Hacker News Reader

Comment by teamspirit | Hacker News Reader

So the guy makes the initial post, within an hour UI team reaches out to him to gather more info and the next post is a criticism of their handling!

What’s wrong with people? I think 1 hour response to a forum post isn’t unreasonable or am I wrong?

View on HN

If I reported to a vendor that I had unfettered access to other people's cloud console, and it was the fourth such report, I'd expect them to shut down access to the console until they figure out what's going wrong.

Instead, they're "looking into it" or something?

I guess they'll just hope nobody does anything nefarious like change the passwords on every switch/router/AP they have access to then get remote access?

Imagine being able to shut off all Ubiquiti console access in the world instantly, by posting about a grave security issue (real or not) and having a few compatriots to do the same in a short amount of time. You could trivially block a business's access to its own security cameras on a moment's notice, among other things.

If the response to an unverified issue were "just shut everything down" you effectively have implemented an exploitable DoS in your own incident policy.

I was typing exactly this when I saw your comment. This could very well be a real issue, but could also be a nefarious attack or even just incompetence. I've done support before and there are always users convinced that they are "hacked" or that we are doing something shady because they forgot their friend logged in on their device or forgot that they actually made two accounts in the past.

This was posted 18 hours ago. If you can't either verify the user has actual access to other people's consoles (at which point you should be immediately turning access off) in 18 hours, then you should probably just close up shop because you have no business providing remote access to a can of soup much less someone's firewall.

If the user in question was making it up, you should also have posted within minutes of discovery that the user in question (and multiple other people) were making false claims.

Again, they've chosen the "we're looking into it" route which is always reassuring.

> If you can't either verify the user has actual access to other people's consoles [...] in 18 hours, then you should probably just close up shop

It's impossible to prove a negative. Maybe they believe that this was user error/malice but are doing more research to confirm this and find evidence of a vulnerability.

>It's impossible to prove a negative. Maybe they believe that this was user error/malice but are doing more research to confirm this and find evidence of a vulnerability.

So it's impossible for me to prove that nobody has walked through my front door today? I'm quite confident it isn't. I'm also confident if they have sane logging in place, they can prove accounts weren't being accessed by unauthorized users.

You're also talking in vagaries like they're hunting a ghost. They've been interacting with a willing end-user who originally reported the error.

For what it's worth, all reports and screenshots of this seemed to have happened within the same hour, so it might've been fixed quickly. I definitely would expect this to get a public postmortem within 48 hours, though (maybe Cloudflare has ruined my postmortem timeline expectations).

If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? Having carte blanche access to someone else's network equipment seems like the highest emergency a company like Ubiquity could have.

I don't know if the time frame is acceptable, but I know I would have reached out to the customer versus waiting around for a DM once the alarm was rung.

> If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable?

In Seattle they don't even show up anymore, they tell you to fill out a form online...

You have to search the streets yourself and be your own advocate if you want to recover your stolen car.

In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut. Adjacent police departments like Kirkland and Lake Forest Park are much more willing to do their job, but they fire officers who don't do their job, while SPD retains these caustic, non-performing officers.

So long as we let our officers in Seattle getaway with billing fraudulent hours that weren't worked, ignoring core job duties, and slow rolling the duties that they do do, we will be stuck with an ineffective police force.

>In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut

The budget was absolutely cut.

https://apnews.com/article/business-police-seattle-6730ec66e...

>The Seattle City Council has approved a 2022 budget that cuts police department spending from previous years [...]

2022 was not 8 years ago.

I do not read "In the last 8 years" as 8 years ago, but within in the last 8 years. Do you read it differently?

In your interpretation the number 8 has no significance in that sentence, since "In the last 1000 years" would have the same meaning.

I could say the exact same thing for your interpretation. Why not just say 1000 years ago the budget wasn't cut? It would have the same meaning. Oh wait, it wouldn't have the same meaning because 8 and 1000 years are quite a bit different.

8 years is probably not meaningless for the poster. He probably moved there 8 years ago or had his car stolen back then and is saying nothing has improved since then despite there being no budget cuts.

It makes no sense to say in the last X years if the poser just mean X years ago. It would cause unnecessary confusion.

>I could say the exact same thing for your interpretation. Why not just say 1000 years ago the budget wasn't cut? It would have the same meaning.

Because it would not have the same meaning. The point of the phrasing is that the time the Seattle PD stopped being motivated to do their job was close to eight years ago, and they have continued to be unmotivated since then.

"1000 years ago the budget wasn't cut" does not convey that information.

If the poster meant 8 years ago they stopped being motivated he would have just said that. The post didn't say that. You are just tangling yourself in word play to try to get the post to mean something different than it does.

You’re parsing this incorrectly mate. “In the last 8 years” means in any of the last 8 years, which is different than in the last 1000 years.

The SPD has lost hundreds of officers and hasn't recouped them.

"Defund the Police" has consequences.

The SPD has lost officers, yes, despite offering hiring bonuses higher than ever. This is not because they don't have enough money, but because the prestige of being a police officer in Seattle has declined.

While defund the police was ill-though out, let's remember that it was a response to the continued use of excessive use of force by police. As one of the parent commenters said, SPD has a poor track record of disciplining misconduct of their officers. People will take increasingly desperate measures if they feel like they're not being heard. The idea that you'd do away with police was short sighted and didn't make sense since the beginning, but the situation SPD finds itself in is partially a self-inflicted wound.

