Hacker News Reader

Comment by alias_neo | Hacker News Reader

Step one is not to buy TP-Link routers.

I know people have limited budgets, but having seen the code that sits on these devices and how poor quality and easily exploited it is, time and time again, I'll never buy TP-Link (amongst others) again.

For a while I collected a graveyard of routers that had been abandoned by the manufacturers (and contained serious vulnerabilities), with the intention of writing them all up one day; next thing you know I have two children rapidly reaching double-digit ages, and much better things to do with my life than write about how shitty the code is on actual products we buy every day.

I switched, about 7-8 years ago to a Protectli box running Coreboot and OPNSense and haven't looked back; I use Ubiquiti APs and switches. I'm not saying they're the best, but anything used in corporate/enterprise is going to have better support (if not better code quality).

The great thing about Ubiquiti APs for me is that each new WiFi generation (or two) I can just buy a few more, snap the existing APs off of the various ceilings they're attached to, snap on the new ones, adopt them, and away we go.

View on HN

> I'll never buy TP-Link (amongst others) again

I've got many dumb cheap ethernet switches and I'd say as long as they're really dumb/unmanaged/not advanced: you can't go very wrong. I've got probably two TP-Link ones and they're on 24/7 and just work: zero problem since years (and they followed me in four countries). Never had any issue with big .iso files or anything.

And I've got a little homelab: VMs and ZFS on a Xeon with ECC RAM, countless Raspberry Pi, two physical different LANs (not VLANs as all my switches are dumb) with a Pi doing the bridge/routing.

It's when things get complicated: configurable stuff, "advanced" capabilities, etc. that the cheap junk stops working properly and that you're better served with proper gear.

And of course there's the $200 or $500 vs $20 question too.

But people shouldn't underestimate how reliable good old dumb unmanaged Ethernet is for home usage.

Heck, I can go from 1 Gb/s to 100 Mbit/s to then a very old 10 Mbit/s (!) switch by daisy chaining them all switches and everything simply just works (I did that for I was thinking about playing with bounded-retrieval-model, hence physically limiting network speed on purpose).

No whether you should support or not a company selling shitty managed switches and shitty routers by buying the products that are okay from them is another question.

Or, buy a TP-Link router and flash it with OpenWrt. Best of both worlds.

Then every upgrade flash becomes an ass-clenching experience. I’ve been down this path.

It’s a lifestyle choice… until you’re up at 3 AM rebuilding everything because you bricked your AP by flashing openwrt-24.10.0-ath79-generic-tplink_archer-c7-v2-squashfs-factory-FOR-C7-V5-EU-NOT-V2-US.bin and not openwrt-24.10.0-ath79-generic-tplink_archer-c7-v2-squashfs-sysupgrade.bin.

There is a one click update in the WebUI now, no need to flash random bins

This is good news then. I divested from the OpenWRT ecosystem about 7 years ago because of an experience similar to my example.

Case in point was an Asus RT-56N router that I had to replace with ISP wifi.

I mean, these days you can just let Claude do it if you don't care for such minutiae... I was skeptical, but it got it done perfectly.

It also discovered my fast roaming settings were incompletely setup and that I was using a 5GHz channel that needed 60s to turn on due to regulations (DFS channels).

I'm at a loss why you would put a random number generator in front of such a sensitive operation. It's literally a matter of time before the output sampler chooses a somewhat-less-probable string like the one xatt posted. Or just deletes your stuff.

Because I've done it a million times and wanted to see what the "random number generator" is capable of? Because I have config backups/know how to unbrick?

You should try it, you might be surprised how thorough it is. It certainly checked more things pre/during/post-upgrade than I did to make sure everything goes smoothly. And definitely more than xattt, apparently ;)

I understand that it works most of the time. I just want to be clear about what the stakes are.

"Because I have config backups/know how to unbrick?" This is the important part for me. I'm not going to gamble with more than I can afford to lose.

The same recovery paths and risk boundaries apply as always.

If anything, these "random number generators" (which they aren't, do not ever use them for that, obviously) are:

- even more cautious,

- more readily take, stash, test and use backups,

- check for and take recovery paths,

- do dry runs,

- consider interruptions,

- mine for more information,

- smoke-test more,

- and are better equipped to do both deeper and wider analyses when encountering problems,

than the typical person.

