7 ms·

Another confused product from UniFi. Is it targeting home users or businesses? It looks like businesses from their web page yet feels very much like a better f

Another confused product from UniFi. Is it targeting home users or businesses? It looks like businesses from their web page yet feels very much like a better fit for home. It only runs UniFi Network, so you have to buy more things, that also run UniFi Network, to get into any of their other products like Protect. I like their stuff but lately a lot of their stuff feels just confused to me, like they don't know what they want to be.

ikiris 3y ago
They want to get income like a hardware store, but sell their product as if their value is software, that they then don't maintain because its not selling their latest hardware.
boringuser2 3y ago
A business really shouldn't be running this. Anything that isn't basically your home office is running a solid NGFW with SSL interception.
- marcus0x62 3y ago
  That’s…Not an accurate description of how things work in the real world. There are large enterprises out there with NGFWs that aren’t doing much TLS inspection. Your average mom and pop business is more likely to have a wifi AP/router/NAT gateway combo from their ISP than something as feature rich as Unifi, let alone a real NGFW.
  - fnordpiglet 3y ago
    Every major company I’ve been at absolutely positively does NOT MitM their own traffic. They pay security people well enough to realize what a massive hole that creates in their security posture, and makes the intercepting appliance a cess pit of regulatory toxic waste. PCI, MNPI, even HIPPA from employees visiting their health insurance site? Check, check, check! All on a silver platter for insiders and hackers.
    - phpisthebest 3y ago
      Pretty sure that is not true, almost every major security vendors recommends Deep packet inspection of unknown traffic (which requires Decryption) Most of the time there are white lists that exempt huge amounts of known traffic to common SaaS services, and known company resources (like Health Insurance) traffic, but if it not a known service than that traffic should absolutely been decrypted and inspected. Cisco, Palo Alto, Zscaller, etc all do this
      - midasuni 3y ago
        Company selling hammers recommends banging things in
    - flumpcakes 3y ago
      We MITM traffic at places I've been at, including government/charities. If you truly have a 'NGFW' then you can easily configure it to not MITM traffic based on categories, like healthcare. It's pretty easy when you have your own PKI infrastructure. Which is surprisingly manageable if you have decent people running active directory services. Which is usually the single source of truth for LDAP integrations with NGFW anyway. You can do cool things like having corporate devices have their own machine certificates that enable an always on VPN to access central resources (updates, AD, etc.) and switch to a user profile certificate as soon as a user logs into the device to get VPN/firewall access to resources that user needs. It solves the pre-pipping problem of sending out devices to remote workers without them having to login before hand to load their profile on the same network as AD. And it's secure. The alternative is to go cloud and in-tune everything and use Entra id, etc. which seems more popular but you lose a lot of control in my opinion and have a massive attack surface because unlike on-prem AD, the cloud is just some amorphous blob that you can't lock down using the usual things like firewalls.
    - tw04 3y ago
      That’s simply not true. I can tell you for a fact basically every Fortune 500 is doing SSL inspection on at least a portion of their traffic. As for things like HIPPA - that’s why you do URL categorization and bypass those destinations.
- midasuni 3y ago
  You’re 10 years out of date. With certificate pinning the dubious benefits of breaking SSL and introducing major severity risk no longer works, far too many exceptions to manage Run your endpoint security on your devices
  - WirelessGigabit 3y ago
    Sadly even Google Chrome allows an Administrator to mark certain certificates as trusted which disables pinned cert enforcement.
chunkyks 3y ago
I bought into their unifi ecosystem years ago. Separate devices, prosumer pricing, features and quality, single pane of glass. ... And I haven't upgraded anything since. Their new products are totally undirected, they aren't making items that are obvious and needed. Their software is falling behind and they just don't care. Case in point: the usg pro 4 is years old but they havent released an updated affordable just-the-border device. Their new stuff like the dream machine, and now this, just isn't the right thing to replace what was there before. The VPN on there doesn't work with recent Android or iPhone, and they just don't care. Adding even the most basic firewall rules is hard. The single pane of glass got a major interface overhaul, and they added a huge amount of hard-to-turn-off phone-home crap at the same time. Enshittification reigns supreme. And don't forget other runty hardware like the poe ceiling lights and doorbell. The company just needs to buckle down, make good stuff, fire the product astronauts, fix obvious major problems before adding pointless new features. ... Suffice to say, my next hardware refresh almost certainly won't be from this company.
- barkerja 3y ago
  I don't disagree, but since buying the UDM-Pro years ago, I feel like the software has gotten great. And recently, they've baked in Wireguard replacing L2TP. Personally, I'd like to see more prosumer devices that support 2.5GbE/10GbE.
  - aetherspawn 3y ago
    People always raise Wireguard as the end-all of VPN and yet its 2023 and there's virtually no way to deploy it in a business context. InTune doesn't even list it as a supported VPN, and everything I see to deploy it suggests some kind of hack to bypass UAC for one specific app because the end-user software requires Admin permissions to startup and hook. When we use L2TP with UDM Pro we get ~0.1Mbps across the wire from macOS and ~20Mbps across the wire with Windows, and yet the same VPN server running on a Mikrotik will easily achieve ~300Mbps. L2TP is so easy to deploy .. it's built into Windows and macOS. I wish they would just stop telling everyone to switch to WG and fix the performance issue that is clearly Unifi specific. NB we are a business and our average spend for Unifi is $50K per year so we have a right to complain.
novok 3y ago
Small offices less than 5 or 10 people, small mall sized retail shops or apartments.
ReactiveJelly 3y ago
I don't even know what UniFi is so I'm a little lost by the site. "What is UniFi Express? It's a UniFi stack in a box." What the heck, lol? "Wi-Fi at remote sites." It's a 5G hotspot? "Secure WAN VPN between remote offices." It's managed Wireguard? It's a Wi-Fi AP with a weather forecast LCD on the front? I must not be the target demo.
- midasuni 3y ago
  Yes it is. If you want to deploy a typical small office traditionally you’d have wifi, switching, routing, firewall, vpn. Typically some of this would be integrated into a single box (routing and firewall for example), but you have a bunch of different specialist bits of equipment to manage and interoperate. This is unifi’s version of “we provide a one stop shop”, with your entire network managed through a single and of glass It’s nothing unique, but it’s unifi’s version.
RankingMember 3y ago
Yeah I'm confused- does this mean they're killing off their Amplifi consumer brand?
newsclues 3y ago
Work From Home. The enterprise is coming to the home.

