Earlier was a topic about OBi devices who got the new firmware despite the fact the firmware update was disabled.
http://www.obitalk.com/forum/index.php?topic=3225.0
Now is gone and I'm disappointed by Obihai.
I can say with certainty that I will no longer purchase another OBi product and I will no longer recommend people purchase them.
OBi you have lost my trust. Why did you build a backdoor into your product? And why are you trying to hide that fact?
Mmmm, I'm not certain it's "hidden". It's practically implied with the partner provisioning guide and the Obiplus program.
Quote from: crazyk4952 on May 09, 2012, 07:48:12 PM
I can say with certainty that I will no longer purchase another OBi product and I will no longer recommend people purchase them.
OBi you have lost my trust. Why did you build a backdoor into your product? And why are you trying to hide that fact?
We've always known it was there.
Quote from: Ostracus on May 09, 2012, 08:10:46 PM
Mmmm, I'm not certain it's "hidden". It's practically implied with the partner provisioning guide and the Obiplus program.
Sort of. If you register your device and start configuring it through the dashboard, it's pretty obvious they are doing
something to control it remotely. But given it's
you configuring it, it's implied you're okay with that.
When your device isn't registered with their dashboard and you have explicitly disabled all provisioning on the device and they
still have control and push updates,
that is worrying.
Even if we assume each device is uniquely keyed and all communications between Obihai and the device is encrypted, you are unknowingly hosting an attack vector. If Obihai is compromised, there is nothing stopping custom firmware being uploaded to all devices and acting as a botnet. Or sniffing your SIP traffic and shuffling it off somewhere. Or anything, really.
I think remote control is a fantastic feature for supporting less technical customers, but it should have some semblance of being under your control. Make me answer the phone and enter a PIN before a remote user gains access -- even if they really still have control but are doing it to make you feel better.
As it stands, I can't trust my OBi110 will always work. I know it's configured correctly. I know it's working right now. I know I disabled every automatic thing I could. It still may be updated without my knowledge, introduce a bug, and break when I need it.
The more technical-minded of us may have always understood it was "backdoored," but fiddling with configuration without your consent is disturbing.
Whee, You say exactly what I was thinking!
There are reasons i had my auto firmware disabled, dang it! I'll roll back to what I had... if I can
... and pretty soon I'll be looking at some wireshark captures or just put some serious restrictions on what traffic is allowed from my obi... I'm guessing it phones home every so often.
What was the point of forcing this update on obi's that don't use GV?
Ugh.
--
MRTT
Quote from: whee on May 09, 2012, 08:41:22 PM
I think remote control is a fantastic feature for supporting less technical customers, but it should have some semblance of being under your control. Make me answer the phone and enter a PIN before a remote user gains access -- even if they really still have control but are doing it to make you feel better.
An OBi that is not associated with the OBiTALK Web Portal, has ALL its Auto Provisioning and Auto Firmware Update options set to Disabled, and has a strong ADMIN password in place, can still have its contents viewed, altered, or updated by Obihai without the knowledge or consent of the owner. It goes much further than just firmware updates.
Probably a call someone had to make - force update on everyone and fix most, and deal with exceptions
GM can access OnStar devices, OBiHai can access your VoIP adapters, and local utility company can access your thermostat - everything for your benefit, of course!
What they say? Just because you are paranoid doesn't mean that they are not after you >:(
Quote from: Felix on May 09, 2012, 10:23:42 PM
GM can access OnStar devices, OBiHai can access your VoIP adapters, and local utility company can access your thermostat - everything for your benefit, of course!
Companies that you allow to direct deposit money into your bank account can also debit money from that account.
Life is never a one-way street.
I started the thread that was removed.
It was an honest technical question on how the units were updated despite settings to prevent it. I think it is the first time one of my posts has been removed. Removing valid questions of a technical nature "does not help the cause" of selling the units. Next we will be asking ourselves if they have the ability to listen/record our conversations??? OBihai, how you handle this issue of trust can have a direct impact on your future sales. You are giving us the impression that there is a dark side to operating the OBi ATA. I don't have this concern with my other equipment providers. Imagine if you suspected your router manufacturer to keep track of what sites you are visiting.
Now that this topic has been tagged, I don't expect this post to last.
