Final thoughts on Ubiquiti • Hacker News Board

Re: Final thoughts on Ubiquiti

#71

Post by nibbleshifter » Wed, Aug 31, 2022, 4:33 PM UTC

cthalupa wrote: post #20

blantonl wrote: post #12

Earlier quoted context omitted.

This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be completely overshadowed by a mistake here. Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy?

>but what more do you want from the guy? By the time the December story was published, it seems that Krebs knew full well that his source was the person implicated in the crime to begin with. I would like to understand why he thought it was responsible to press forward while obfuscating this fact, and how he will handle similar situations moving forward. His thought process there will help inform me as to whether or…

many of Krebs's sources are criminals, often dropping their competitors info in Brian's lap as a way to get ahead.

Brian's a willing and witting participant in this behaviour, even encourages it, because it gives him more stories.

Re: Final thoughts on Ubiquiti

#72

Post by robertlagrant » Wed, Aug 31, 2022, 4:34 PM UTC

criddell wrote: post #60

ulrashida wrote: post #34

Earlier quoted context omitted.

I think you're right, but it took me a few minutes to put my finger on what was missing. There should have been a "going forward I will..." segment.

What should he do going forward?

Not be a shock jock revealing things based on untrustworthy sources.

Re: Final thoughts on Ubiquiti

#73

Post by InTheArena » Wed, Aug 31, 2022, 4:34 PM UTC

nottorp wrote: post #70

Ok no security breach. Can I set up a new ubiquity device without registering with them at all now? Been told that you can delete the cloud registration after the set up, but that’s still unacceptable.

yes.

You do not need any cloud login at this point.

Re: Final thoughts on Ubiquiti

#74

Post by encryptluks2 » Wed, Aug 31, 2022, 4:34 PM UTC

stickfigure wrote: post #36

blantonl wrote: post #12

Earlier quoted context omitted.

This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be completely overshadowed by a mistake here. Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy?

> what more do you want from the guy? He's a guy who writes about hacks. He got "hacked". At the very least I am curious to know more of the story.

If you can call it that. Seems more like a convenient excuse.

Re: Final thoughts on Ubiquiti

#75

Post by balentio » Wed, Aug 31, 2022, 4:35 PM UTC

You guys are thinking about this in a very cloudy kind of way. Assuming that Ubiquiti was being blackmailed, they have a security problem in who they hire (Who held user data for ransom). Assuming they were not being blackmailed, but had a security hole in their software, Ubiquiti has a security problem.

Krebs reporting comes from a potential conflict of interest in that the person who might have been trying to blackmail was also the source. Defamation is not really the issue then because the source was pointing at a security problem which they happened to also be the cause of. The entity that hired this person was...Ubiquiti! Hence, it is not really defamation AS SUCH. Rather, if anything, it was true but maybe blown out of proportion to get a larger sum of money from Ubiquiti. We don't know how much info the person got their hands on, because Ubiquiti would be to blame for that, wouldn't they?

So, ultimately I think taking down the articles is a mistake in the sense that they reported on a problem either way with Ubiquiti and security. Take off the ad revenue from those articles, and issue a modified retraction on the conflicted interest the source held as a correction. Use it as a cautionary tale on "Sensationalism" and "not always knowing what the hell someone is doing when they report a leak" and move on.

Re: Final thoughts on Ubiquiti

#76

Post by curiousgal » Wed, Aug 31, 2022, 4:35 PM UTC

obblekk wrote: post #32

Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. It's true that his reporting probably caused stress for Ubiquity. I'm curious what people think i…

He has a history of doxxing people who have nothing to do with his pieces so yeah excuse my negativity.

Re: Final thoughts on Ubiquiti

#77

Post by gonehome » Wed, Aug 31, 2022, 4:35 PM UTC

The HN comments here at the time weren't great either: https://news.ycombinator.com/item?id=30850983

Despite it being clear that Krebs was wrong on this issue for some time, it showed the extent of his influence and the attacker's success in leveraging it to manipulate the public (including HN users).

Hopefully his retraction at least helps with that.

Re: Final thoughts on Ubiquiti

#78

Post by ineptech » Wed, Aug 31, 2022, 4:37 PM UTC

blantonl wrote: post #12

acoard wrote: post #6

An accurate but pretty lacklustre "mea culpa" and retraction. I don't mind people making mistakes, everyone does, but seeing how Krebs has handled this whole episode has not inspired optimism in how he'll handle future mistakes. He was essentially used as an unwitting party in a cyber blackmail scheme, and he doesn't touch on that at all. There will continue to be nefarious parties trying to misuse his reputation, so…

This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be completely overshadowed by a mistake here. Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy?

> what more do you want from the guy?

"This has taught me that my platform can be weaponized by any bad actor who can fool or manipulate me. One column from me could get a CISO fired or move a Fortune 500 company's stock price. That's a heavy responsibility that I wasn't really accounting for, but now that I understand it, I've put some thought in to it and I have made some changes that I hope will harden me and my platform against this kind of social engineering attack."

Re: Final thoughts on Ubiquiti

#79

Post by encryptluks2 » Wed, Aug 31, 2022, 4:39 PM UTC

mardifoufs wrote: post #68

riffic wrote: post #3

this reads like he got out-lawyered here. context for the unaware: https://arstechnica.com/tech-policy/2022/03/ubiquiti-sues-jo...

I wonder what has changed? The original thread discussing the lawsuit was filled with super dismissive comments, arguing that ubiquity lawyers were incompetent and had no actual way to win the case. Some of the commenters were supposedly actual lawyers too, so it's not even just the normal "terrible armchair law advice" we are used to from HN.

Everyone loves to play the armchair lawyer. Bias quickly fuels whatever side of a case you're on. However discovery and a few court conferences can quickly put things into perspective. Almost everyone's lawyers start off with some encouraging words but eventually they are telling you to settle for X and it is clear that they wouldn't have got paid if they told you that you had a losing case from the get go.

Re: Final thoughts on Ubiquiti

#80

Post by PragmaticPulp » Wed, Aug 31, 2022, 4:40 PM UTC

obblekk wrote: post #32

Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. It's true that his reporting probably caused stress for Ubiquity. I'm curious what people think i…

> What is Krebs' false positive rate?

What's more important is how those false positives are handled.

In this case, it feels like it was swept under the rug and he avoided addressing for as long as possible. If he had simply addressed the problem head-on as the news came out and the FBI information became public, it would have been a different story.

The way he rushed to report accusations from an anonymous source (who was actually the perpetrator) felt asymmetric relative to the minimal reporting on the extortion scandal and ensuing FBI investigation. IMO, the story about someone extorting their employer and then abusing security reporters as leverage was more interesting than the original story. Yet Krebs did very little reporting on the latter, likely because he knew he was central to making it all happen in the first place.