ikiris 3y ago

They want to get income like a hardware store, but sell their product as if their value is software, that they then don't maintain because its not selling their latest hardware.

boringuser2 3y ago

A business really shouldn't be running this. Anything that isn't basically your home office is running a solid NGFW with SSL interception.

marcus0x62 3y ago
That’s…Not an accurate description of how things work in the real world. There are large enterprises out there with NGFWs that aren’t doing much TLS inspection. Your average mom and pop business is more likely to have a wifi AP/router/NAT gateway combo from their ISP than something as feature rich as Unifi, let alone a real NGFW.
- fnordpiglet 3y ago
  Every major company I’ve been at absolutely positively does NOT MitM their own traffic. They pay security people well enough to realize what a massive hole that creates in their security posture, and makes the intercepting appliance a cess pit of regulatory toxic waste. PCI, MNPI, even HIPPA from employees visiting their health insurance site? Check, check, check! All on a silver platter for insiders and hackers.
  - phpisthebest 3y ago
    Pretty sure that is not true, almost every major security vendors recommends Deep packet inspection of unknown traffic (which requires Decryption) Most of the time there are white lists that exempt huge amounts of known traffic to common SaaS services, and known company resources (like Health Insurance) traffic, but if it not a known service than that traffic should absolutely been decrypted and inspected. Cisco, Palo Alto, Zscaller, etc all do this
    - midasuni 3y ago
      Company selling hammers recommends banging things in
  - flumpcakes 3y ago
    We MITM traffic at places I've been at, including government/charities. If you truly have a 'NGFW' then you can easily configure it to not MITM traffic based on categories, like healthcare. It's pretty easy when you have your own PKI infrastructure. Which is surprisingly manageable if you have decent people running active directory services. Which is usually the single source of truth for LDAP integrations with NGFW anyway. You can do cool things like having corporate devices have their own machine certificates that enable an always on VPN to access central resources (updates, AD, etc.) and switch to a user profile certificate as soon as a user logs into the device to get VPN/firewall access to resources that user needs. It solves the pre-pipping problem of sending out devices to remote workers without them having to login before hand to load their profile on the same network as AD. And it's secure. The alternative is to go cloud and in-tune everything and use Entra id, etc. which seems more popular but you lose a lot of control in my opinion and have a massive attack surface because unlike on-prem AD, the cloud is just some amorphous blob that you can't lock down using the usual things like firewalls.
  - tw04 3y ago
    That’s simply not true. I can tell you for a fact basically every Fortune 500 is doing SSL inspection on at least a portion of their traffic. As for things like HIPPA - that’s why you do URL categorization and bypass those destinations.
midasuni 3y ago
You’re 10 years out of date. With certificate pinning the dubious benefits of breaking SSL and introducing major severity risk no longer works, far too many exceptions to manage Run your endpoint security on your devices
- WirelessGigabit 3y ago
  Sadly even Google Chrome allows an Administrator to mark certain certificates as trusted which disables pinned cert enforcement.

