Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

Shame Boy posted:

rce, my rdp dll?

wasn’t expecting this

Adbot
ADBOT LOVES YOU

Computer Serf
May 14, 2005
Buglord
https://github.com/solana-labs/solana/issues/12232

brokechain posted:

Problem

Users need to verify programs that manage large amounts of on-chain capital against open-source implementations to trust there is no back-door in the program

Proposed Solution

TBD

seems bad :thunk:

Jimmy Carter
Nov 3, 2005

THIS MOTHERDUCKER
FLIES IN STYLE
I really want to believe the HN comment from a former engineer about how hosed-up the company was at the time, and bits like them running the company under the CEO's personal AWS account and keeping all their hardware signing keys in a GitHub repo in plaintext are those little juicy details that make it sound real

rossipedia posted:

Hoo boy, this is gonna be a fun one. For reference, I spent a year (mid-2018 to mid-2019) running the UniFi Network team and worked with Nick during that time.
> * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when used, confirmed and audited by relevant persons or teams.
The "Cloud Lead" that Nick took over from gave zero fucks. He ran all the AWS stuff for Ubiquiti under his personal AWS account. Nick came in and started putting "proper" AWS structure and security in place, primarily by scaring Robert (the CEO) into giving him the keys to the castle (my own personal opinion of Robert is... not the greatest).
One thing to understand about Ubiquiti (at least during those times) is that the company had zero C-level execs. There was Robert.... and then nobody knows. I asked repeatedly why we didn't have a CTO, or a COO, or a CFO, or CMO or ANYTHING and I got nothing but shrugs and "idunno" as a response for the whole year I was there.
So when Nick came in, a very... let's just say "forceful" personality, he immediately won over Robert and ended up with carte blanche over pretty much all of Ubiquiti's cloud accounts. Which were basically... everything. All the UniFi Network services, UniFi Protect services, you name it. If it was connected to the cloud in any way, Nick had access to it.
So why wasn't anybody else notified? Simple. Because he was basically "god". If anybody was gonna be notified, it would've been Nick. He was the top of the totem pole company-wide when it came to AWS.
Also, for some perspective, at that time Ubiquiti kept all the hardware signing keys in a private GitHub repo that every employee had read access to. And they were in plain-text. So... yeah.
> * Furthermore on the root account being easily accessed, the root account in the companies I've worked at had MFA enabled, and the QR code is locked in a safe only accessible by two people agreeing it needs to be accessed in a break glass situation, where warranted.
See above for the quality of security processes and practices this company had in place.
> * Why was he also able to delete critical CloudTrail logs and reduce their retention to 1 day? I.e. These logs should be in a S3 bucket or other environment where such changes cannot be made. Alternatively, they should be shipped to a redundant service that manages this risk to prevent data deletion
See above. (re: "god") Nick answered only to Robert. And he'd already successfully hoodwinked him. He could do whatever he wanted. Eventually he fell from Robert's good graces, but seeing as Ubiquiti as a company didn't really have a ton of checks and balances, he kept his god-level access far longer than he should've.
> * Why did Ubiquti not announce they were compromised sooner? The hack started in early December, Ubiquiti noticed the compromise on Dec. 28. Ubiquiti told the market on January 11th. Is that a satisfactory turn around? Giving them some credit for the XMas break I'll say this partially understandable.
Simple. Fear of share price falling. I was constantly given this as a reason we couldn't be transparent. Not by Robert, nor where he could hear. But it was pretty much well known that the company kept poo poo quiet for fear of the share price dipping.
> All the AWS configuration I'm speaking of above, I would describe as Security 101.
To keep with the metaphor, Ubiquiti couldn't even get Pre-school level security in place, much less 101. I have no idea how something even more massive hasn't happened yet. Must be dumb luck.
Speaking of, by the time I left the company, the team that was handling the door entry-way systems (UniFi "Access" I guess) had been caught with numerous security issues, not the least of which was logging user credentials in plain text (not just storing, but logging, in response to authentication events). They were also based in China and subject to Chinese laws around government access, so take that how you will.
And that doesn't really even cover most of it. That year took a toll on my physical, mental, and emotional health, not to mention put a crazy strain on my marriage. I'd rather honestly forget it, but the schadenfreude of what's going on is too delicious to ignore.

Sniep
Mar 28, 2004

All I needed was that fatty blunt...



King of Breakfast
So if a friend of mine was in the market for a replacement wifi AP system and maybe more what kinds of best practices are there now?

Chris Knight
Jun 5, 2002

me @ ur posts


Fun Shoe
cool
https://twitter.com/portswiggerres/status/1467856380174512129

infernal machines
Oct 11, 2012

we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

i guess it was only a matter of time before content blockers were exploited.

mystes
May 31, 2006

It's by malicious filter lists, which may not be that realistic, not the page.

