I know people have limited budgets, but having seen the code that sits on these devices and how poor quality and easily exploited it is, time and time again, I'll never buy TP-Link (amongst others) again.
For a while I collected a graveyard of routers that had been abandoned by the manufacturers (and contained serious vulnerabilities), with the intention of writing them all up one day; next thing you know I have two children rapidly reaching double-digit ages, and much better things to do with my life than write about how shitty the code is on actual products we buy every day.
I switched, about 7-8 years ago to a Protectli box running Coreboot and OPNSense and haven't looked back; I use Ubiquiti APs and switches. I'm not saying they're the best, but anything used in corporate/enterprise is going to have better support (if not better code quality).
The great thing about Ubiquiti APs for me is that each new WiFi generation (or two) I can just buy a few more, snap the existing APs off of the various ceilings they're attached to, snap on the new ones, adopt them, and away we go.
It’s a lifestyle choice… until you’re up at 3 AM rebuilding everything because you bricked your AP by flashing openwrt-24.10.0-ath79-generic-tplink_archer-c7-v2-squashfs-factory-FOR-C7-V5-EU-NOT-V2-US.bin and not openwrt-24.10.0-ath79-generic-tplink_archer-c7-v2-squashfs-sysupgrade.bin.
Case in point was an Asus RT-56N router that I had to replace with ISP wifi.
It also discovered my fast roaming settings were incompletely setup and that I was using a 5GHz channel that needed 60s to turn on due to regulations (DFS channels).
You should try it, you might be surprised how thorough it is. It certainly checked more things pre/during/post-upgrade than I did to make sure everything goes smoothly. And definitely more than xattt, apparently ;)
"Because I have config backups/know how to unbrick?" This is the important part for me. I'm not going to gamble with more than I can afford to lose.
If anything, these "random number generators" (which they aren't, do not ever use them for that, obviously) are:
- even more cautious,
- more readily take, stash, test and use backups,
- check for and take recovery paths,
- do dry runs,
- consider interruptions,
- mine for more information,
- smoke-test more,
- and are better equipped to do both deeper and wider analyses when encountering problems,
than the typical person.
Yes, randomness is involved, except you're destroying the snot out of it by biasing it to hell and back with those billion-trillion parameter models in front of the sampler.
Alternatively, check the difference between an arbitrary ChatGPT prompt response, and the output of the following:
import tiktoken, secrets
enc = tiktoken.get_encoding("o200k_base")
tokens = tuple(enc._mergeable_ranks.values())
msg_len = 128 + secrets.randbelow(2048 - 128)
token_ids = [secrets.choice(tokens) for _ in range(msg_len)]
print(enc.decode(token_ids))
Even if you mean it on a "higher level", imbued into the language emitted, do feel free to ask a model with disabled tool calling to give you some random numbers / words. You'll find that it isn't very random. Certainly wasn't when I last tried this for entertainment.
That's basically how I feel about LLMs right now. I have no idea how any of this is possible but somehow it seems to be working.
Only do this if you rescued the router from the trash bin, not if you spent money on it
Uniquiti APs are fine, they've been reliable for me; I have one AP that's nearly a decade old and still going strong, and I just swap them out or extend coverage when a new generation comes along, and move the older ones to where stronger/newer wifi isn't needed. If I wasn't in the Unifi ecosystem which keeps my life simple, I'd probably look at Ruckus or maybe see whether Mikrotik have anything compelling yet.
As it stands; the Unifi Server I'm self-hosting keeps them up-to-date and optimised, so I just plug in an AP, adopt it and forget about it, it gets configured automatically and away we go; that's about the amount of involvement I want these days.
Coincidentally, I need an extra AP for my Steam Frame to use it away from the dongle in an area where I currently don't have good WiFi coverage, so I'm going to pick one (probably a 7-Pro or 7-Pro-XG) up and just plug it in to an ethernet port in the room in question, wait a couple of minutes and be ready to roll.
Why is this exclusive to Ubiquiti? Can't you do it with any other company that has managed APs?
I bought an Omada, thinking I was getting a quality product. It died in the first 2 weeks.
Support accused me of not using a surge protector (it was plugged into a UPS) and grudgingly sent me a replacement.
Even at home, I can't risk having to replace my router every 2 weeks, so I just stuffed it in a box. I did use it again later, but wasn't happy with it, and ended up with a Ubiquiti Unifi UCG-Ultra. It's better than the TP-Link Deco and Omada, Eero Pro, Google Wifi, and Asus routers I've had, though I'll admit some of the Asus were pretty decent.
Spent days trying to make it work (it would work, then lose the connection, roaming was probably an issue too) and in the end leased meraki hardware that worked fine.
I'd avoid their cheap tier of AP at least.
I also heard a horror story about RouterOS coming with an insecure configuration by default, lots of open ports and services running which were recently affected by a vulnerability. Speaking of RouterOS do I have to also buy a license along with the hardware? How about updates?
If you need layer 2 or stateless layer 3 filtering at hardware speeds, Mikrotik makes 10G switches that can do it for under $200. Mikrotik APs also support port and WiFi isolation which is enough security for most home networks (e.g. isolating an IOT VLAN).
Mikrotik's "fastpath" stateful connection tracking feature is also fast in my experience; not fully wire speed but good enough for untrusted devices that you want to be fast, like a Fire stick or game console or similar.
- Mikrotik doesn't have open ports to the outside since years and years ago, IIRC. They had a CVE on their administration port (not in ssh) in 2023, but you shouldn't open that port to the outside anyway.