The police chief is appointed by the mayor. If people feel like they are not being listened to or there is too much abuse maybe they should elect a mayor that will deal with it?

Yes and no. Traffic enforcement and dispatch positions were moved to another funding line item outside of the SPD. This was the city council attempting satisfy calls to "defund the police", while not actually reducing the amount of money allocated to policing.

https://southseattleemerald.com/2023/09/14/opinion-debunking...

"The new budget includes funds for 1,357 officers and SPD says right now, there are 1,120 officers on the force—which leaves 237 open jobs."

20 years ago in school our English teacher had us read a science fiction short story about a robbery. I wish I could remember the name of it. The essential idea was that robbery was at some point legalised and nobody really cared because they just claimed on insurance. With more and more of our possessions being basic commodities (cars, electronics, IKEA furniture etc.) and everything of importance being digital, this seems to be coming true now.

From very dim memory: https://en.wikipedia.org/wiki/Flatlander_(short_story)

Anymore? They've never shown up for this kind of stuff as long as I can remember.

That's not a good comparison.

911 is paid by taxes for being 24/7 available. It is also a public service. Ubi is free (at least I don't pay for any of my Unifi consoles, besides the initial cost). It is also a private company, free (as in beer) to do as they like.

Do you think Ubiquiti has hundreds of people on staff to watch their forums to triage every issue within seconds of it being posted? I'm curious what level of support would be satisfactory to you, in this instance.

Not OP but you don't need 100s of staff monitoring the forum. You need a webhook that filters on "security" in the title and post it in the relevant slack channel. I do expect UI have a 24/7 paid support/security team and I'm sure someone could say "uh, this looks real what's going on?"

Ah yes the typical engineer response of "just <insert system>".

Yes, damn those engineers for coming up with solutions to problems I personally believe are unsolvable based on nothing but personal feelings.

Ignoring the fact that flagging when certain keywords are posted is probably built into the forum software itself... I had that with phpbb back in 2001.

I just find it funny when engineers trivialize solutions that they themselves wouldn't employ. Like yeah, I'm sure your phpbb solution was a proper vulnerability reporting and triaging system.

You must not have had any dealings with the police in any US city if you think that they will come running in minutes if someone is stealing your car.

There is an escalation path for security tickets at most large companies, and a community forum post is not it.

You sure about that?

Chicago: 3.46 minutes

Los Angeles: 5.7 minutes

Seattle: 7 minutes

Dallas: 8 minutes

Miami: 8 minutes

New York City: 9.1 minutes

Atlanta: 9.5 minutes

Houston: 10 minutes

Detroit: 12 minutes

Denver: 13 minutes

Go on any of those city subreddits and read the stories of 911 not picking up or refusing to come out because "you can file a report online".

That's called anecdotal evidence. I've had police come slow and come fast. 911 also prioritizes calls, so it's possible you're being rate limited by them and not the actual police. The data from their apps tells a different story, maybe they're fudging it, I just don't think making blanket statements about timing based on someone else's story gives me an accurate picture.

The problem is calls that are never picked up, and calls that are "resolved" by telling the caller that a stolen car is no biggie, ruin these "stats".

Yep, the stats are bogus because the party that they are measuring are also creating the stats.

Even crime stats are bogus in NYC, I speak from experience as cops literally tell you to fuck off if you want to file a police report. You can be stabbed, bleeding out and walk into a police precient, and they'll drag you outside so they don't have to write a report

This is pretty simple, if you cannot be down for an hour… don’t buy Ubiquity.

Enterprise sucks a lot of the time, but this is what you are supposed to be paying for.

And nothing for 16hrs. So probably there is something wrong. And it’s seems pretty critical. Status page doesn’t show anything

I don't know if it's expected of status pages to signal security incidents and bugs if you technically can still use your (and other people's) console.

(Putting on buck teeth and fidgeting with something) But but but akchyually, it's not an outage, you see.

If other people can access your console, then this feels like a case where it's negligent not to have an intentional outage, shutting down all remote access to all cloud consoles until this is fixed.

Why would users want them to advertise a vulnerability on the status page before the issue is fixed? I would want them to keep this as quiet as possible until the issue is resolved.

To enable workarounds and/or stop the bleeding.

There's many places where no network is strongly preferable to network that could be open to hackers.

I mean... It's not even "no network". Once the management connection is severed the network equipment doesn't stop operating at all.

All users should be informed so they can decide if to pull the plug or not on their devices...

Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

Nothing's wrong with people angry about this. What's wrong with the company letting it happen in the first place?

Update the status, and discuss it more in the open. Obviously with any security issue there's reasons to keep some discussions private, but it feels like they're attempting to minimize it, the same way a restaurant doesn't want their customers to hear about the mice in the kitchen.

https://status.ui.com/#past-incidents still says "no incidents reported today"

Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

If they're not going to update the status page, then it's a liability and should be taken down.

I think you are missing the point. the point is this should never ever happen in whats considered to be SMB enterprise products. Peoples businesses and livelihoods are at stake. The fact that it did happen is bad enough, the rest is just the icing on the cake. you made the point about a 1 hour response, howewver 18 hours after that response there is still no update anywhere for lots of worried customers.

If Ubiquiti was my company and this post was posted on my forum, I would be having status messages/emails out to all my customers, updates on status pages, warnings on website logins etc. Hiding this in a private DM with a single customer is terrible, and they even told the world thats what they were doing which was a kick in the nuts.

Reply on news.ycombinator.com