Zamujasa
Oct 27, 2010



Bread Liar
css more like constant security shenanigans

kitten smoothie
Dec 29, 2001

Jimmy Carter posted:

I really want to believe the HN comment from a former engineer about how hosed-up the company was at the time, and bits like them running the company under the CEO's personal AWS account and keeping all their hardware signing keys in a GitHub repo in plaintext are those little juicy details that make it sound real

Also I didn't know until last week that Ubiquiti is publicly traded, but the CEO owns like 90% of the shares. Knowing that definitely makes this story a lot more believable.

Sniep posted:

So if a friend of mine was in the market for a replacement wifi AP system and maybe more what kinds of best practices are there now?

Hard same, I'm like $1500 deep into Unifi hardware and I'm still thinking of switching. The real draw for me for Unifi was PoE access points, so I can keep the whole network up from the UPS attached to the router and switches.

kinda looking at the Aruba stuff now

Subjunctive
Sep 12, 2006

✨sparkle and shine✨

kitten smoothie posted:

Hard same, I'm like $1500 deep into Unifi hardware and I'm still thinking of switching. The real draw for me for Unifi was PoE access points, so I can keep the whole network up from the UPS attached to the router and switches.

yeah, that combined with the in-wall APs are really nice aspects of Unifi. I guess I’m going shopping

defmacro
Sep 27, 2005
cacio e ping pong
ugh i had just more or less figured out what to get from ubiquiti and i'm definitely having second thoughts now.

spankmeister
Jun 15, 2008






it's fine, don't worry about it.

cinci zoo sniper
Mar 15, 2013




spankmeister posted:

it's fine, don't worry about it.

thanks, Officer

cinci zoo sniper
Mar 15, 2013




for real though, it’s fine and there are no even vaguely similar alternatives at similar price points

Shame Boy
Mar 2, 2010

my AP is a consumer one i got on sale from newegg with dd-wrt running on it

thats my poast thanks for reading

Beve Stuscemi
Jun 6, 2001




cinci zoo sniper posted:

for real though, it’s fine and there are no even vaguely similar alternatives at similar price points

Its almost like there might be a reason for that.

FWIW I ran Ubiquiti switching and AP's at home for a couple years and it was by far the most janitorially heavy home setup I've ever had and it didnt work great about 90% of the time.

I just bought an orbi Pro system and sattelite off amazon, installed it, configured it with the app, havent touched it since and it works perfectly.

Antigravitas
Dec 8, 2019

Die Rettung fuer die Landwirte:
I have one Unifi AP that requires their dumb controller that is poo poo. Mongodb, lmao.

I like the UFO, I just wish the software was less garbage.

Quackles
Aug 11, 2018

Pixels of Light.


I bought an ASUS wireless router and installed tomato on it.

BlankSystemDaemon
Mar 13, 2009



Zamujasa posted:

css more like constant security shenanigans
drat it, I did a spit-take from laughing because of you!

Perplx
Jun 26, 2004


Best viewed on Orgasma Plasma
Lipstick Apathy
i use a ubiquiti ap, i had a an er-4 but i swapped it out for a full pc

i don't have to worry about cpu bottlenecks with a 10th gen i3 at 4Ghz

cinci zoo sniper
Mar 15, 2013




Jim Silly-Balls posted:

Its almost like there might be a reason for that.

FWIW I ran Ubiquiti switching and AP's at home for a couple years and it was by far the most janitorially heavy home setup I've ever had and it didnt work great about 90% of the time.

I just bought an orbi Pro system and sattelite off amazon, installed it, configured it with the app, havent touched it since and it works perfectly.

i haven’t touched mine since the initial configuration, which took maybe 2 hours, for another anecdote

Zamujasa
Oct 27, 2010



Bread Liar

Shame Boy posted:

my AP is a consumer one i got on sale from newegg with dd-wrt running on it

thats my poast thanks for reading

same, very needs-suiting

Agile Vector
May 21, 2007

scrum bored



cinci zoo sniper posted:

i haven’t touched mine since the initial configuration, which took maybe 2 hours, for another anecdote

my ubiquiti issues are mostly from self-inflicted post-setup tinkering, to add. i replaced a dd-wrt router with a udm so, if anything, it was an improvement as far as setup and configuration. not that wrt firmware didn't serve me well

actually, the biggest pain has been the beacon hd, the mesh outlet-only unit. the firmware was spotty at first and i didn't used the provided faceplate, so it wouldn't sit securely. i don't know why they didn't make the back divot a bit larger

Quackles
Aug 11, 2018

Pixels of Light.


Zamujasa posted:

css more like constant security shenanigans

secfuck megathread v18.12 - more like constant security shenanigans

spankmeister
Jun 15, 2008






i have a ubiquity setup with cloud key, AP-AC-Pro, USG and some PoE switch. I have not touched it for literal years. no janitoring required at all

evil_bunnY
Apr 2, 2003

Zamujasa posted:

css more like constant security shenanigans
:perfect:

Partycat
Oct 25, 2004

I have a stack of their APs. I just run one of the AC-M at home configured from the mobile app.

it works okay but every time something doesn’t want to associate or stick (rarely now) I know in my heart there is nothing to be done

Chris Knight
Jun 5, 2002

me @ ur posts


Fun Shoe

Zamujasa posted:

css more like constant security shenanigans

lmao perfect

Computer Serf
May 14, 2005
Buglord

Sniep posted:

So if a friend of mine was in the market for a replacement wifi AP system and maybe more what kinds of best practices are there now?

