5 ms·

Their firmware is absolutely riddled with flaws and exploitable vulnerabilities. Unless you are willing to re-flash their hardware with third-party firmware su

Their firmware is absolutely riddled with flaws and exploitable vulnerabilities. Unless you are willing to re-flash their hardware with third-party firmware such as DD-WRT or OpenWRT, I would always encourage anyone to go with a company that keeps their firmware up to date, like Ubiquity. It’s not their hardware. It’s their firmware which is the problem.

nottorp 2y ago
Ubiquity has already attempted to make their customers dependent on the "cloud" once. I believe there was some pushback and they just made it annoying to not use their online services, but I'd still like to know what they need my personal data for...
- buildbot 2y ago
  According to their privacy policy, they don’t collect or sell anything (besides the standard we run a website stuff). The nefarious, evil purpose of the cloud service is…just lock in. And being easy to configure.
ryanianian 2y ago
For anyone curious about the vulnerabilities, this Ars article from November 2024 is a good read: https://arstechnica.com/information-technology/2024/11/microsoft-warns-of-8000-strong-botnet-used-in-password-spraying-attacks/ https://arstechnica.com/information-technology/2024/11/micro...
moduspol 2y ago
Perhaps the ban / tariff / regulation should be applied to companies making networking hardware that's riddled with flaws and exploitable vulnerabilities, rather than by naming specific companies or countries of origin.
- rekabis 2y ago
  I would be fully open to the FTC/CRTC or whatever network/ISP regulator that exists in your country be the determiner of what should be exposed to world+dog. Let them do remote vulnerability scans once a day on all IP addresses assigned to domestic ISPs or locations physically in-country, then flag the IPs that have vulnerable routers. From there, they can force ISPs to contact their clients to demand the issue be resolved. If the client does not respond to the ISP, the ISP is forced to suspend the connection until the client can demonstrate a fix has been implemented. In all cases, that vulnerability vanishing has the ISP updated so the client is no longer in danger of being pestered. If the product is still being sold in stores, or is not very far past EoL, and there is no manufacturer patch available, those manufacturers must take their hardware back for a 100% MSRP refund, or provide an equivalent router without those exploits. It’s only if the product has been no longer manufactured for a minimum set period of time - say, 7 years - that it is deemed “too far past EoL” for the responsibility for patching/replacing to fall on manufacturers, and responsibility finally falls to the consumer to replace/upgrade. In all cases, a customer can “fix” their router with third-party firmware such as OpenWRT or DD-WRT, but this also requires laws to be written that forces manufacturers to not hardware-lock their routers, and force them to meet the minimum storage/driver-availability specs these third-party firmwares need.
hindsightbias 2y ago
Even with the WRTs, the firmware is probably built by the manufacturer. Try finding the provenance of who wrote the source code and where they live. AFAIK, that's not possible. So you have a router built with Chinese components (all of the ones anyone here can afford) with closed and "open" firmware built by them. I bought one of those GL.inet "open" routers and the WRT packages bricked it, so I have a choice of reverting or flashing from the factory (which appears to be a link to HK). That's probably 99.99% of use cases. They're in your base and they always have been.
- rekabis 2y ago
  > Even with the WRTs, the firmware is probably built by the manufacturer. Say you know nothing about router firmware without saying you know nothing about router firmware. OpenWRT and DD-WRT and other open-source third-party firmwares are THIRD PARTY firmwares. They have no connection with the manufacturer whatsoever.
  - hindsightbias 2y ago
    I just looked at 10 different openwrt data entries: > WikiDevi URL: https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x Every one had a .ru domain. How do you know, exactly, who built it? GL.inet builds their own WRT package. It's a "feature".
    - rekabis 2y ago
      > Every one had a .ru domain. Brand-new to the Internet, are ya? Just because you cherry-pick Russian informational sites doesn’t mean that third-party firmwares have any connection to Russia whatsoever. Third-party firmwares are open-source projects, worked on by tens of thousands of volunteers from around the planet, and frequently have ZERO CONNECTION to any one hardware manufacturer. There are some collaboration efforts, when a particular manufacturer decides to adopt an open-source firmware as the exclusive firmware for their own hardware, but that simply means the hardware is fully unlocked for any third-party firmware that wants to be adapted for that hardware. These manufacturers just decided that they had no desire to f**k over the consumer by locking them into custom-made firmware. For example, I believe Turris https://www.turris.com/ https://www.turris.com/ takes a stock, latest copy of OpenWRT and makes a few tweaks to extend its capabilities for additional, server-like features.
adamc 2y ago
I dislike the pattern where we have to hook into their cloud.

nottorp 2y ago

Ubiquity has already attempted to make their customers dependent on the "cloud" once. I believe there was some pushback and they just made it annoying to not use their online services, but I'd still like to know what they need my personal data for...

buildbot 2y ago
According to their privacy policy, they don’t collect or sell anything (besides the standard we run a website stuff). The nefarious, evil purpose of the cloud service is…just lock in. And being easy to configure.

ryanianian 2y ago

For anyone curious about the vulnerabilities, this Ars article from November 2024 is a good read: https://arstechnica.com/information-technology/2024/11/microsoft-warns-of-8000-strong-botnet-used-in-password-spraying-attacks/ https://arstechnica.com/information-technology/2024/11/micro...

moduspol 2y ago

Perhaps the ban / tariff / regulation should be applied to companies making networking hardware that's riddled with flaws and exploitable vulnerabilities, rather than by naming specific companies or countries of origin.

rekabis 2y ago
I would be fully open to the FTC/CRTC or whatever network/ISP regulator that exists in your country be the determiner of what should be exposed to world+dog. Let them do remote vulnerability scans once a day on all IP addresses assigned to domestic ISPs or locations physically in-country, then flag the IPs that have vulnerable routers. From there, they can force ISPs to contact their clients to demand the issue be resolved. If the client does not respond to the ISP, the ISP is forced to suspend the connection until the client can demonstrate a fix has been implemented. In all cases, that vulnerability vanishing has the ISP updated so the client is no longer in danger of being pestered. If the product is still being sold in stores, or is not very far past EoL, and there is no manufacturer patch available, those manufacturers must take their hardware back for a 100% MSRP refund, or provide an equivalent router without those exploits. It’s only if the product has been no longer manufactured for a minimum set period of time - say, 7 years - that it is deemed “too far past EoL” for the responsibility for patching/replacing to fall on manufacturers, and responsibility finally falls to the consumer to replace/upgrade. In all cases, a customer can “fix” their router with third-party firmware such as OpenWRT or DD-WRT, but this also requires laws to be written that forces manufacturers to not hardware-lock their routers, and force them to meet the minimum storage/driver-availability specs these third-party firmwares need.

hindsightbias 2y ago

Even with the WRTs, the firmware is probably built by the manufacturer. Try finding the provenance of who wrote the source code and where they live. AFAIK, that's not possible. So you have a router built with Chinese components (all of the ones anyone here can afford) with closed and "open" firmware built by them. I bought one of those GL.inet "open" routers and the WRT packages bricked it, so I have a choice of reverting or flashing from the factory (which appears to be a link to HK). That's probably 99.99% of use cases. They're in your base and they always have been.

rekabis 2y ago
> Even with the WRTs, the firmware is probably built by the manufacturer. Say you know nothing about router firmware without saying you know nothing about router firmware. OpenWRT and DD-WRT and other open-source third-party firmwares are THIRD PARTY firmwares. They have no connection with the manufacturer whatsoever.
- hindsightbias 2y ago
  I just looked at 10 different openwrt data entries: > WikiDevi URL: https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x Every one had a .ru domain. How do you know, exactly, who built it? GL.inet builds their own WRT package. It's a "feature".
  - rekabis 2y ago
    > Every one had a .ru domain. Brand-new to the Internet, are ya? Just because you cherry-pick Russian informational sites doesn’t mean that third-party firmwares have any connection to Russia whatsoever. Third-party firmwares are open-source projects, worked on by tens of thousands of volunteers from around the planet, and frequently have ZERO CONNECTION to any one hardware manufacturer. There are some collaboration efforts, when a particular manufacturer decides to adopt an open-source firmware as the exclusive firmware for their own hardware, but that simply means the hardware is fully unlocked for any third-party firmware that wants to be adapted for that hardware. These manufacturers just decided that they had no desire to f**k over the consumer by locking them into custom-made firmware. For example, I believe Turris https://www.turris.com/ https://www.turris.com/ takes a stock, latest copy of OpenWRT and makes a few tweaks to extend its capabilities for additional, server-like features.

adamc 2y ago

I dislike the pattern where we have to hook into their cloud.