Hacker News Reader

Comment by bioemerl | Hacker News Reader

I cannot emphasize enough that you should not purchase some no name super cheap Chinese product and place it at the center of your home network.

It will be a little bit more expensive, but you should probably purchase from a more reputable brand.

View on HN

With the exception that the reputed brands may just be the Chinese ones but rebranded.

Iirc there was an article where someone purchased a port of some kind from multiple brands but they were all the same under the hood.

> With the exception that the reputed brands may just be the Chinese ones but rebranded.

20 years ago, I'd have said you're crazy, but the reality is this is true more often than not. However, there is one caveat I've noticed. Though this hardware tends to come from the same factories, or same ownership, often the 'namebrand' are the 'A' runs, and in some cases the cheaper so-called 'no-name' brands are the 'B' grade.

This is 100% anecdotal based on personal experiences and failure rates.

Yes, and in my experience, sometimes the off-brand version may be exactly the same in almost every way, except there may be a few components that they skimp on. Otherwise, they will look identical on the outside.

> except there may be a few components that they skimp on.

On the brand name ones or on the off-brand ones? ;)

Both probably, but the off-brand a bit more. :-)

It's absolutely a thing for a product to be made and sold below the standards of the brand name despite being effectively identical. You can find info on it if you look up third shift or ghost shift: https://money.cnn.com/magazines/fortune/fortune_archive/2006...

While the hardware can be the same, reputable brands can still have different firmware/software. Maybe not for a switch like this, but definitely for a router or something like that.

Maybe this post[0]? I remember relating to this part:

> Again, I found multiple identical-looking products on Aliexpress for 10 to 15 euros. I appear to be paying a lot of money for products that I could buy for cheap on random websites is starting to piss me off a bit at this point. I don’t really care about paying too much - I’d be perfectly fine with that if the product did its job. Unfortunately, it doesn’t do that.

[0] https://overengineer.dev/blog/2021/04/25/usb-c-hub-madness.h...

Why? Are these possibly unsafe because consumer safety tests are not verified? Is this more likely to fail early in its lifecycle?

I suppose I’m seeking to understand if the low prices are from cheaper manufacturing or if they’ve taken shortcuts. And as a consumer how are we supposed to become informed?

The switching ports are probably fine.

I wouldn't trust the power-over-ethernet at any distance where I couldn't still read the UL approval sticker.

(Which it does not have.)

Most networking equipment doesn’t have a UL or other NRTL listing. I don’t think any Ubiquiti product includes a UL mark. Even their power bricks and devices that take line voltage lack a listing.

Even if a product does have a listing it’s prob just for the power supply and not for the PoE circuitry.

It’s obvious: Networking equipment is responsible for transferring your personal data. Especially in home network where it might not be encrypted.

Hell, I don’t even trust most big brands. Run my own FreeBSD + pfsense + well known NICs from Intel sourced from Provantage or other data center distributor. Not eBay or Amazon.

That's... not obvious at all, no? Even if it's a rando-brand, you're going to have to dig deep to show these things actually phone home. Because so far that's been a lovely little tinfoil hat conspiracy theory that just doesn't hold up to reality.

Hilariously lawful intercept^1 is a baked-in Backdoor on many US branded devices like from Cisco. It taps ports and exfils data surreptitiously.

Not just legal but legally required.

1 https://en.wikipedia.org/wiki/Lawful_interception

Only on equipment an ISP would use.

I am responding to GP's skepticism of random Chinese networking equipment in your home and their skepticism is obvious; that's what I meant. Then I proceed to explaining my own reasons at home. Now whether you agree with GP or my statements is entirely orthogonal and up for debate. There were a number of responses asking "Why?" so I took a stab at the obvious.

Sure for most people, it is a pain to dig into these things. I can negligible sometimes too. And it can be just a woo woo conspiracy in my brain, possible.

what personal data is transferred in plaintext nowadays?

really the whole "trusted/privileged network" thing is outdated. your life will be much easier if you don't trust any network.

SMB isn't encrypted by default

Maybe for ancient versions on out-of-support Windows OSes or the odd appliance but SMB has been encrypted by default since at least 2016.

In Windows 10 and 11 file sharing is strongly encrypted by default. I don't even know how to turn it off; only an option to degrade to 40bit DES for old devices.

Copying IP and designs from others is an unethical practice. As such, the people conducting this practice are not going to be trustworthy for creating a reliable quality product.

Then, the customers who buy this stuff: Instead of paying a share of the R&D costs and the costs of quality, customers who cheap out on this kind of cargo cult product are instead saving a few bucks short term, only to pay the price later when the unit fails to perform long term.

Reality I think is much more bad: big name players buying cheap stuff from a catalog rebranded while sacking or not replacing good engineers at home.