I'm being very literal about the randomness. The language model outputs a distribution over all possible output tokens, and the chosen output is sampled from that distribution. The process intentionally includes output that is not the top-ranked token according to the model.

Think about that for like two seconds.

Yes, randomness is involved, except you're destroying the snot out of it by biasing it to hell and back with those billion-trillion parameter models in front of the sampler.

Alternatively, check the difference between a typical ChatGPT prompt response, and the output of the following:

  import tiktoken, secrets
  
  enc = tiktoken.get_encoding("o200k_base")
  tokens = tuple(enc._mergeable_ranks.values())
  msg_len = 128 + secrets.randbelow(2048 - 128)
  token_ids = [secrets.choice(tokens) for _ in range(msg_len)]
  print(enc.decode(token_ids))

You'll note that they're not much alike. You may also note that with LLMs you can set the "temperature" parameter to zero, in which case the sampling is no longer randomized. So much so, that given various runtime conditions, passing in the byte exact input will return the byte exact output, every time. Possibly across machines, depending on the inference engine used.

Even if you mean it on a "higher level", imbued into the language emitted, do feel free to ask a model with disabled tool calling to give you some random numbers / words. You'll find that it isn't very random. Certainly wasn't when I last tried this for entertainment.

What I mean is, using LLMs for search and coding, they return the wrong answer all the time, unpredictably. Often if I redirect them, they will agree that they were wrong. So even though the knowledge that I need is in there somewhere, it doesn't get applied reliably. I don't want that experience for my infrastructure, where the model usually gets it right, but it just goes wrong a noticeable fraction of the time.

Do you know what I mean?

Yes, I do get that, I was simply taking an issue with the characterization, cause it's super catchy but conflates several distinct failure modes.

The model emitting nonsense is mostly the model just being terrible in general. The model answering slightly different each time is inference details, like temperature, seed, batching, hardware, etc. The model responding to the same inquiry very differently is the model being semantically unstable. These all exist but they are distinct, and social media isn't kind to nuance to begin with.

You gestured at the second previously, but what you describe now is mostly the former. I don't really experience this anymore, but I do typically use Opus, and work an area where it's clearly excelling in, so that's probably why. Every time I go back to Sonnet, the bullshit parade begins, no matter the amount of context provided, or the thinking effort level configured. Mostly tolerable, but I wouldn't leave it unattended, like you say.

The third I only recently got into testing, cause it's kind of rich to re-run the same task many times just to eval stochastic variation, and not even always viable. Tested Luna, Terra, and Sol at various thinking levels, multiple runs each on the same problem, perturbing it with a (genuinely) random bit of text injected each time. The famed stochastic parrot effect didn't really materialize, I got normal parrots. I wouldn't necessarily say this was a clear win in semantic stability though, cause the random bit of text wasn't semantically relevant. Maybe if I reworded the prompts proper each test, it'd have been a different story. But then that's not a clean test per se. Controlling for variables is hard enough even in normal research, try controlling for billions reacting who knows how, which is the whole issue to begin with, after all. So you can't properly test without better understanding, but you can't gain the understanding without proper testing. Catch 22.

No, you’re not being even slightly literal. If language models were random number generators, their output would be gibberish. That’s literal.

The randomness is biased, so it's usually fine. But sometimes the output is gibberish. Ask your LLM what sampling temperature is.

Randomness with bias can't explain the output of an LLM. You're confusing bias with the non-uniformity of the underlying distribution, before any random sampling occurs. Random sampling of the logit distribution that's output by the model doesn't turn the whole system into a random number generator.

It's the highly non-uniform nature of the distribution before sampling that allows the LLM to produce coherent results. That non-uniformity is the result of complex dependencies in the model weights, which allow it to produce context-dependent sequences.

Since you're being snarky about asking an LLM, I'll note that your comment above is closer to gibberish, for the reasons I've described, than anything a frontier LLM would produce. If we were to extrapolate from this one data point, we might conclude that an LLM is a more trustworthy choice to flash a router than a human that produces such comments.

If I had a pseudo random number generator that somehow kept outputting winning lottery numbers a reasonable percentage of the time, I would use it to enter the lottery. Even if it seemed completely impossible and despite studying the algorithm, I did not understand how it worked—I would still use it.

That's basically how I feel about LLMs right now. I have no idea how any of this is possible but somehow it seems to be working.

Would you put in your life savings every time?

No. But I'd certainly put in the cost of a router.

Didn't xatt prove you shouldn't leave this to human? I'd trust a frontier model more than a human to do it.

It works, bud. It is getting to the point where I am learning new things when using my LLM to modify my home network and devices.

I did that once or twice, but I got fed up of finding the correct hardware revision of a particular router that supports OpenWRT, and I much prefer OPNSense anyway, and it runs on commodity hardware that you have full control over.

Waaaay too easy to end up a bricked router with no working recovery options.

Only do this if you rescued the router from the trash bin, not if you spent money on it

It's not a router, it's an AP, so in my mind it's just a LAN to wifi bridge, a wrapper around the chip :) People were recommending them, it has PoE, roaming works etc. I thought I could buy a consumer product and stop tinkering lol. I'll check Ubiquiti, but I somehow thought that they are overpriced af and never looked into them

Your experience seems to indicate that even their APs are a mess; while I applaud your effort to solve this, "I'm too old for this shit" is where I'm at now when it come to my home network, I (and my wife and kids) just want it to work so I've spent a fair chunk of change on it.

Uniquiti APs are fine, they've been reliable for me; I have one AP that's nearly a decade old and still going strong, and I just swap them out or extend coverage when a new generation comes along, and move the older ones to where stronger/newer wifi isn't needed. If I wasn't in the Unifi ecosystem which keeps my life simple, I'd probably look at Ruckus or maybe see whether Mikrotik have anything compelling yet.

As it stands; the Unifi Server I'm self-hosting keeps them up-to-date and optimised, so I just plug in an AP, adopt it and forget about it, it gets configured automatically and away we go; that's about the amount of involvement I want these days.

Coincidentally, I need an extra AP for my Steam Frame to use it away from the dongle in an area where I currently don't have good WiFi coverage, so I'm going to pick one (probably a 7-Pro or 7-Pro-XG) up and just plug it in to an ethernet port in the room in question, wait a couple of minutes and be ready to roll.

Mikrotik routers are cheap, very stable and highly configurable. Admittedly the learning curve is a bit rough, but in today’s age of agentic assistance, you can just have your LLM help you configure it.

I bought ~15 of their cheapest 2.4ghz router to connect payment terminals ~4 years ago and it was a terrible mistake. I thought for a low bandwidth application with the router being decently close it would work fine.

Spent days trying to make it work (it would work, then lose the connection, roaming was probably an issue too) and in the end leased meraki hardware that worked fine.

I'd avoid their cheap tier of AP at least.

... and kind of slow. I've recently looked at Mikrotik hAP be lite (A42G-HbeP ) [1] and noticed only 2315.1 Mbps for 25 bridge filter rules or 1430.3 Mbps for 25 ip filter rules.

I also heard a horror story about RouterOS coming with an insecure configuration by default, lots of open ports and services running which were recently affected by a vulnerability. Speaking of RouterOS do I have to also buy a license along with the hardware? How about updates?

[1]: https://mikrotik.com/product/hap_be_lite

That's not really a fair comparison, since any software packet filter on that class of hardware will be slow.

If you need layer 2 or stateless layer 3 filtering at hardware speeds, Mikrotik makes 10G switches that can do it for under $200. Mikrotik APs also support port and WiFi isolation which is enough security for most home networks (e.g. isolating an IOT VLAN).

Mikrotik's "fastpath" stateful connection tracking feature is also fast in my experience; not fully wire speed but good enough for untrusted devices that you want to be fast, like a Fire stick or game console or similar.

- 1430.3 Mbps for 25 ip filter rules in a 70€ Wi-Fi 7 router doesn't sound that bad to me. Also, as sibling comment says, you can enable fast tracking for certain connections.

- Mikrotik doesn't have open ports to the outside since years and years ago, IIRC. They had a CVE on their administration port (not in ssh) in 2023, but you shouldn't open that port to the outside anyway.

- All Mikrotik wireless routers include at least a level 4 license. You only need a higher license level if you need more than 200 VPN tunnels or more than 200 users in the hotspot functionality. A bigger wireless router like the hAP ax³ will already have a level 6 license, the biggest one. You might need a license if you set up a Mikrotik instance in a X86 server, or virtualized, for example to manage a bigger site or as a bigger hotspot controller. Licenses aren't expensive and are paid only once, no subscriptions (by device, I think you get a device ID or something like that).

- All the Mikrotik routers that I own still get updates. The RB750GL, that was released like 15 years ago or more, still updated.

They had a pretty serious SSH auth fail recently. Lots of devices with external ssh access (non-default) compromised.

https://nvd.nist.gov/vuln/detail/cve-2026-67276

Ah, wasn't up to date with that, that's pretty recent. I wonder what SSH implementation are they using (I wouldn't make my own implementation if I were them...)

I have hap ax3. They cleaned up their defaults. No extra license costs.

One issue I had was that I was affected (and many others) by wifi bug in firmware which made connections drop randomly. Took them half a year to resolve it. Wouldn't recommend Mikrotik as access point. Otherwise it's good.

Good to know since I was thinking of using it as an access point.

If you don't understand it, high chance LLM will leave with an open firewall.

The learning curve being a bit rough is massive understatement. It's not meant for not computer savy people.

TP Link's support is the worst, too.

I bought an Omada, thinking I was getting a quality product. It died in the first 2 weeks.

Support accused me of not using a surge protector (it was plugged into a UPS) and grudgingly sent me a replacement.

Even at home, I can't risk having to replace my router every 2 weeks, so I just stuffed it in a box. I did use it again later, but wasn't happy with it, and ended up with a Ubiquiti Unifi UCG-Ultra. It's better than the TP-Link Deco and Omada, Eero Pro, Google Wifi, and Asus routers I've had, though I'll admit some of the Asus were pretty decent.

> The great thing about Ubiquiti APs for me is that each new WiFi generation (or two) I can just buy a few more, snap the existing APs off of the various ceilings they're attached to, snap on the new ones, adopt them, and away we go

Why is this exclusive to Ubiquiti? Can't you do it with any other company that has managed APs?

Yes, but Ubiquiti did a good job of advertising these features and making them available to the “prosumer” segment. With most other brands you have to go through enterprise sales, a distributor, or find them second–hand. Cisco might make the best APs ever, but good luck using them in your home.

I have a TPlink omada system that works exactly the same. Managed controller and APs that get adopted.

I bought them brand new from shops. No distributor, no enterprise sales.

I believe Aruba works in a similar way

Ubiquiti APs and switches might be okay, but their routers are also quickly abandoned, so I'm not sure I'd be willing to invest in their other gear. (UniFi Express only got Network upgrades for about 18 months.)

> I'll never buy TP-Link (amongst others)

Been wondering recently what the others might be. Can you give a few examples among popular brands?

As in the others that I _won't_ buy (which is what I meant)?

I wouldn't buy Netgear, Asus, D-Link again. My ISP gave me Eero and I've never connected it, far too much Amazon crap going on there (but I have to keep it if I want the ISP to provide support).

Gl.iNet has been OK for the price but re-flash it with vanilla OpenWRT because their OS has some dubious phone home stuff (or did last time I looked at it).

Honestly, in terms of routers, I'm never likely to use something off-the-shelf again a decent box with Intel NICs that can run OPNSense and preferably run Coreboot (or similar). If I did go with something COTS (Commercial Off The Shelf), I'd look at Mikrotik.

I'm not a massive fan of Ubiquiti but I have their APs and I've had a bunch of their EdgeMAX switches (sadly discontinued when some of their best devs left), and their APs have been solid for me for the best part of a decade.

The advantage of using dedicated components is that each can be chosen according to your requirements.

Thanks for sharing the experience.

> As in the others that I _won't_ buy (which is what I meant)?

Correct. Sorry, worded the question a bit too ambiguously :)

What kind of trouble did you have with ASUS and D-Link? Security or the lack of configuration options? Haven't bought them in a while, but I remember them being somewhat decent.

I'm quite frequently in the market for a simple home router/AP for friends and family, and they'd rather have something simpler and cheaper, so that rules out Mikrotik (which I would normally go for). Would love to hear some stories about the issues you've had with all kinds of off the shelf stuff if you have the time.