chunkyks 3y ago

I bought into their unifi ecosystem years ago. Separate devices, prosumer pricing, features and quality, single pane of glass. ... And I haven't upgraded anything since. Their new products are totally undirected, they aren't making items that are obvious and needed. Their software is falling behind and they just don't care. Case in point: the usg pro 4 is years old but they havent released an updated affordable just-the-border device. Their new stuff like the dream machine, and now this, just isn't the right thing to replace what was there before. The VPN on there doesn't work with recent Android or iPhone, and they just don't care. Adding even the most basic firewall rules is hard. The single pane of glass got a major interface overhaul, and they added a huge amount of hard-to-turn-off phone-home crap at the same time. Enshittification reigns supreme. And don't forget other runty hardware like the poe ceiling lights and doorbell. The company just needs to buckle down, make good stuff, fire the product astronauts, fix obvious major problems before adding pointless new features. ... Suffice to say, my next hardware refresh almost certainly won't be from this company.

barkerja 3y ago
I don't disagree, but since buying the UDM-Pro years ago, I feel like the software has gotten great. And recently, they've baked in Wireguard replacing L2TP. Personally, I'd like to see more prosumer devices that support 2.5GbE/10GbE.
- aetherspawn 3y ago
  People always raise Wireguard as the end-all of VPN and yet its 2023 and there's virtually no way to deploy it in a business context. InTune doesn't even list it as a supported VPN, and everything I see to deploy it suggests some kind of hack to bypass UAC for one specific app because the end-user software requires Admin permissions to startup and hook. When we use L2TP with UDM Pro we get ~0.1Mbps across the wire from macOS and ~20Mbps across the wire with Windows, and yet the same VPN server running on a Mikrotik will easily achieve ~300Mbps. L2TP is so easy to deploy .. it's built into Windows and macOS. I wish they would just stop telling everyone to switch to WG and fix the performance issue that is clearly Unifi specific. NB we are a business and our average spend for Unifi is $50K per year so we have a right to complain.

novok 3y ago

Small offices less than 5 or 10 people, small mall sized retail shops or apartments.

ReactiveJelly 3y ago

I don't even know what UniFi is so I'm a little lost by the site. "What is UniFi Express? It's a UniFi stack in a box." What the heck, lol? "Wi-Fi at remote sites." It's a 5G hotspot? "Secure WAN VPN between remote offices." It's managed Wireguard? It's a Wi-Fi AP with a weather forecast LCD on the front? I must not be the target demo.

midasuni 3y ago
Yes it is. If you want to deploy a typical small office traditionally you’d have wifi, switching, routing, firewall, vpn. Typically some of this would be integrated into a single box (routing and firewall for example), but you have a bunch of different specialist bits of equipment to manage and interoperate. This is unifi’s version of “we provide a one stop shop”, with your entire network managed through a single and of glass It’s nothing unique, but it’s unifi’s version.

RankingMember 3y ago

Yeah I'm confused- does this mean they're killing off their Amplifi consumer brand?

newsclues 3y ago

Work From Home. The enterprise is coming to the home.