Waste of everyone's time and money.
This whole thing pisses me off. A insider threatened a company with reputational damage and used a press guy to pull it up. HN picked it up and amplified it. Press guy never corrected the story, and the here we are - with people still railing on HN for a untrue story that the press guy enable that the extortionist planted.
Ubiquiti did not have good security policy as stated in the hacker news post from 3 months ago (cred open to many people etc).
While it’s impossible to completely prevent this, best practices were not followed.
Krebs does tend to just throw stuff on the wall. Conversely, people should not be so influenced by one security blogger.
If you're Brian Krebs and are writing, editing and publishing this stuff yourself, I don't know that you'd have the bandwidth to be able to monitor and correct every new development in something you've written. The New Yorker has a staff of hundreds of fact checkers, lawyers and proof readers just to keep them out of court, and they too seem to have a difficult time with publishing corrections.
I'm not excusing either party, there are issues here that need to be resolved. But the expectation that any part of the press, be it publishing a physical newspaper or running a security blog, will spend much time paying attention to old stories for corrections doesn't match up with reality.
It arguably started when they:
- Shipped tons of jobs overseas, and firmware quality took a noise-dive.
- Stopped letting people run the NVR on their own hardware (with short-notice).
- Required cloud login and an app for setup (something that, for years, NOT having was a claimed Unifi advantage).
- Constantly introducing and retiring half-baked ideas/products/lines.
The whole company has lost focus and certainly lost quality. The recent security kerfuffle certainly didn't help, but mostly it reminded people that their previously "local only" stuff was now Cloud Connected™ by force, and that UB lost the keys that users didn't want to exist to begin with.
- Got acquired by Cisco.
Heaven help us.
The price here is almost the same as the Lite series of Unifi. They also have a Meraki go line but that seems to be yet another one (from an acquisition). But this is also in the same price range.
But the nail in the coffin was their reaction to the whole thing with lawsuits and denials.
- Ads in the management interface
I get it. Telemetry helps with diagnosing issues. But UI’s reaction to being unmasked made me realize they could never, ever be trusted for network infrastructure.
Forcing everything to cloud-connected is what turned me off.
I don't need the devices I use to connect to the cloud to be dependent on the cloud.
Mostly from how the company has shifted their focus as described in other posts.
Then around a year later an update bricked 4 of my 5 cameras, and support was completely useless.
You know, and then they had this huge security issue.
Sure, Krebs reported the security issue, but "ubiquiti sucks" sentiment has largely been Ubiquiti's doing IMHO.
This entire fiasco has hurt Ubiquiti’s brand and reputation, and in no small part Krebs is responsible for that.
2. The "Ubiquiti sucks" mood started with Ubiquiti releasing shit products with even shittier software that, quite incredibly, sometimes even degraded with updates.
If you read his reporting on this now, it is still not clear that "Adam", his source, and the person committing the alleged offences are the same person. It may be he doesn't know but he certainly makes zero effort in either article to address the question.
Ubiquiti's forced cloud BS is more than enough reason for people to move away from them -- they basically dropped out of consideration for my purposes after they did that.
It can also be true that there was a drop in stock price when this incident was reported, and further drops after Krebs' coverage.[3] In fact he even discusses their share price at the tail end of his original article, even updating it on March 31 and acknowledging a roughly $50 drop following his reporting.
I doubt Ubiquiti will win this court case but I do think Krebs damaged his own credibility here.
[1]: https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b...
[2]: https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
[3]: https://markets.businessinsider.com/stocks/ui-stock?op=1
It also doesn't mention anywhere in the indictment who Sharp spoke with, so until it goes to trial... unless Krebs confirms that it was Sharp that contacted him, these are just assumptions/allegations and not something that have been proven one way or the other.
You can't sue journalists for this.
Now, it sounds like they have a bunch of other (factually correct) nonsense going on, they had a leak, suing to try to stop is just an incredibly bad look. I don't even know who Ubiquiti is, but fuck them, they sound like aholes to me.
A random "Tell HN: UI sucks because their firmware went down hill"-post is not likely to go anywhere. But as a comment within an article about UI, sure, that works.
There are many things wrong with UI. An inflated insider security story does not change that.
things like this contribute more to the mood you reference than the reporting from Krebs a year ago, IMO.
Their product direction changed and they're no longer my go-to. It appeared to kill a lot of goodwill from others too.
On the other hand, I hadn't even heard Krebs was going after them until today.
I took that as an un-recommend.
Nobody’s posted a “Ubiquiti sucks” thread from before the Krebs kerfuffle, so here’s one from Nov 2019. In that thread, people complain about a new “phone home” feature and Ubiquiti ignoring the terms of the GPL.
Ever since they fired their domestic development staff and shipped those jobs overseas it has been getting worse and worse. And it isn't because foreign developers cannot develop, it is because the company then and since has prioritized cost (and flash half-baked features) over quality.
Meraki competes against Ubiquiti and Aruba InstantOn with Meraki Go, not mainline Meraki.
It turns out, there can be such a thing as bad publicity. And like all forms of publicity, there are ways of putting it into a positive feedback loop. (Positive in the sense that you get more of it, perhaps from your perspective it is a positive development, perhaps not).
Thanks to Ubiquiti's efforts, now the story is known to a larger audience.
He seems like the sort of person to take it personally and then go out of his way to find security issues, of which I am sure there are plenty, considering the breadth of software and firmware across all their devices.
This is not a symmetric fight.