> What kind of trouble did you have with ASUS and D-Link? Security or the lack of configuration options? Haven't bought them in a while, but I remember them being somewhat decent.

I should caveat all of my opinion with the fact that I stopped buying this stuff the best part of a decade ago when I decided to go open source, so things may very well have changed in that time.

My experience with a particular manufacturer I won't name, which provides solar panel monitoring and optimisation equipment that I have installed at home suggests otherwise though, it's bad to the point of being unsure if I should laugh or cry.

Anyway, my experience back then was that Netgear and ASUS stuff was generally overpriced, performed reasonably though not amazingly well but had support dropped within 2-3 years and were left with severe vulnerabilities.

D-Link I found lacked features, performed generally weaker than the others, and were lucky to get any updates.

I can't recommend anything these days because I haven't used any in a long while, so my old-timer advice is moot. If I had to pick a branch of off-the-shelf to buy today because I was forced to it'd probably be Ubiquiti.

That said, I'm a dev in the communications-security space, my requirements are a little different to my family and friends, I have static IPs, lots of hosted stuff, and a low risk-appetite for vulns on my network, while a typical household will have a dynamic IP, unlikely to be hosting much if anything and so their attack surface is lower.

What's likely to be my next move personally? I currently run a Protectli box with about 90% more power than I need for my 1Gb network and 1Gb/1Gb WAN, but the NICs (5 Intel NICs) are the limiting factor, I'll likely buy something similar with 10Gb when the time comes and carry on running OPNSense and hopefully Coreboot.

On the other end I can recommend FritzBox. Rock solid and has a lot more bells and whistles than I expected, like wireguard support, NAS-like access by attaching USB storage, and more graphs than I know what to do with. It's the happiest I've been with an electronic purchase in a long time.

Well, I don't think this build quality is solid [1]. With OpenWrt you have more freedom than FritzBox. But the UI is pretty idiot-proof indeed.

[1] https://borncity.com/win/2024/07/20/fritzbox-7590-router-the...

Oh, I rather meant the brands to avoid. But it's still interesting to discover new ones, thanks.

Ops, bad comprehension skills on my part. I've amended the post to make the difference clearer.

I tried out quite a few products and brands. I've settled on opnsense running on a spare x86 based machine with an intel x550 T2 NIC that I got off of ebay. My only regret is not making this switch earlier.

> Step one is not to buy TP-Link routers.

What about their switches? I'm looking at buying a small 10GB SFP switch and TP-Link was one option.

I've already got Ubiquiti kit, and frankly while I don't much like it I can't deny that it works well enough and is reasonably priced for what you get.

So, it looks like I'm going to lean towards the Ubiquiti switches.

It really depends on what you need from it; a cheap L2 switch will do the job, but frankly, you can get a Ubiquti Flex Mini with 5x1Gb ports for £35, I have a bunch of them around the house, and they're semi-managed so I can do VLANs on them and power them over PoE; since I'm already running Unifi, don't see the point cheaping out on switches.

I also have a bunch of EdgeMAX because I use the L3 features, they were more expensive, and that range is sadly now discontinued, but the Unifi equipment have all been workhorses, and the only think I've ever had fail in the past decade was an EdgeRouter Lite, the power circuitry failed after some dodgy mains voltage issues in my previous home.

> Ubiquti Flex Mini

These are handy but I've never had one successfully be adopted by Unifi. No idea why. And since they're basic enough that they have no ssh command line access, there are limits on what you can do to debug them.

For my use case, though, powered by PoE and unmanaged is good enough.

Yeah, I need 10GB though, I'm throwing very high bitrate video over them. The plan is to have a Ceph cluster storing footage and serving NFS along with Postgres server for project storage.

Sorry, I somehow skipped over that.

I've been looking at upgrading to 10Gb myself, currently my top contenders are Mikrotik and Ubiquiti.

Mikrotik is much more reasonably priced, but I already have mostly Ubiquiti equipment so I'd probably spend the extra to keep the single-pane-of-glass for maintenance, something simple like the Flex XG / Flex 10 GbE so long as it can run my VLANs.

What router brands are producing quality?

Ubiquiti, GL.iNet, FRITZ!Box

Happy to be proven wrong

Reply on news.ycombinator.com