Quackles posted:

I bought an ASUS wireless router and installed tomato on it.

check the built in storage/memory before you buy anything new for tomato or openwrt.

with some janitoring microtiks can be setup with roaming

Quackles
Aug 11, 2018

Pixels of Light.


Computer Serf posted:

check the built in storage/memory before you buy anything new for tomato or openwrt.

You mean, how much it has? Or to see if something specific is present/absent?

(I admit that I bought the router based on Tomato's compatibility lists...)

Sniep
Mar 28, 2004

All I needed was that fatty blunt...



King of Breakfast

Computer Serf posted:

check the built in storage/memory before you buy anything new for tomato or openwrt.

with some janitoring microtiks can be setup with roaming

Nah, can't get into janitoring hacked consumer gear

it's gotta be a legit vendor. I guess the next option would be paying for meraki licenses. Or maybe aruba? I am not super familiar with all the different wifi / AP hardware options, but the routing side has gotta remain a real router and probably might just stick with the edgerouter 6p i have now for the time being. It's the unifi poo poo that i'm trying to get rid of now after the hell stories from Ubiquiti.

At least the edgerouter I can replace separately, probably with something juniper. I don't like web UIs, has to be something with a real console interface

Computer Serf
May 14, 2005
Buglord

Sniep posted:

Nah, can't get into janitoring hacked consumer gear

it's gotta be a legit vendor. I guess the next option would be paying for meraki licenses. Or maybe aruba? I am not super familiar with all the different wifi / AP hardware options, but the routing side has gotta remain a real router and probably might just stick with the edgerouter 6p i have now for the time being. It's the unifi poo poo that i'm trying to get rid of now after the hell stories from Ubiquiti.

At least the edgerouter I can replace separately, probably with something juniper. I don't like web UIs, has to be something with a real console interface

i saw a huge custom aruba deployment at a big FOSS conference, idk if that’s the best endorsement but take that as you will

meraki licensing is weird, more like a subscription last i checked

Quackles posted:

You mean, how much it has? Or to see if something specific is present/absent?

(I admit that I bought the router based on Tomato's compatibility lists...)

just the capacity on the hardware level. routers with more memory let you install more utilities. it’s basically just running busybox

e: typos

Computer Serf fucked around with this message at 01:56 on Dec 7, 2021

Computer Serf
May 14, 2005
Buglord
is there any sort of rewards program for reporting wire fraud scammers who try to get other people to forward money to some other account?

normally i wouldn’t waste my time but someone is clearly asking me to sign up for a bank account and just give them the login lmao

psiox
Oct 15, 2001

Babylon 5 Street Team
openwrt owns and is not hard to janit. if you want to get really fancy you can even bake your own configs into the firmware image to make it impossible to gently caress up if you maintain devices for other people

Shaggar
Apr 26, 2006
openwrt was the worst of all the wrt variants i ever used

Soylent Pudding
Jun 22, 2007

We've got people!


The more I think about it the more I hate the term computer janitor. It's demeaning to the noble and essential profession of janitors to imply they touch computers.

post hole digger
Mar 21, 2011

Jim Silly-Balls posted:

Its almost like there might be a reason for that.

FWIW I ran Ubiquiti switching and AP's at home for a couple years and it was by far the most janitorially heavy home setup I've ever had and it didnt work great about 90% of the time.

I just bought an orbi Pro system and sattelite off amazon, installed it, configured it with the app, havent touched it since and it works perfectly.

everyone else was right, i was wrong. i am sick to death of dealing with unifi. it is in fact, a pos. nothing ever stays adopted after a controller reboot, so many loving mesh problems. unifi sucks dick.

Sniep
Mar 28, 2004

All I needed was that fatty blunt...



King of Breakfast

post hole digger posted:

everyone else was right, i was wrong. i am sick to death of dealing with unifi. it is in fact, a pos. nothing ever stays adopted after a controller reboot, so many loving mesh problems. unifi sucks dick.

nah they got me too.... they got me too

mine even works pretty well but i havent updated jack poo poo and the ui still wont even show half their own gear on it

i bought the hype and didn't listen to my gut. when it's too cheap to believe, it's truly too cheap to believe

defmacro
Sep 27, 2005
cacio e ping pong

Soylent Pudding posted:

The more I think about it the more I hate the term computer janitor. It's demeaning to the noble and essential profession of janitors to imply they touch computers.

Adbot
ADBOT LOVES YOU

Beve Stuscemi
Jun 6, 2001




Soylent Pudding posted:

The more I think about it the more I hate the term computer janitor. It's demeaning to the noble and essential profession of janitors to imply they touch computers.

yeah it’s a bit like that tweet suggesting that pick up artists and garbage men should switch names

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply