Hacker News Reader

Comment by cavisne | Hacker News Reader

As the article points out its got the same realtek chip in it as any other brand.

It's so cheap because it comes with a power supply that doesn't have a UL or ETL certification, and as such could not be legally sold in North America. A decent quality power supply that could output 125 W would be around $50-70. You get what you pay for.

I got a ceiling fan a few months back. The wireless remote had no FCC id on it. The box in the fan did. I opened the remote and the plastic was oddly formed, and there was only one nonsense word printed on the pcb, and "v1.0". The microcontroller didn't even have anything printed on it. I listened to it with an sdr and it was in the 434MHz band, and not overly noisy. It probably would have passed if someone had payed for it to be tested... If I'd purchased it on AliExpress or even ebay I wouldn't have been surprised, but it was a front page prime-day deal. I knew Amazon was iffy, but this was a straight up illegal product.

Amazon doesn't care, much of what is offered is ordered on Alibaba, shipped direct to an Amazon warehouse for Fulfilled by Amazon then resold at a notable markup.

Policing this is very hard for brands that have skus they would like to defend from fakes, nevermind a much broader range of consumer goods with little oversight.

So what is the law that requires UL, ETL or other NRTL for power supplies in network equipment?

If such a law exists then how does Ubiquiti get away with selling unlisted product in North America?

It depends on your jurisdiction. Some products fall under the Consumer Product Safety Act, others falls under different regulations. In Canada marks are required, in the US it depends on where you are and where you're installing it e.g. is it for home use or a hospital's internal network?

https://electronics.stackexchange.com/questions/10639/is-ul-...

If your house burns down using an uncertified product, your insurance company may not also cover the claim. Personally I prefer to run electronics that I know are tested to not burn down my house or electrocute my children when they fail.

The article says the power supply is certified, but not the device.

It's CE certified which is something that Chinese companies print on everything, since it's a self-certification process. UL/ETL require you to do failure mode testing and provide detailed schematics of your equipment for review, and costs quite a bit of cash to get done.

Yes, but firmware backdoors are a thing. The same chip does not mean the same behavior.

Let me see if I can nail down the argument here:

- Chinese brand, with Chinese manufacturing: Backdoored.

- Non-Chinese brand, with Chinese manufacturing: Safe.

I mean, do people not realize that most "made in China" electronics is taken directly from a shipping container landing in California straight to reseller's warehouses? I mean, sure, they might spot check a few units here and there for QA, but it is direct from a Chinese factory to your mailbox without often receiving a secondary check.

Even "final manufacturing in the US" is often taking the Chinese made casing and the Chinese made board and mating them in a small operation for a sticker.

> Let me see if I can nail down the argument here:

Wrong nail. My home router runs OpenWRT. While it's not a 100% guarantee to be safe, it's a lot better than any closed-sourced firmware.

That said, if the choice is limited to closed-sourced firmware options, it's best to choose a reputable brand, so that the list of people who can access your router is limited to three letter agencies (US and China), as opposed to random scammers, like with all these malware-ridden Android phones from Aliexpress: https://www.cnet.com/tech/mobile/android-malware-that-comes-...

So, yes. Not buying network equipment on Aliexpress is a sound advice.

Why would it be better than the realtek chip found in so many devices that the odds of yours being bugged are proportional to how much you're wanted by the authorities. Consumer hardware doesn't have backdoors because the monumentous task required to keep that hidden isn't worth the non-payoff of not getting the military or state secrets that would make it worth the effort.

This is just a switch but similiar 2.5gbe routers can run pfsense or opnsense with i225/i226 chips and intel/amd cpus. Servethehome covers quite a few of them.

OpenWRT does not replace the firmware on any of the actual controllers inside the device, which is where a backdoor would likely reside.

Safer indeed.

I do not worry about people spying on me, I worry about empowering China, Russia, North Korea, Iran, or any such country that would happily eat our lunch if given the opportunity.

Do not empower people who would happily screw you over.

Keeping as much distance as possible from Chinese influence in all of the products you use in your home is essential to having a home that remains functional should we ever go to war.

I would be surprised if this device had any firmware at all. It's an unmanaged switch; most of the device's behavior is embedded in the switch IC.

So the backdoor is in the switch IC? :)

Yes they do. I have an ZyXEL XGS1010-12 (unmanaged) and it also runs Linux. The switch chip must be initialized, and the realtek SDK is based on Linux.

You could do it with just an eeprom afaik, but seems to be actually more effort (and not possible on all of realtek's switch chips).

Reply on news.ycombinator.com