Ubiquity hardware sends telemetry and it cannot be turned off
theregister.co.uk
theregister.co.uk
They claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers? They are very barebone anyway, and were there to be any issues, they would be notified by the customer.
Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set.
I have so many other devices that are snooping and constantly sending data (phones) that I don’t really care about my USG sending crash data.
The workaround is really lame and and blocks all traffic to the data leak domains.
I don’t want to send crash data. I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. They claim it’s only crash data, but I don’t know. They can also change it at any time as they’ve lost my trust by adding data leaks to a firmware update I accepted without knowing it.
What piece of non mobile/pc tech do you run firmware upgrades on more often than a router?
Good technology doesn't need to be updated all the time.
Do you receive any notification if there's ever an issue found? Is there even a centralised tracker for security issues affecting the router software?
Sometimes, things need to be updated. And consumers can't be bothered to flash a firmware image.
There could be a XSS vulnerability in the management interface.
There could be a vulnerability in any component which is internet facing.
The router is handling packets. There might be a vulnerability in that logic allowing for maliciously crafted packets (in the answer of a request).
Surely you aren't exposing that interface to the world at large, right?
Of all the devices in a house, a router should be the most important to keep up to date.
If it is not, you will have to explain exactly the vulnerability works.
Preventing DNS rebind attacks closes only one avenue.
I think saying tomato is more secure and refined than some router that updates itself constantly to secretly bait and switch the user's expectations is an understatement.
>automatically installed on unaware customers equipment.
No.
>they claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers?
Also apparent you have not used their IPv6 stack nor their fq_codel implementation.
>Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set.
This move certainly made me scratch my head a little. Especially when Ubiquiti should know their customer base would be less than thrilled.
That's way easier said than done. Plus, then you have to trust users. If I want to know how often feature X is used on platform Y, having some basic telemetry is way more reliable than sending out a survey to users.
True, but this fact isn't important. What's important is having respect for your users and their preferences.
Both of those points may be true. I'm claiming that the fact they may be true isn't important, though, because respecting user wishes, particularly about privacy, tops those considerations.
Does anyone, literally anyone at all make hadware you can trust anymore? I feel like I am taking crazy pills.
They will allow opt out. For now ...