[0] Maybe not technically a franchise. Not sure. There are a bunch in California.
> .. never had any safety issue so far
It's the 'so far' which really tickles me.
So they can take your security seriously, but they will be hacked, or they have already.
It was a light-hearted jest at the fact that this exact line is in every single breach notification I have read for the past few years.
The more serious point I was alluding at was not "just don't get breached", it was that the "we care" line rings hollow after the 250th time reading it.
They could have not done that. The users were probably unaware that their data was even placed on the cloud servers of some third party.
Ubiquiti used to be cool. They've taken a nose dive in recent years in several ways: Firmware upgrade suddenly including telemetry by default, forcing people to use their NVR appliance instead of installing their software on their private servers, etc.
Had Ubiquiti not moved people to "cloud solutions" an attacker would have to attack millions of peoples equipment. Now he only had to attack one providers network.
When did they stop allowing people to use a private server for central management? I see Unifi still has a network controller.
I'm thinking of "Unifi Video" that is going out (EOL announced six months ago), where you could either buy their appliance OR download an official .deb package and install the NVR software on your own server.
They replace that with "Unifi Protect" that comes ONLY as an NVR appliance. No more .deb packages. It also requires you to buy one of their other products (Cloud Key 2), IIRC.
I think it's expensive, but possible.
Do you have data to back up your claim that no one, ever has ever successfully remained secure?
The unknown unknown. How can you be sure all the "resisted actual attempts" been even detected?
... right up until the SolarWinds hack became public.
The point being, provable "we've never been breached" seems to have a way of turning out to be wrong. :/
Just because known attempts have failed doesn’t mean the unknown ones have too.
https://www.express.co.uk/news/uk/1372333/Gmail-hacked-Googl...
Not unheard of at Google, either.
https://arstechnica.com/information-technology/2013/11/googl...
Maybe you should know literally anything about the topic at hand before making sweeping assertions? I realise that's asking a lot here at HN, but it would improve the site a lot.
That will be the new norm in these kinds of annoucements, I'm sure.
Just like SolarWinds dropping "Team City", saying "no evidence" of a breach of it. So why mention it at all?
‘We know they breached but don’t know what they did’ is an interesting statement. One POV is that they didn’t have sufficient logging and segregation to determine how widespread the breach was, the other is that they’re not arrogant enough to think their SIEM adequately captures everything.
Aren't they based in California which, if I remember correctly, as a law requiring them to notify the victims of a data breach?
Would they still have chosen to in the absence of such a law? We'll never know, I guess.
No, that is not what I'm saying. I'm saying don't put platitudes in a breach notification.
HAHA ! Too True !
Reminds me of getting "punished" as a child...
Parent: "Now remember this will hurt me more than it will hurt you"
PS. No child were abused in the making of the above comment. My parents were/is excellent !
Why does every company, after demonstrating a lack of security, like to say this exact line? I can just imagine the PR person hovering over the shoulder of whoever authored the post yelling "make sure you tell the victims of this breach that we care!"