And now you get to explain why, of course.

As the article points out its got the same realtek chip in it as any other brand.

Yes, but firmware backdoors are a thing. The same chip does not mean the same behavior.

Let me see if I can nail down the argument here:

- Chinese brand, with Chinese manufacturing: Backdoored.

- Non-Chinese brand, with Chinese manufacturing: Safe.

I mean, do people not realize that most "made in China" electronics is taken directly from a shipping container landing in California straight to reseller's warehouses? I mean, sure, they might spot check a few units here and there for QA, but it is direct from a Chinese factory to your mailbox without often receiving a secondary check.

Even "final manufacturing in the US" is often taking the Chinese made casing and the Chinese made board and mating them in a small operation for a sticker.

> Let me see if I can nail down the argument here:

Wrong nail. My home router runs OpenWRT. While it's not a 100% guarantee to be safe, it's a lot better than any closed-sourced firmware.

That said, if the choice is limited to closed-sourced firmware options, it's best to choose a reputable brand, so that the list of people who can access your router is limited to three letter agencies (US and China), as opposed to random scammers, like with all these malware-ridden Android phones from Aliexpress: https://www.cnet.com/tech/mobile/android-malware-that-comes-...

So, yes. Not buying network equipment on Aliexpress is a sound advice.

Why would it be better than the realtek chip found in so many devices that the odds of yours being bugged are proportional to how much you're wanted by the authorities. Consumer hardware doesn't have backdoors because the monumentous task required to keep that hidden isn't worth the non-payoff of not getting the military or state secrets that would make it worth the effort.

This is just a switch but similiar 2.5gbe routers can run pfsense or opnsense with i225/i226 chips and intel/amd cpus. Servethehome covers quite a few of them.

OpenWRT does not replace the firmware on any of the actual controllers inside the device, which is where a backdoor would likely reside.

Safer indeed.

I do not worry about people spying on me, I worry about empowering China, Russia, North Korea, Iran, or any such country that would happily eat our lunch if given the opportunity.

Do not empower people who would happily screw you over.

Keeping as much distance as possible from Chinese influence in all of the products you use in your home is essential to having a home that remains functional should we ever go to war.

I would be surprised if this device had any firmware at all. It's an unmanaged switch; most of the device's behavior is embedded in the switch IC.

So the backdoor is in the switch IC? :)

Yes they do. I have an ZyXEL XGS1010-12 (unmanaged) and it also runs Linux. The switch chip must be initialized, and the realtek SDK is based on Linux.

You could do it with just an eeprom afaik, but seems to be actually more effort (and not possible on all of realtek's switch chips).

It's so cheap because it comes with a power supply that doesn't have a UL or ETL certification, and as such could not be legally sold in North America. A decent quality power supply that could output 125 W would be around $50-70. You get what you pay for.

I got a ceiling fan a few months back. The wireless remote had no FCC id on it. The box in the fan did. I opened the remote and the plastic was oddly formed, and there was only one nonsense word printed on the pcb, and "v1.0". The microcontroller didn't even have anything printed on it. I listened to it with an sdr and it was in the 434MHz band, and not overly noisy. It probably would have passed if someone had payed for it to be tested... If I'd purchased it on AliExpress or even ebay I wouldn't have been surprised, but it was a front page prime-day deal. I knew Amazon was iffy, but this was a straight up illegal product.

Amazon doesn't care, much of what is offered is ordered on Alibaba, shipped direct to an Amazon warehouse for Fulfilled by Amazon then resold at a notable markup.

Policing this is very hard for brands that have skus they would like to defend from fakes, nevermind a much broader range of consumer goods with little oversight.

So what is the law that requires UL, ETL or other NRTL for power supplies in network equipment?

If such a law exists then how does Ubiquiti get away with selling unlisted product in North America?

It depends on your jurisdiction. Some products fall under the Consumer Product Safety Act, others falls under different regulations. In Canada marks are required, in the US it depends on where you are and where you're installing it e.g. is it for home use or a hospital's internal network?

https://electronics.stackexchange.com/questions/10639/is-ul-...

If your house burns down using an uncertified product, your insurance company may not also cover the claim. Personally I prefer to run electronics that I know are tested to not burn down my house or electrocute my children when they fail.

The article says the power supply is certified, but not the device.

It's CE certified which is something that Chinese companies print on everything, since it's a self-certification process. UL/ETL require you to do failure mode testing and provide detailed schematics of your equipment for review, and costs quite a bit of cash to get done.

I made the mistake of buying a very cheap “mercusys” router. Works well but i caught it sending data to a chinese server. I threw it away but if someone out there working in security has the time to dig into what mercusys routers do and publish their findings that would be awesome.

Reply on news.ycombinator.com