Netgear Firmware Requires Online Registration | Hacker News Reader

Netgear Firmware Requires Online Registration

kb.netgear.com

255 pointslgats185 comments

I recently bought a couple of Netgear Managed Switches (for Business)⁰ and in their datasheet they list "Local-only management" as a feature. Only after they arrived we discovered that you only get limited functionality in the Local-only management mode, you have to register the switches to your Netgear Cloud account to get access to the full functionality.

Reading up on it, this was achieved only after a community outcry because in the prior firmware versions the switch would have to connect to the Netgear Cloud on every bootup.

Needless to say I would not have bought the swiches if I had knew I needed to register them to Netgear Cloud to have access to the full functionality specified in the data sheet. If I had bought them as a consumer, not as a business, I would have returned them immediately.

Netgear are now on our purchasing blacklist.

⓪ - the switches are Netgear GS-108Tv3

I ran into a similar issue with a Linksys consumer router. Needless to say, that was back in the box and to the retailer in a new york minute.

I ended up going with Ubiquiti equipment for now, since it was available locally. Much more expensive and complicated but Linksys convinced me it was worth any cost to get the hell away from them. But I will definitely be looking into the Turris Omnia, pfSense devices, and maybe even reusing my current Ubiquiti AP with OpenWRT, next time I need to muck with networking.

Which is why I really really want Apple to come back to the Router Market.

I miss my Airport Extreme.

I’ve still got mine. I should replace it with something newer, but I’m not sure what, if anything, is safe and secure.

That was how I replaced mine, I wanted something new to play around with. Turns out it wasn't much fun...... For now I will wait for WiFi 6E from Ubnt.

Doesn't Ubiquiti require online registration, too? It was the first thing I had to do to set up my Unifi AP.

Ubiquiti does not require registration by default but it does collect and uploads data by default.

This is configuring the AP via CloudKey. Don’t know about other methods.

I set up my own controller. No such issue.

I ended up going with Ubiquiti equipment for now, since it was available locally.

Sadly, even Ubiquiti gear has recently been criticised for doing the built-in phone home thing.

It can be tuned off, iirc...

I'm a bit out of the loop on Ubiquiti, but IIRC they pushed out an update where telemetry was not optional, and then after the backlash they may have pushed out another one with slightly more configurability.

If you buy professional gear from an organisation that would think that was acceptable in the first place, you might want to re-evaluate your preferred suppliers anyway.

I was looking for small business switches recently and I noticed the trend across all brands to push hard for cloud management (aka your device is a brick when we get tired of supporting our cloud platform).

I ended up with a local-only tp-link JetStream.

Well, the industry has been wondering for a while whether white box hardware and SDN will be the way of the future. So far, even at higher prices, the traditional model of having a reseller as point of contact and your gear made by well-known brands with big support contracts has held up quite well. This has been, at least in part, due to less than perfect software for the SDN aspect. I wonder whether this increasing trend to lock everything to the cloud services when it's clearly not necessary for the core function of the product will be a catalyst for more networks -- particularly smaller ones that don't have huge enterprise support contracts in place anyway -- to consider the alternatives again.

We buy the same type of switches (and some larger/faster ones) from Netgear since a few years.

The problem is: The old version (v2) is locally managed only, whereas the new version (v3) is with cloud management:

https://www.netgear.com/business/products/switches/smart/GS1...

Maybe you looked into the datasheet of the old v2? And then got delivered the new v3?

We stumbled over the same problem a few month ago, after buying a bunch of these in the new version. I thought: Newer is better... But apparently not so with Netgear products. :-(

Very confusing, what Netgear does with their product naming!

> Maybe you looked into the datasheet of the old v2? And then got delivered the new v3?

We did not. We specifically chose the v3 version for its lower latency in switching packets and other features unrelated to cloud management.

As someone who buys a router/switch/dongle once a decade and doesn’t follow the networking meta, who do you buy from?

Tp-link and Microtik.

Ubiquity and mikrotik for the personal / smb stuff.

I love Mikrotik/RouterBOARD gear but I would not recommend it to someone who hardly uses any networking equipment. The interface is far from straightforward and new users mostly get overwhelmed by the functionality they offer.

One plus-side for them logging into Netgears cloud when they boot up - IF they get stolen. In that instance, would Netgear be able to assist in there recovery and law enforcement?

Certainly would add to the old saying "every cloud has a silver lining".

This is assuming Netgear cares

Does anyone really steal routers and switches...? They are basically cheap as dirt or even hidden away in walls, and there is typically much better gear available during a break-in.

Am I the only one who feels like this is a huge industry espionage risk? Especially if the cloud is in China?

>If I had bought them as a consumer, not as a business, I would have returned them immediately.

Why would you not send them back as a business?

Consumer protection laws do not apply to businesses.