- All Mikrotik wireless routers include at least a level 4 license. You only need a higher license level if you need more than 200 VPN tunnels or more than 200 users in the hotspot functionality. A bigger wireless router like the hAP ax³ will already have a level 6 license, the biggest one. You might need a license if you set up a Mikrotik instance in a X86 server, or virtualized, for example to manage a bigger site or as a bigger hotspot controller. Licenses aren't expensive and are paid only once, no subscriptions (by device, I think you get a device ID or something like that).
- All the Mikrotik routers that I own still get updates. The RB750GL, that was released like 15 years ago or more, still updated.
One issue I had was that I was affected (and many others) by wifi bug in firmware which made connections drop randomly. Took them half a year to resolve it. Wouldn't recommend Mikrotik as access point. Otherwise it's good.
The learning curve being a bit rough is massive understatement. It's not meant for not computer savy people.
Been wondering recently what the others might be. Can you give a few examples among popular brands?
I wouldn't buy Netgear, Asus, D-Link again. My ISP gave me Eero and I've never connected it, far too much Amazon crap going on there (but I have to keep it if I want the ISP to provide support).
Gl.iNet has been OK for the price but re-flash it with vanilla OpenWRT because their OS has some dubious phone home stuff (or did last time I looked at it).
Honestly, in terms of routers, I'm never likely to use something off-the-shelf again a decent box with Intel NICs that can run OPNSense and preferably run Coreboot (or similar). If I did go with something COTS (Commercial Off The Shelf), I'd look at Mikrotik.
I'm not a massive fan of Ubiquiti but I have their APs and I've had a bunch of their EdgeMAX switches (sadly discontinued when some of their best devs left), and their APs have been solid for me for the best part of a decade.
The advantage of using dedicated components is that each can be chosen according to your requirements.
> As in the others that I _won't_ buy (which is what I meant)?
Correct. Sorry, worded the question a bit too ambiguously :)
What kind of trouble did you have with ASUS and D-Link? Security or the lack of configuration options? Haven't bought them in a while, but I remember them being somewhat decent.
I'm quite frequently in the market for a simple home router/AP for friends and family, and they'd rather have something simpler and cheaper, so that rules out Mikrotik (which I would normally go for). Would love to hear some stories about the issues you've had with all kinds of off the shelf stuff if you have the time.
[1] https://borncity.com/win/2024/07/20/fritzbox-7590-router-the...
I've got many dumb cheap ethernet switches and I'd say as long as they're really dumb/unmanaged/not advanced: you can't go very wrong. I've got probably two TP-Link ones and they're on 24/7 and just work: zero problem since years (and they followed me in four countries). Never had any issue with big .iso files or anything.
And I've got a little homelab: VMs and ZFS on a Xeon with ECC RAM, countless Raspberry Pi, two physical different LANs (not VLANs as all my switches are dumb) with a Pi doing the bridge/routing.
It's when things get complicated: configurable stuff, "advanced" capabilities, etc. that the cheap junk stops working properly and that you're better served with proper gear.
And of course there's the $200 or $500 vs $20 question too.
But people shouldn't underestimate how reliable good old dumb unmanaged Ethernet is for home usage.
Heck, I can go from 1 Gb/s to 100 Mbit/s to then a very old 10 Mbit/s (!) switch by daisy chaining them all switches and everything simply just works (I did that for I was thinking about playing with bounded-retrieval-model, hence physically limiting network speed on purpose).
No whether you should support or not a company selling shitty managed switches and shitty routers by buying the products that are okay from them is another question.
What about their switches? I'm looking at buying a small 10GB SFP switch and TP-Link was one option.
I've already got Ubiquiti kit, and frankly while I don't much like it I can't deny that it works well enough and is reasonably priced for what you get.
So, it looks like I'm going to lean towards the Ubiquiti switches.
I also have a bunch of EdgeMAX because I use the L3 features, they were more expensive, and that range is sadly now discontinued, but the Unifi equipment have all been workhorses, and the only think I've ever had fail in the past decade was an EdgeRouter Lite, the power circuitry failed after some dodgy mains voltage issues in my previous home.
These are handy but I've never had one successfully be adopted by Unifi. No idea why. And since they're basic enough that they have no ssh command line access, there are limits on what you can do to debug them.
For my use case, though, powered by PoE and unmanaged is good enough.
I wonder if EU push for basically 5 years of mandatory updates will make it better. Then again this isn't security bug but functional one...
That only applies to smartphones and tablets, I believe.
> !!
I was shocked when this happened to me. My company had a Dell switch kicking around in storage. It was a Dell Powerswitch Somethingorother_b. Big, expensive, enterprise switch. I went to set it up and found that I couldn't find the manual for that model online. Dell told me they only made a Somethingorother without any suffix. But we had records of buying it straight from them.
Apparently it happens. I have no idea how.
The consequences of global supply chains.
Anecdotal but, I knew an original designer and owner of a Cali. based manufacturer of very high end audio equipment; the kind that gets used for tier one studios and audio reproduction reference, who had his chassis designs replicated and manufactured by unlicensed vendors. Not directly competing in the audio market, but as a very recognizable shape for some with the implied quality and appearance. He tried to make even an initial contact with them, mostly to find out of they could become a new resource as he was not fully satisfied with his present chassis manufacturer, and these unlicensed lookalikes were actually very well built. (We actually used one for his home media Slimserver) But at the very first email, they completely dissolved the organizational structure and vanished like smoke, only to have the exact same grey market devices appear under another entity within a few months.
Have seen all manner of grey-market Dell, HP, Asus, Cisco, Brocade (Silkworm), Qualcom, Foxconn, Liftmaster, ... the list goes on. I believe the terms for this are, unauthorised production, white branding, or three shift production in the cases where component subcontractors actually engage in overproduction of same or very similar devices.
In regulated markets; not being proactive about these issues can become quite risky. It really has been "buyer beware" pretty much the whole time.