Quote from: jimates on May 09, 2012, 08:35:13 PM
Quote from: crazyk4952 on May 09, 2012, 07:48:12 PM
OBi you have lost my trust. Why did you build a backdoor into your product? And why are you trying to hide that fact?
We've always known it was there.
How did you know, it's in the manual, on their web site somewhere, an Obihai public announcement?
With all update, provisioning and Obitalk disabled are they still able to access the device?
If that's true it's totally wrong.
Obihai can you comment on that or if was posted somewhere can you provide a link please?
Quote from: Dan_voip on May 10, 2012, 02:20:26 PM
Obihai can you comment on that or if was posted somewhere can you provide a link please?
OBi silence on this topic is deafening! As they said in Nixon years - it's not the mischief that gets you; it's the cover-up!
I just want to know, do those who claim to have received the update but think they shouldn't have, have all of the following settings as shown:
System Management | Auto Provisioning | Auto Firmware Update: Method: Disabled
System Management | Auto Provisioning | ITSP Provisioning: Method: Disabled
System Management | Auto Provisioning | OBiTALK Provisioning: Method: Disabled
Voice Services | OBiTALK Service | Enable (Unchecked)
Especially check the last one because I'm being told that's the one that's important — you must have OBiTALK Service disabled or you may still get the updates!
Hi Everyone,
As most all of you are aware, an OBi device can make calls to other OBi devices and soft phones (running on smart phones, tablets and PCs) out-of-the-box. Customers use this capability to make calls to OBi devices to ring its attached phone or to bridge a call to a regular phone number -- using the OBi device as a VoIP gateway.
To maintain OBiTALK OBi-to-OBi calling functionality (and related features), Obihai may make configuration or software modifications to devices that use the OBiTALK Service. Otherwise, when there is a 'service' affecting issue, we may need to update its config or software. This is memorialized in the OBiTALK terms of service and this is what we did on Wednesday. There are no backdoors on Obihai products.
Service providers with whom we do business have access to additional provisioning capabilities that, depending on how they utilize the OBi device remote configuration process, can affect how the device behaves in relation to available OBiTALK-driven services. Just like individual owners of Obihai devices, service provider owners have 100% control over how the device operates.
By keeping OBiTALK Service and OBiTALK provisioning enabled, the following services are available today (more will be available in the future):
Including: Calling to/from your OBi to/from the OBiON for iPhone or Android and OBiApp for PC
- OBi-to-OBi-to-SIP or Google Voice Service Calling (and vice-versa)
- OBiTALK Device Configuration
Including Configuration of SIP and Google Voice Service(s)
Emergency Calling Service Set-Up
Convenient Setting Time-Zone, Attendant PIN, etc.
- OBiTALK Circle of Trust Invites / Acceptance
- Speed Dial Configuration Across All Your OBi Devices & Soft Phone
- Assignment of Trusted Callers' Phone Numbers for Access to the OBi Attendant for Service Bridging
- OBi Expert Cloud Based Configuration
By the way: We are Fixing the Config Import Function
- Direct Support from Obihai via e-mail or Phone
As for deleting topics (and posts) on the OBiTALK forum, we do this very rarely, but topics (or individual posts) are deleted when they contain falsehoods and/or inaccurate information that would be misleading and unproductive to the OBi user community. We want the forum to be place where a user can go to learn about how to use an OBi product without fear they will receive false information that would hinder their ability to use the product. QBZappy is one of the forum's top contributors and a valuable, knowledgeable asset to the community. QBZappy's topic-creating post was not the offending one, but there were several other posts that made there, making that particular thread worthless to the community. So we deleted it.
Thank you,
Sherman
sherman@obihai.com
Just for clarity...
In order for individual owners of Obihai devices to ensure their devices cannot be accessed, altered, or updated by Obihai in any way, all of the following options must be set:
System Management -> Auto Provisioning -> Auto Firmware Update -> Method : Disabled
System Management -> Auto Provisioning -> ITSP Provisioning -> Method : Disabled
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
Please confirm that after these options are set, Obihai will have no ability to access the device in any way.
Quote from: ShermanObi on May 11, 2012, 10:32:38 AM
To maintain OBiTALK OBi-to-OBi calling functionality (and related features), Obihai may make configuration or software modifications to devices that use the OBiTALK Service. Otherwise, when there is a 'service' affecting issue, we may need to update its config or software. This is memorialized in the OBiTALK terms of service and this is what we did on Wednesday. There are no backdoors on Obihai products.
