a shipping container landing in California straight to reseller's warehouses? I mean, sure, they might spot check a few units here and there for QA, but it is direct from a Chinese factory to your mailbox without often receiving a secondary check. Even "final manufacturing in the US" is often taking the Chinese made casing and the Chinese made board and mating them in a small operation for a sticker.
  - krasin 4y ago
    > Let me see if I can nail down the argument here: Wrong nail. My home router runs OpenWRT. While it's not a 100% guarantee to be safe, it's a lot better than any closed-sourced firmware. That said, if the choice is limited to closed-sourced firmware options, it's best to choose a reputable brand, so that the list of people who can access your router is limited to three letter agencies (US and China), as opposed to random scammers, like with all these malware-ridden Android phones from Aliexpress: https://www.cnet.com/tech/mobile/android-malware-that-comes-preinstalled-are-a-massive-threat https://www.cnet.com/tech/mobile/android-malware-that-comes-... So, yes. Not buying network equipment on Aliexpress is a sound advice.
    - TheRealPomax 4y ago
      Why would it be better than the realtek chip found in so many devices that the odds of yours being bugged are proportional to how much you're wanted by the authorities. Consumer hardware doesn't have backdoors because the monumentous task required to keep that hidden isn't worth the non-payoff of not getting the military or state secrets that would make it worth the effort.
    - mrmuagi 4y ago
      This is just a switch but similiar 2.5gbe routers can run pfsense or opnsense with i225/i226 chips and intel/amd cpus. Servethehome covers quite a few of them.
    - mike_d 4y ago
      OpenWRT does not replace the firmware on any of the actual controllers inside the device, which is where a backdoor would likely reside.
  - bioemerl 4y ago
    Safer indeed. I do not worry about people spying on me, I worry about empowering China, Russia, North Korea, Iran, or any such country that would happily eat our lunch if given the opportunity. Do not empower people who would happily screw you over. Keeping as much distance as possible from Chinese influence in all of the products you use in your home is essential to having a home that remains functional should we ever go to war.
- duskwuff 4y ago
  I would be surprised if this device had any firmware at all. It's an unmanaged switch; most of the device's behavior is embedded in the switch IC.
  - pabs3 4y ago
    So the backdoor is in the switch IC? :)
  - oliv3r 4y ago
    Yes they do. I have an ZyXEL XGS1010-12 (unmanaged) and it also runs Linux. The switch chip must be initialized, and the realtek SDK is based on Linux. You could do it with just an eeprom afaik, but seems to be actually more effort (and not possible on all of realtek's switch chips).
f38zf5vdt 4y ago
It's so cheap because it comes with a power supply that doesn't have a UL or ETL certification, and as such could not be legally sold in North America. A decent quality power supply that could output 125 W would be around $50-70. You get what you pay for.
- iforgotpassword 4y ago
  The article says the power supply is certified, but not the device.
  - f38zf5vdt 4y ago
    It's CE certified which is something that Chinese companies print on everything, since it's a self-certification process. UL/ETL require you to do failure mode testing and provide detailed schematics of your equipment for review, and costs quite a bit of cash to get done.
- galangalalgol 4y ago
  I got a ceiling fan a few months back. The wireless remote had no FCC id on it. The box in the fan did. I opened the remote and the plastic was oddly formed, and there was only one nonsense word printed on the pcb, and "v1.0". The microcontroller didn't even have anything printed on it. I listened to it with an sdr and it was in the 434MHz band, and not overly noisy. It probably would have passed if someone had payed for it to be tested... If I'd purchased it on AliExpress or even ebay I wouldn't have been surprised, but it was a front page prime-day deal. I knew Amazon was iffy, but this was a straight up illegal product.
  - simfree 4y ago
    Amazon doesn't care, much of what is offered is ordered on Alibaba, shipped direct to an Amazon warehouse for Fulfilled by Amazon then resold at a notable markup. Policing this is very hard for brands that have skus they would like to defend from fakes, nevermind a much broader range of consumer goods with little oversight.
- 4y ago

As the article points out its got the same realtek chip in it as any other brand.

krasin 4y ago

Yes, but firmware backdoors are a thing. The same chip does not mean the same behavior.

