If it was open source, would you recommend Unifi to your family? I feel like family will either be technical enough to understand OPNSense, or not technical at all at which point even Unifi is not something they'll manage themselves.

I actually run OPNSense for myself at home, but for my parents I deployed full Unifi. This way if there's any problem, I can remotely look at the network in the cloud console and try and see what's wrong.

> I feel like family will either be technical enough to understand OPNSense, or not technical at all at which point even Unifi is not something they'll manage themselves.

Agreed. Major ISPs in the US (and I presume many other places) offer routers that work well enough to satisfy the requirements of any non-technical household and often come with provisioning/troubleshooting features that enable the ISP to provide technical support if necessary.

In the old days, ISP-provided devices often lagged behind other consumer or prosumer network offerings, and it made sense to swap them out... but that's not really the case today. Today, swapping out the ISPs router is probably going to make a non-technical user's life harder, unless they have someone technical to manage it for them.

ISP gear is still trash. It's just better for the user, because the ISP won't bitch and moan and tell you your hardware is unsupported.

"Trash" is subjective.

Satisfaction happens when a product or service meets the user's requirements. A new Cisco catalyst setup may be technologically superior to my mother's ISP provided router, but it might not make it easier for her to play Candy Crush on her iPhone if she forgets the wifi password.

I suppose you're right. Just after seeing my family lose internet a bunch of times due to the ISP supplied router just straight up failing, I don't have much confidence in the hardware. Also I don't think that rebooting the router once a week because it's frozen makes it a quality product that brings satisfaction. I've never seen an ISP supplied router that isn't like this. But that could just be my personal experience.

I mean, when the first thing you hear when you call your ISP, is to "reboot your router" on a recorded message, doesn't that throw a red flag to anybody else? I don't use high end gear at home like Cisco, either, but it has never needed a reboot.

My family uses some of the later devices from Comcast and Verizon and they don't seem to have any issues requiring reboots. I do know, at least for Verizon, that their troubleshooting tool can automatically reboot and reprovision their routers, so there's no need to tell the user to do this on the phone anymore.

No, AT&T is still shipping with a router that cannot hit more than 50% bandwidth on any of 3 devices from under 5 feet. With one wood + pressboard wall between me and the router, 25%.

This is symmetric gigabit product, but still.

You've described a technical problem, not a non-technical problem.

I'm not familiar with that device, but a non-technical user might not care about that "problem", as long as their device does the task they are intending to perform.

The problem is being described technically, which is more useful than the non-technical description of the problem, which is "I don't know, the Zoom isn't working, and the kids can't watch their Netflix at the same time".

Yes, but Zoom and Netflix will work great on 50% or 25% of 1gbps. Heck, they'll work great with 5% of 1gbps.

I am sure that AT&T's CPE equipment is lackluster, but that doesn't mean it won't work to do basic tasks to the satisfaction of a home user.

I dunno what to say, but it does not do basic tasks to the satisfaction of people who buy 1gb internet connections.

I can tell you from experience that large downloads and uploads cause latency-sensitive applications to stutter in a way that is fixed by using ubiquiti gear.

In your defense, you did say non-technical household, but I dunno -- I don't think that wanting to use, eg, backblaze for backup and not have that tank zoom makes you a technical household.

And I don't know anything about the equipment AT&T is handing out these days, it could be particularly bad. But generally speaking the equipment that ISPs are handing out these days is pretty functional for generic use.

I think UnifiOS is pretty straight forward (at least for my generation). I don’t think I would recommend it to my parents but I did to a sibiling and they managed to setup their own system with only a little bit of help from me. I also sent them the awesome lazy admin VLAN guide which helped a ton.

I'm pretty bad at coming up with business ideas, but one that I think would work, if I ever got the time to do it, is a user-friendly x86 router firmware centered around the idea of making it as easy as possible to set up and control your network and its devices.

On my home network, what I really want is the ability to define one or more networks (VLANs, if you will) and then place devices in those networks. When you click on a device, you are then able to do things like give it a static IP, look at the traffic it's generating, shape its traffic, disallow traffic from/to certain ports, kick it off the network at certain times of day, allow it access to the local network but not the Internet, change its DNS resolvers, etc.

In order to do these things on most routers, if they offer the ability at all, you need to jump around to different places in the UI and manage each service as its own thing. OPNSense is great (and it's what I currently use) but it's UI is really just multiple little windows into the various sub-services that the firmware provides. Separate page for all the firewall rules, another for all the DHCP leases, etc. It works, but it's kind of frustrating to use, especially when you're not digging around in it every day.

The business model would be: everything open source, but three "tiers" of releases: 1) free "beta" releases featuring new and lightly-tested features for the adventurous. 2) "stable" releases via subscription (paying customers have access to the source code and build tools) 3) "freeloader" releases, the same as "stable" but with a 6-9 month delay.

Devil is in the details of course, but if I had any entrepreneurial bent at all, I think it would be a big improvement over the current state of things.

Do you know about OpenWRT and the others? If yes what are they lacking?

I know about OpenWRT and used it for years on various cheap MIPS routers. But back then, the UI did not come with the firmware, you had to install it separately. And it was _very_ basic and there was lots that you still had to do on the command line to get anything done.

Correct me if I'm wrong, but that still looks to be largely true. Except that there are multiple to choose from: https://openwrt.org/docs/guide-user/luci/webinterface.overvi... I had a look at a few, and they all seem to be "managing the router"-centric, not "managing your network"-centric.

Well, since we're talking about delays in security responses, OPNsense is in the same boat. https://news.ycombinator.com/item?id=34839161

I have a lot of complaints about OpnSense. But how exactly is that a similar security response?

That wasn’t a security incident for OpnSense. It was a CVE for an optional package most users probably don’t have installed. Sounds like not-an-emergency to me. That user is completely unreasonable. Opnsense should refund their money (if any lol) and tell them to pop off.

>That wasn’t a security incident for OpnSense. It was a CVE for an optional package most users probably don’t have installed.

First of all, the point is that the OS didn't release CVE fixes for the packages in its repositories even though it had already committed those fixes to version control. Notice that my comment specifically talks about "delay in security response", not that it was an "emergency".

>That user is completely unreasonable. Opnsense should refund their money (if any lol)

Second, I recommend reading the comment you respond to carefully before you rush to make an account to respond to it. "That user" is me. The GH thread has a clear comment from me that I did not pay them any money and do not have any expectation of support.

Third, notice that the point of the GH thread was me asking what their policy of releasing CVE fixes was. You seem to think I was some Karen complaining that they hadn't released the fix. All I asked was a confirmation that they're aware that they're shipping a package with a CVE, that they've already fixed the package but just not published it, and what their policy is for releasing fixes in general.

They could've responded with something like "We're aware of the CVE but we don't plan to release the fix in 23.1. Our policy is to only release bugfixes for non-critical packages in the next stable release, and we consider os-haproxy to be a non-critical package."

Instead they got weirdly defensive about it, tried to lecture me about how OS releases generally work, called me "rude" (ironic), and locked the issue.

The ultimate point is that OPNsense delays security fixes. Maybe you think it's okay because you think some OS packages are critical and this one wasn't. Maybe you think if an OS can't articulate its security fixes release policy without getting combative, then it's hard to take its security seriously. The decision is yours.

The maintainers of OpnSense are able to make their own determination about the severity of the issue and the method of the fix. They gently reminded the user of their process. Ubiquiti, as a provider of a paid security product, has a much larger, immediate, and different responsibility to fix the issue and communicate clearly with their clients.

I think that everyone is entitled their own intentions, but they are also responsible to communicate those intentions effectively. If the intention was to not be "some Karen complaining" it wasn't clearly communicated that way.

Yeah he installed a webserver on his router and walks up to the BSD port maintainer and complains about security LOL, he even archived it.