> You can login and access all features through the local browser UI 3 times without registering the switch through your netgear.com account.

How generous, for a device that people buy (not rent) from them, and pay actual money for (not receive for free).

And apparently Netgear didn't even feel the need to bother including any contrived excuse as to why this is being introduced. What a time to be alive.

The money is in managed services.

Unless you use some cloud offering they have, there is no need for “managed services”.

Buy router, plug it in, change password and rarely any setting required for average user.

Not worth the monthly fees and data collection on users (name, email, location, credit card,...)

All low end proprietary network gear is going managed by cloud. Ubiquiti on the soho side and now consumer.

Open source is the only equipment you can trust to not adopt this model as it’s much more profitable than shipping a box once every five years.

It's optional with Ubiquiti.

... but the telemetry isn't, IIRC.

Is it not? I disabled diagnostic and analytics reporting, though it does occasionally ask me to turn it back on.

Is there additional telemetry that cannot be disabled?

When they pushed the firmware, iirc the telemetry was done without notice, opted in and enabled by default, and there was no way to actually opt out until _another firmware update after the uproar_

Ubiquiti has never cared about security, if they did they wouldn't have been scammed for $40,000,000 via a literal scam email.

If Ubiquiti staff has the non-existent procedures and corporate security for this to happen, they surely don't care about your privacy or security.

So what is the alternative nowadays?

They didn't scammed, they washed some of the investors money. These kind of attacks are ridiculously hard to believe.

Got it! Thank you for that context. I'm pretty sporadic about updates so I more than likely missed the gap when it was enabled by default and not available to be disabled.

Not cool to do that :(.

I'd argue the continued "ask you to turn it on" just in the hopes that you might eventually do it to shut it up is also a terrible antipattern.

I believe it's no longer optional on the new UDM and UDM Pro devices

Netgear isn't (wasn't?) really low-end though. At least not priced as such. One would think they'd be making enough without having to resort to such tactics.

You're right Ubiquiti did it though and I believe their devices are priced even higher. (Edit: note the post next to mine says you can opt out of this.)

I agree replacing the stock firmware with an open-source aftermarket one like OpenWRT is the way to go but there's still the moral dilemma of supporting such practices with your wallet.

I was also thinking if this could be an attempt to thwart the second-hand market for their devices? Is the binding to the online account permanent, or maybe it requires unbinding the previous account first?

You can get a $20-40 Netgear router at Walmart.

It's unfortunate that Ubiquiti is forcing telemetry on users. Having everything integrate into UniFi Controller is pretty neat. Like enough so that if I didn't already have an APU2 running pfSense, I'd very likely buy a UDM Pro despite it being immense overkill.

I would posit that MikroTik is so far not doing this insanity, and price-wise is not far off from NetGear.

Nor DrayTek, AFAIK. And those are the two brands that I consistently see recommended for SOHO network gear these days. They don't have the flashy UI of something like Ubiquiti, so you do have to know what you're doing to set them up, but they seem to make reliable hardware and solid firmware.

Why can't we have network equipment that's designed from the ground up to run open source router firmwares? When my ISP gives me new networking hardware, the first thing I do is look for ways to flash new firmware on it or put it into bridge mode.

There's librerouter actually, but Is more intended for mesh network scenarios.

https://librerouter.org/

How handy, that should be plenty of logins to install Fresh Tomato on the router.

I used Tomato until around 2010 where I switched to dd-wrt, then around 2014 went with openwrt and haven't really followed Tomato in the last 10 years.

I wouldn't mind going back to where I started and using Tomato again, so I was curious what major thing(s) they've done in the last 10 years and why you would chose Tomato over dd-wrt or openwrt.

> why you would chose Tomato over dd-wrt or openwrt

As far as I know the choice is constrained by the SoC in the device you have (or are planning to get): generally, Tomato has better support for Broadcom devices, and OpenWRT works better on Atheros. DD-WRT should be more balanced in this aspect. (And predictably, open-source support for MediaTek devices is the most patchy.)

I haven't really used Tomato. Between DD-WRT and OpenWRT, the former is arguably easier to set up (through the GUI), while the latter can offer more functionality (with no hardcoded settings and a huge repository of installable packages). OpenWRT has higher memory and storage requirements though.

I use Tomato because it seems to have the best support for the Netgear routers I've owned. Not much has changed in the way that I use it, other than the GUI has been updated. Fresh Tomato is the only fork that gets updated anymore, and it is mostly bug-fixes and updating the various Linux packages, not new features.

This is becoming the dark-pattern-du-jour.

I get this with videoconferencing too (webex, teams), where the app starts downloading and the ability to do what you want (use the browser) is hidden or delayed until you've failed.

If you mean dark as in Darth Vader choke grip dark, and not dark as in subtle under the radar manipulation dark pattern, then yes.

I realise HN isn't known for its sense of humour, but if this trend doesn't justify an analogy about being in a cloud city, setting a trap, someone altering a deal, and praying it isn't altered any further, I don't know what does.

I noticed that too. A few weeks ago, clicking on a Zoom link in your browser would trigger an automatic download of the app installer (which I don’t want). The webpage would still display an “or launch in the browser” link. But yesterday I noticed the link was gone, thinking the only option was to install the app (which I still don’t want). But it turns out the browser link appears after a 5-second delay.

I wonder how many people installed the app thinking it was the only option now. I assume a lot of people. Or how to increase your install numbers with that one weird trick.

Very sneaky.

I didn’t know there was a web mode. I’ve been using my iPad for zoom, because it’s the only way I could think of to sandbox it.

I have found the Windows 10 Sandbox feature quite useful to deal with the random teleconferencing software. It fires up an empty Windows 10 HyperV VM in a few seconds, audio is passed through both ways. After the session is finished, close the VM and everything is gone.

I wonder how long until this gets hacked, and someone releases a cracked firmware with this idiocy removed. Clearly, the functionality is already there if it can be accessed "3 times".

This is the dark side of the "update culture" --- forcing you to take all the things you don't want along with the bug fixes. Aided by dire security warnings of not updating, it's a perfect way to achieve control over your userbase.

You can probably install tomato, ddwrt, or openwrt.

Until they lock down the bootloaders...

I have serious doubts. Having worked with switch ASIC vendors before (Marvell, Broadcom), they require you to sign a mile long NDA before you can even access datasheets.

If you can get the switch vendor to release a GPL archive (which is often a struggle in of itself) I have never seen them release the source code to manage the switch ASIC. That's always built as an out-of-tree module which is not released as part of the GPL archive.

Many switches are not even running Linux, it's quite typical to see eCos, VxWorks, or an RTOS (e.g. ThreadX) on a switch.

tl;dr - even if the switch runs Linux (many don't), it is very unlikely you will have the datasheet and/or reference implementation for managing the switch ASIC

More likely there to be a security breach at Netgear & similar companies within next 2-5years. Of course the registered data would be exposed and downloaded.

What is the benefit/incentive for Netgear? Why are they pulling such a move?

https://en.wikipedia.org/wiki/Surveillance_capitalism

Isn't it more likely that's it's a push to more lucrative subscription services?

Could you clarify what you're claiming here? The obvious interpretation seems far fetched.

Seems like both that as well as a way to ramp into SAS subscription nonsense. Who would have thought that despicable model would make its escape from B2B into the retail market...

My new clothes washer has an app.

It requires access to location, and phone settings or the app closes by design.

I don't think this stuff stops without legislation.

What brand? So I know what to avoid in the future.

That's really disappointing as LG has been my go to brand for many of my appliance purchases including a washer and dryer a few years ago.

It's the same with LG TVs. The remote app on iOS for my 2018 LG OLED TV does not launch without granting it location access. I don't understand why a TV remote app would ever need location access?

Yesterday, the app refused to even start up until I updated it to the latest version.

I thought apple didn't allow that.

Don't bring up a BLE packet sniffer around a LG soundbar, it's spamming about 10 UUID packets per second. Pretty annoying.

Do you HAVE to use the app to use the machine though? Can you just not enable wifi on itand use it like a dumb washer?

The washer absolutely works without the app.

The app provides some benefits, but they're not required.

I'm assuming it uses Bluetooth, if thats the case location access is required by Android to search for Bluetooth devices because Bluetooth devices don't move around very much and its possible to get your location if the app has access to a Bluetooth location database.

And on top of that I guarantee they'd start sending lawyers if you hack your own device.

I don't think that one could say that is acceptable under the App store review guidelines if that was for iOS.

You can't legislate morals. Don't depend on the government to solve your problems, vote with your wallet.

You can't legislate morals, but you can successfully legislate many consumer-hostile practices out of existence. Germany was pretty successful when it came to many dark patterns trying to trick consumers into "agreeing" to "contracts".

Dark patterns were successful, or the preventing legislation was successful?

The preventing legislation was successful.

All those "* by using this free trial you agree to pay 19.99/month for at least 24 months" scams went away basically overnight.

The key to this is not to be afraid to aggressively add new dark patterns to the list of banned practices.

An alternative would be aggressively hitting scammers who clearly rely on people missing the fine print with criminal charges for fraud/extortion (when they try to collect on the non-contracts). No idea why that wasn't done - the legal system is usually a lot more resistant to the "well, TECHNICALLY" thing than engineers think.

Germany is really good about these rules. For example, a long list of practices, including mandatory arbitration, is explicitly forbidden (or forbidden in standard contracts) in § 308-309 BGB. § 312j BGB mandates clear disclosure that and what you're about to spend money on. The whole set of § 312-someletter is basically "we found another shitty practice and we're ending it now".

I find europe more enlightened than the US when it comes to privacy, but I can't help but think things like the GDPR wouldn't have gone through if the companies doing it were domestic.

The US doesn't care at all, until it's huawei.

Just a law, not morality.

You can absolutely legislate morals, and a lot of laws are exactly that: codified morals.

Many Bluetooth actions are tied to the location permission on Android, because you can use Bluetooth to locate the user through beacons.

The downside of this is that you can' distinguish between apps that just want to use Bluetooth, and apps that are trying to get your device location through location services, and users are trained that "bluetooth app = location permission is legit".

Things like this are why I buy "dumb" equipment, which will remain obedient to you and not the manufacturer. My white goods are all many decades old. Washer and dryer are both entirely computer-free (mechanical controls) and don't even contain a single semiconductor (unless you count the indicator bulbs I replaced with LEDs.)

Many people often think the house/life of a software developer is filled with "smart" things, and are astounded when they hear what I use. Maybe the younger ones are indeed surrounding themselves with this sort of predatory "smartness" and couldn't care less about the downsides, but not everyone in the industry thinks that way; sadly, I think those who don't want this crap are a dying breed.

Same here. I try to buy appliances as dumb as possible. I know how fast software is being deprecated and my washing machine, fridge etc. are supposed to work for decades, not months.

Out of all the terrible trends in technology today, I’m convinced that “unnecessary cloud-tethering” is the absolute worst. I should not need to sign in and get permission from the device manufacturer to use or configure a device or software I supposedly bought. I should not need you as an intermediary when I’m using it. I should not need to give you analytics on how I’m using it. You should not even know I’m using it! I don’t want an ongoing relationship with your company. Our relationship ends when I swipe my credit card.

It getting harder and harder to avoid this trash too. I fear it will be normal one day.

Out of all the terrible trends in technology today, I’m convinced that “unnecessary cloud-tethering” is the absolute worst.

Yes. If not only because "cloud" services typically live for only a few years. Then the device is useless.

There should be a warning on the box that you need internet for this to work or enable it. I guess we should talk to the lawmakers at the EU (or wherever you live) to make this stop.

Damn, that's impressive. Sadly I've yet to see an old non-electronic washer or dryer still work. Just about everything is simply worn out, even the hoses crack and crumble. But they did last a long time compared to new stuff.

Tbh, there's nothing wrong with electronics, "smart" doesn't mean it needs an Internet connection.

even the hoses crack and crumble

Those are wear items, just like seals, and would definitely need to be replaced at regular intervals. Replacements are cheap and plentiful.

Tbh, there's nothing wrong with electronics, "smart" doesn't mean it needs an Internet connection

Electronics are more difficult to troubleshoot and specialised parts often become unavailable/rare quickly. I can do and have done component-level repair, but still prefer not to.

I live with my girlfriend here, and my router lists 14 devices connected to it, from phone and laptops to TV and Google home to one monstrosity of an IR blaster due to lack of "smartness" of the A/C. Some stuff are even programmed with IFTTT, some with NFC tags tapped by either of our phones, and many devices listen to magic packets on LAN.

I enjoy the convenience of being able to control pretty much everything from bed, with just voice, but I can't get rid of the dystopian feeling that I'm just a "user" of it, but not in control of it.

I buy "smarter" devices. Washing machines with better energy saving features. But I'll never buy "smart" appliances that require an internet connection.

My fridge just needs to keep my food cool. and I don't need to brew a cup of coffee from the bedroom.

There is the old joke along the lines of:

Tech enthusiast: Everything in my house is smart.

Tech workers: The most smart device in my house is a printer and I keep a gun next to it in case it makes a weird noise.

They have to check your location to make sure the drum only spins at RPMs that are legal in your country...

On the other hand, a new firmware for my recent Brother printer added a bunch of cloud-based features that are pretty cool (scan to dropbox, etc). When done well, this sort of thing is great.

> I don’t think this stuff stops without legislation

I agree, but sadly I expect it would quickly boil down to “click OK to waive all your rights, which you really want in order to make the device actually do what you bought it for”.

I think any network connectivity related to high-power (2000W or more) household appliances is a big mistake.

Imagine someone hacks their flimsy IoT service and manages to start those 3kW heater elements in hundreds of thousands of washing machines all at once, what that will do to the power grid.

That switch is based on a Realtek RTL838x/RTL839x SoC. An effort is currently underway to properly support these in openWRT and the mainline Linux kernel. First patch in OpenWRT is in:

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=df...

These SoCs are used in a lot of consumer-level switches, so it's a target-rich environment! We're populating a wiki to keep track of it all, feel free to join in if you can help:

https://biot.com/switches/

Nice! This is exciting as I own an early GS110TPv3. Would a very early firmware image help you in any with this effort (v1.0.0.4)? My switch is booted into a more recent firmware version now (7.x.x.x) but if I recall, the cloud features were not present in 1.0.0.4.

Not really, the firmware is what we aim to replace. But if you want your device supported, you can pitch in. Post description/pics in the wiki, help test code, etc.

I was gonna buy a new DOCSIS 3.1 netgear modem for my gigabit service. Guess I won't be doing that now. I'm tired of this type of bullshit.

It's exactly why I'm leaning really heavily towards Mikrotik for all of my networking gear at home. These types of devices are user hostile, bad for the environment, and set a precedent for a type of world we shouldn't want to live in.

I am also in the market for a docsis 3.1 modem. What are you going for?

Well, I'm running a SB6190 right now. I guess I'm going to go with either an SB8200 or a motorolla MB8600.

One thing I like about the SB8200 is that if I ever go back to running a "business" connection at home I can have a second IP assigned to the second WAN port it has.

I also plan on modifying the modem to fit into my network rack without a shelf like so: https://www.reddit.com/r/homelab/comments/ft579e/finally_got...

So the actual internal matter a little bit to me as well.

Be aware the SB8200 runs a Puma chipset. For all I know modern versions of this chipset on modems are OK now, but I have a headache that will probably never going away trying to work around latency and DOS issues with one of these in a situation where I couldn't change out the DOCSIS modem for reasons that were out of my control.

It's in my "never touch again for any reason" bucket now as a result.

Incorrect, the SB8200 has a Broadcom BCM3390: http://en.techinfodepot.shoutwiki.com/wiki/Arris_SB8200

There's really no better choice than Arris SURFboard if you want a DOCSIS bridge that just sits there and works all the time.

Yea, that's what I'm leaning toward at the moment. I already have a Cisco 2921 router and cisco switches in various places throughout my house.

So something dumb and performant is what I want. What I liked about the netgear modems is they do have models with a router built in without it being wifi which I would like to use as a failover. But I'll just keep my 2921 around as a failover if my new mikrotik router fails for some reason.

LOL. NO.

Arris (formerly Motorola) modems have a overheating reliability issue. Especially the Surfboard ones you like. SB6666

Go search online. You'll see.

I've had a number of them do this, and so I avoid their stuff.

This is true, they definitely do have an overheating issue. That's why I was looking at other modems aside from upgrading my service.

But I do plan on modding mine so it's not something I specifically would run into.

Anecdotally my Arris SURFboard units have just sat in the dark and served perfectly, except that I had to replace one to get higher DOCSIS speeds. Maybe the overheating has something to do with local cable plant conditions from which I don't suffer?

The Arris box I currently have is a PITA to use. It takes several seconds to navigate between pages and its extremely illogical. I was just going to see if I can flash it with Openwrt or dd-wrt because it's just unusable.

I don't know if you realise it or not but "PITA" is almost the perfect expression to use for networking equipment by the name of "Arris":

" Jonathon Green, a British slang lexicographer who authored The Vulgar Tongue: Green's History of Slang, told me that his favorite rhyming slang word is "arris," which means ass, because it actually goes through more than one round of partially-dropped rhyming. "Arris," he said, is short for "Aristotle," which rhymes with "bottle," which itself is the first half of the phrase "bottles and glass," which rhymes with "ass." So in rhyming slang, "I'll put my foot up your arris" means "I'll put my foot up your ass" "

from https://www.vox.com/2015/2/16/8045999/cockney-rhyming-slang-...

Since he's British it should be "which rhymes with "arse", glass only rhymes with ass in the north of England and beyond, and even there they'd prefer arse over ass (a turn of phrase I hope to never use or see again!)

Can't get the journalists nowadays.

Ha yeah I suspect he's aware of the pronunciation differences but kept it that way for simplicity's sake.

Also I'm so sorry but "arse over ass" made me laugh and has kinda imprinted on me, so I'm gonna remember whenever I see "brigandish" in HN comments :-D

I was referring to the cable bridges, not the ones that have wifi and all that. For example the SB6183. I don't think it's smart to get integrated cable+wifi because the wifi stuff evolves very rapidly and the cable stuff evolves hardly ever.

I use mikrotik switches and run openwrt on them. rb2011 series and one rb750gl.

Razer has done something similar with their peripherals. I remember buying a Razer keyboard that I later realized required an online account and some Synapse software to configure in any meaningful way. Quickest return I ever made. Razer's privacy policy is dicey and then there's this[0] which inspires loads of confidence.

[0]: https://www.pcmag.com/news/razer-accidentally-exposed-custom...

Razer Synapse has removed that requirement now, you can use local guest account without registering.

Such a relief really to use Linux, the hardware just works out of the box. Or in theory could also be it doesn't work at all since there won't be downloadable drivers, but in practice all my peripherals have worked great.

If you didn’t know, there are open source drivers for many Razer peripherals that let you control things like colors and macros: https://openrazer.github.io/

The Synapse software is absolute trash.

I've used Logitech mice since forever, but their quality has taken a nose dive, so I bought a Razor Deathadder. Because everyone markets their products towards 13 year-olds, it's called "Deathadder" and it's stuffed full of RGB LEDs. To disable the LEDs, you must install the Synapse software which is Electron trash, because nobody writes real software any more. And you have to KEEP this software installed, to keep the LEDs off. If you uninstall it, the LEDs come right back on.

So I did what anyone would do: I took a screwdriver and a sidecutter, ripped out the leds and threw them in the trash.

Landfills will welcome the load of Netgear hardware that cannot be sold as used anymore, although perfectly working, because of this nonsense.

Which is exactly the intended effect. Non transferable -> more sales, they reason. See also Microsoft and Sony’s latest console releases.

Nah. The majority of owners are not HN types. They don’t even know what firmware is, or why you should update it or how.

(ITT: Plenty of comments from folks who clearly didn't bother to RTFA.)

This appears to be for one specific product, a "smart cloud switch" [0] (which comes with a "1-Year Insight Subscription").

I don't see anything to indicate that the product registration requirement applies to any of their other products.

I bought one of their 108 series managed switches, and "managed switch" always meant a management interface, vs an unmanaged switch. So there could be confusion.

The firmware says you can't access the local browser UI. Insight management is for the online management UI. Even if you don't pay for insight, you should be able to access your switch locally without needing Netgear's permission.

According the the relevant Netgear Knowledge Base article[0], config file uploads and downloads are supported without registration.

I'd expect (I do not own one of these devices) that configuration without restriction can be done by uploading a modified config file.

Perhaps someone who owns a NETGEAR Smart Managed Pro Switch could chime in to confirm or refute that.

[0] https://kb.netgear.com/000061174

I had a Nighthawk router of some persuasion that was so infuriatingly buggy it took years off my life. A bad router is so maddening that the curse "may your brakes work as well as your firmware" repeatedly came to mind.

Never again.

Only buy something that works with OpenWRT. Or at least has hardware that is compatible so you can make your own build or have someone else do it. And contribute to the project, if you can.

I'm still on a now ancient TP-Link router, it works absolutely flawlessly with all the features one might need.

I know newer routers can be faster on stock firmware because of proprietary stuff, but fuck that, if I need Gigabit, I'll use wires. WiFi N speeds are good enough for me.

Which one? My R7000 works perfectly fine, since years.

That's the exact one, actually. It would constantly go into a sort of "soft crash" mode where it would continue to run as a wifi router but with more dropped packets and the web interface was inaccessible. It was a nightmare.

I assume I just got a dud, but what a dud. It was such a gradual downward slide into being unusable that it was beyond warranty when I finally figured out it was unsalvageable.

The worst kind of failure mode, hope you lit it on fire or something.

Netgear doesn't even care that the "ReadySHARE" almost all their routers are marketed with, is broken: https://community.netgear.com/t5/Idea-Exchange-For-Home/Read...

Why would I ever want to enable SMB 1.0 (security issues, deprecated) on my R8000. And even then, shares require admin credentials.

IMO this is refund material.

> IMO this is refund material.

It's also the kind of thing EU regulators pick up on.

Recently I found an old TP-Link wall-plug WiFi extender which defaults to a .com domain name for configuration.

All is fine when you don't have internet access, but once you configured it, you'll find out that TP-Link lost access to the config-bound domain and now it's a website full of malware and the config keeps redirecting you there.

And they're still selling these (hopefully with updated firmware)

wow, thats kinda horrifying. I wonder how they even let that slip

Just another reason why I hate Netgear products. Had a wireless G card that worked perfectly fine with XP and when Vista came put it had no driver support even though it was product that wasn't discontinued.

I think I had the same one. Seriously, it feels like networking hardware is the armpit of the industry. A place where "approximately functional as long as you reboot it weekly and don't use any of its advertised features" appears to be considered good enough by their QA.

LOL @bug fixes:

"Default IP route configuration disappears after reset"

Literally the device's bread and butter and it fails that. Not sure I care about its management interface after reading that.

Soon you will not be able to use a switch on a private network not connected to the internet thanks to these assholes...

No more Netgear device for me!

I wonder how hard it is to build your own switch these days? Maybe something built around a Pi class SBC?

If you don't care about performance, any computer can bridge multiple interfaces in software and behave like a switch.

15 years ago all of the better switches could internally handle the aggregate bandwidth of all of their ports. I assumed that would be standard now, but shopping for a switch recently I discovered I was wrong. We still have switches where you can’t max out all ports at the same time.