Someone1234 4y ago
Let me see if I can nail down the argument here: - Chinese brand, with Chinese manufacturing: Backdoored. - Non-Chinese brand, with Chinese manufacturing: Safe. I mean, do people not realize that most "made in China" electronics is taken directly from a shipping container landing in California straight to reseller's warehouses? I mean, sure, they might spot check a few units here and there for QA, but it is direct from a Chinese factory to your mailbox without often receiving a secondary check. Even "final manufacturing in the US" is often taking the Chinese made casing and the Chinese made board and mating them in a small operation for a sticker.
- krasin 4y ago
  > Let me see if I can nail down the argument here: Wrong nail. My home router runs OpenWRT. While it's not a 100% guarantee to be safe, it's a lot better than any closed-sourced firmware. That said, if the choice is limited to closed-sourced firmware options, it's best to choose a reputable brand, so that the list of people who can access your router is limited to three letter agencies (US and China), as opposed to random scammers, like with all these malware-ridden Android phones from Aliexpress: https://www.cnet.com/tech/mobile/android-malware-that-comes-preinstalled-are-a-massive-threat https://www.cnet.com/tech/mobile/android-malware-that-comes-... So, yes. Not buying network equipment on Aliexpress is a sound advice.
  - TheRealPomax 4y ago
    Why would it be better than the realtek chip found in so many devices that the odds of yours being bugged are proportional to how much you're wanted by the authorities. Consumer hardware doesn't have backdoors because the monumentous task required to keep that hidden isn't worth the non-payoff of not getting the military or state secrets that would make it worth the effort.
  - mrmuagi 4y ago
    This is just a switch but similiar 2.5gbe routers can run pfsense or opnsense with i225/i226 chips and intel/amd cpus. Servethehome covers quite a few of them.
  - mike_d 4y ago
    OpenWRT does not replace the firmware on any of the actual controllers inside the device, which is where a backdoor would likely reside.
- bioemerl 4y ago
  Safer indeed. I do not worry about people spying on me, I worry about empowering China, Russia, North Korea, Iran, or any such country that would happily eat our lunch if given the opportunity. Do not empower people who would happily screw you over. Keeping as much distance as possible from Chinese influence in all of the products you use in your home is essential to having a home that remains functional should we ever go to war.
duskwuff 4y ago
I would be surprised if this device had any firmware at all. It's an unmanaged switch; most of the device's behavior is embedded in the switch IC.
- pabs3 4y ago
  So the backdoor is in the switch IC? :)
- oliv3r 4y ago
  Yes they do. I have an ZyXEL XGS1010-12 (unmanaged) and it also runs Linux. The switch chip must be initialized, and the realtek SDK is based on Linux. You could do it with just an eeprom afaik, but seems to be actually more effort (and not possible on all of realtek's switch chips).

f38zf5vdt 4y ago

It's so cheap because it comes with a power supply that doesn't have a UL or ETL certification, and as such could not be legally sold in North America. A decent quality power supply that could output 125 W would be around $50-70. You get what you pay for.

iforgotpassword 4y ago
The article says the power supply is certified, but not the device.
- f38zf5vdt 4y ago
  It's CE certified which is something that Chinese companies print on everything, since it's a self-certification process. UL/ETL require you to do failure mode testing and provide detailed schematics of your equipment for review, and costs quite a bit of cash to get done.
galangalalgol 4y ago
I got a ceiling fan a few months back. The wireless remote had no FCC id on it. The box in the fan did. I opened the remote and the plastic was oddly formed, and there was only one nonsense word printed on the pcb, and "v1.0". The microcontroller didn't even have anything printed on it. I listened to it with an sdr and it was in the 434MHz band, and not overly noisy. It probably would have passed if someone had payed for it to be tested... If I'd purchased it on AliExpress or even ebay I wouldn't have been surprised, but it was a front page prime-day deal. I knew Amazon was iffy, but this was a straight up illegal product.
- simfree 4y ago
  Amazon doesn't care, much of what is offered is ordered on Alibaba, shipped direct to an Amazon warehouse for Fulfilled by Amazon then resold at a notable markup. Policing this is very hard for brands that have skus they would like to defend from fakes, nevermind a much broader range of consumer goods with little oversight.
4y ago