I think you could still make one that doesn’t have that problem, but the memory would limit doing much smart switch work. If any.

Building a switch is (relatively) easy. Building a switch that can offer acceptable performance in a box with enough ports on it to be useful is harder.

It's not immediately obvious what advantage you'd gain by doing that anyway, since you can just buy a white box switch and run your own software on it.

There are chips out there already, aren't there? I think the Turing Pi board has a switch built into it (and an ethernet chip per slot, which is maybe not so good)

There are chips out there already, aren't there?

Yes, those are what you'd expect to find in the white box systems I mentioned, and most branded off-the-shelf switch products for that matter. But if that's what you need, I'm not sure what the advantage is to building your own hardware instead of buying one of the ready-made options. It seems like you'd need to have quite eccentric requirements before it was worth seriously considering designing and building a whole system of your own instead.

I wonder what could serve as the replacement for Netgear switches. I have a couple GS108s at home and thought to buy a couple more. After such news I don’t want to even come close to NG, but from possible alternatives I’m familiar only with Linksys which are not an option really. What are other brands to consider?

I've got a managed Zyxel switch at home. Not exactly a challenging setup, 4 vlans and that's it, but apart from a known firmware bug with multicast when I first bought it, with an update already available, there have been no issues at all. Would buy again.

This is insanity. Stuff like this just seems to get worse every year smh.

In the market for a new home router. Keen to avoid such stupidity. Can anyone recommend a modern, powerful router that supports dd/openwrt?

GL.inet is a brand I've been a fan of for a while: https://www.gl-inet.com/

They have a range of personal/SOHO routers that all run officially-supported-by-manufacturer OpenWRT, and their own UI skin isn't bad (though easy to switch to LuCI if you want)

Reading through their support forums is what sold me on them - their firmware engineers actually pay attention to issues, engage in threads, and respond with patched firmwares.

This looks like the manufacturer I've been looking for, bookmarked for future purchases.

Can anyone recommend a good router that's good for putting openWRT on and isn't so user-hostile?

in related news Cottonelle and Quilted Northern now require registration before use.

Charmin declined to comment.

When I first encountered netgear hardware, it ran far hotter than any other equipment. When I had a five port switch that was so hot I could nearly burn myself touching it, I stopped buying their gear.

Are they still the laggard in this respect, or have they gotten better?

Wow jeeze. This is such a different & bad look from the netgear I know. This is hard to see.

Netgear has been one of the main companies to go to if you care about using your hardware. They have had a spirited MyOpenRouter community[1] for their systems, with great firmwares & flexibile package-add-ons developed with assistance from their solid-gold readily-reproduceable GPL releases[2].

I just had a somewhat overlong thread about Broadcom chipset routers having headed towards being impervious & useless, resistant to any experimentation, & bereft of open source firmwares[3], & a general trend in wifi of routers getting less & less general purpose & user-centric hardware, under increasingly consumeristic teiring[3]. While hardware alternatives vanish. This news doesn't mean Netgear is going to go totally darkside & cut off the amazing innovation they've let grow under them, but it sure is frightening that it could be part of that wider scary course into darkness & ignorance that wifi seems to be heading down.

Own the means of production. Own the means of communication. Do not stop short, do not accept less.

[1] https://www.myopenrouter.com/forum

[2] https://kb.netgear.com/2649/NETGEAR-Open-Source-Code-for-Pro...

[3] https://news.ycombinator.com/item?id=24521265

Edit: hopefully much ado about nothing; seems this change only applies to their cloud ️ services

> It appears the registration is only required for "cloud" features managed through Netgear's subscription service.

https://news.ycombinator.com/item?id=24530009

From the article:

> product registration is required to unlock full access to the local browser UI.

Emphasis mine.

I can upload the firmware image v1.0.0.4 from my GS110TPv3 dated 2018-10-04 if anyone is interested... I don't think the cloud features were enabled on this one.

Yes, please.

Maybe if the US wants to get serious (or at least effective) about security, we need ridiculousness like this to be regulated/outlawed.

I'd recommend OPNSense and miniPC with a few LAN ports from aliexpress for both, home and SME.

thanks for the heads up. I guess it's tp-link for cheap wifi routers then

Fortunately this does appear to be specific to managed switches which are sold as having cloud management functionality. I don't think you have to worry about their normal routers having this restriction.

Why no backlash for iOS and Android? We have to register to use the devices.

You dont have to register for ios and android. For sure not with you real data. Anonymous email suffices. And you do get services by both platforms for free included in your purchase. Push notifications, automatic updates, free messaging and not to speak about tons of free apps to use.

I don't think that is correct. What sort of registration are you thinking of?

I believe you no longer have to register your ios device - but it is a dark pattern. On the screen to enter your apple id, you don't have a "skip" choice, you have to say "don't have one" and I believe then you can skip setting up an apple id.

You can use it like a phone at that point - you can send text messages and make calls, but I don't believe you can install any apps.

That said - you must go online - turn on cellular data or wifi before you can use the phone, it must be "activated". And apple phones home a lot.

And apple phones home a lot.

I see this sort of claim often, but reliable information about the specifics is hard to come by. Can you share any?

On a mac run little snitch. On a current ios iphone, I'm uncertain but i run an older version of ios with adblockios.

It contacts a whole slew of apple and 3rd party sites. the main one is that it contacts *.ls.apple.com all the time (location services) even with location services turned off. lots of other apple sites. third party is akamai all the time, but also sites like phicdn.net and att.net (I have an at&t iphone). I do not have any at&t app installed.

on macos catalina, you can (currently still) run little snitch and all kinds of services start contacting apple. and new ones have shown up like touristd and rapportd. Every time you try to pull up a help page. Every account you configure, apple based or not. sigh.

I wonder whether the ls.apple.com servers are connected with security features like "Find my iPhone". But then, I'm not sure exactly what Find my iPhone does if it's turned on but location services are disabled.

I'm an embedded systems student and this makes me sad and angry.

I worked with software update mechanisms and they are an essential part of every IoT product. They are needed to supply the product with security updates and consumers should be trained to allow for automatic updates as maintaining 20 devices is not something your average user will do manually. Or at least to install updates when they come along.

This just fucks the consumer as it includes a massive inconvenience. What's going to happen? They won't install the update as they don't want shit forced down their throat. But the bad taste stays, and instead of installing a risky update on other devices or investing the time researching, the consumers will just keep them at the current software state.

Thanks Netgear for fucking a whole industry.

Is that device sold in the EU? What about GDPR? Well, it seems to be a switch and private households are less likely to run a switch. But still some people might. So will the device still work after you ask them to delete your data?

For a company on the other hand you might want to have secure systems not connected to the Internet at any time.

Reminds me of years ago, when Microsoft started forcing players to be online when playing on xbox...which was minutes before I decided I would never need an xbox :)

didn't they backpeddle on that? https://www.cnet.com/news/microsoft-pulls-a-180-reverses-xbo...

Even if they did, deciding to do it in the first place tells you something important about them. For some people, that said "do not ever trust these evil fuckers, they'll sell you out whenever they can do so without too much public backlash..." This it the tech industry version of politicians dropping bad news as 4:59pm on a Friday.

They did, but that only came after a huge backlash by gamers.

In my case, I perceived this as a signal that Microsoft was interested in monetizing my data when playing video games (e.g. schedule, hours spent, progression, overall cognitive capabilities, etc.) to third parties that will use this data without my informed consent (not to be confused with the consent given to Microsoft to "share with partners").

I still find this totally unacceptable today.

This mentioned product is marked as "GC108P — Insight Managed 8-port Gigabit Ethernet PoE+ Smart Cloud Switch with FlexPoE Power".

So, what is the problem? You got, what you payed for. ;-)

If you want to have a product with local management, then buy another one without "Insight" capabilities, e.g. one of the "Standalone Smart managed Pro" line:

https://www.netgear.com/business/products/switches/smart/sta...

It appears the registration is only required for "cloud" features managed through Netgear's subscription service. Here's what's possible without the cloud service:

https://kb.netgear.com/000061174/What-features-of-my-NETGEAR...

And here are the features of the cloud service:

https://kb.netgear.com/000044342/What-can-I-do-with-Insight

In this case, it doesn't seem that bad. Limited to remote monitoring and management features but I wouldn't want that anyway.

It's not true. If you want to use all the features on my POE Netgear switch, you have to online register and use a code to unlock full access to local mode.

There's no cloud features involved. You have to register online just to use all the features of the switch locally.

Seems this applies to certain categories of devices [1] and then it's $5/yr for the Basic "Insight" plan (mobile app only) [2] or either $1/mo or $10/yr [3] for the "Premium" one (access via web browser as well and some additional features). First 2 devices are free.

From what I'm reading, it seems like you're required to register some devices or their functionality will be reduced, and then if the device can also be managed through the cloud interface (regardless of whether you actually want to be managing it that way), it will count against the free device limit (as long as you register it under the same account).

However, it also looks like these products were advertised as such from the start. I previously thought that this was forced upon the users through a firmware update.

1. https://kb.netgear.com/000048452/What-devices-can-I-discover...

2. https://kb.netgear.com/000053256/What-Insight-subscription-p...

3. https://kb.netgear.com/000053255/What-countries-and-currenci...

The very first bullet says that it's for the the local UI... Your first link predates this change as evidenced by the last updated date of 2019-08-22.

Reply on news.ycombinator.com