Can you provide a list of all settings required to disable ObiTalk and any other features necessary so that OBi devices can no longer be accessed by anyone other than the physical owner/user?
Users who are concerned about security over features can then make a choice as to which they prefer.
I too would appreciate an official response to RonR's post above.
Also, please confirm that with the settings RonR quoted, OBi devices have no way to "phone home" or otherwise spontaneously make any attempt to provision themselves or upgrade their firmware, without the explicit action of the end user.
To answer questions from RonR and VaHam...
The following parameter settings will disable OBiTALK services.
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
Auto Firmware Update & ITSP Provisioning are parameters used primarily by ITSPs (and managed services VARs). OBiTALK does not use either of these parameters. Some individuals & organizations may use the Auto Firmware Update as described in this FAQ: Click Here (http://www.obihai.com/FAQ.html#How-do-I-automate-upgrades)
You have not explicitly answered RonR's, VaHam's, or my questions.
ShermanObi,
You did not confirm that after these options are set, Obihai will have no ability to access the device in any way.
Exactly what must be done to ensure that Obihai cannot view or alter a device's configuration nor update the device's firmware? What settings are required to prevent ALL outside access to an Obihai device by anyone other than the owner?
@Mango: Use the settings below to achieve the state for which you request confirmation.
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
@ronr: Confirmed.
Have a great weekend and thanks for your support.
Thank you very much for your response, and for all your hard work for the VoIP community.
I hope you as well have a great weekend! :)
ShermanObi,
Thank you for your reply. If you were more clear in your first reply, the last four posts were unnecessary in order to press you for a final and clear reply. You are obviouly replying to Mango and RonR directly, and indirectly to everyone else. The style of your responses makes me feel like I am reading the output of the big "OBihai syslog server". The reply is in human readable form, however sometimes I'm left scratching my head wondering if I understood the log message completely. It is sometimes too Borg like. Loosen up a little.
You know we all love your product. That's why we care.
Cann't wait for the next update. :)
Have a nice weekend.
Quote from: ShermanObi on May 11, 2012, 11:59:18 AM
To answer questions from RonR and VaHam...
The following parameter settings will disable OBiTALK services.
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
Auto Firmware Update & ITSP Provisioning are parameters used primarily by ITSPs (and managed services VARs). OBiTALK does not use either of these parameters. Some individuals & organizations may use the Auto Firmware Update as described in this FAQ: Click Here (http://www.obihai.com/FAQ.html#How-do-I-automate-upgrades)
Your response addresses disabling OBiTALK services and OBiTALK provisioning; but mentions that
OBiTALK does not use the Auto Firmware Update & ITSP Provisioning parameters. Are you saying that anyone who did not have those enabled, should not have been upgraded recently? Or are you saying that OBiHai ignores those settings and performs upgrades when it deems them to be necessary? Note I am saying OBiHai (the Company) not OBiTALK here; which would include OBiTALK and any other software operated or licensed by OBiHai.
The link you provided describes how enable auto upgrades. ("How do I automate upgrades to the most current available firmware?")
I remain uncertain that the above responds to my question. Which was:
QuoteCan you provide a list of all settings required to disable ObiTalk and any other features necessary so that OBi devices can no longer be accessed by anyone other than the physical owner/user?
Users who are concerned about security over features can then make a choice as to which they prefer.
I am asking for all settings necessary to keep anyone other than myself from being able to access my OBi's for any purpose other than simple processing of phone calls.
Quote from: VaHam on May 11, 2012, 05:21:25 PMI am asking for all settings necessary to keep anyone other than myself from being able to access my OBi's for any purpose other than simple processing of phone calls.
Check ShermanObi's Reply #21 on this topic and you'll have your answer.
I have those 2 settings disabled/unchecked and
I can confirm my firmware is still 1.3.0 (Build:
2690) so was not updated.
Beside those 2 you have to disable "Auto Firmware Update" and "ITSP Provisioning", that way you'll be sure your device will not be updated or provisioned.
The difference between Auto Firmware Update and OBiTALK provisioning/service enabled is for the 1st option the OBi device will check and ask for a firmware update while the 2nd one will allow Obihay to push an update to an OBi device.
ShermanObi,
Are you sure we have the full story?
With:
System Management -> Auto Provisioning -> Auto Firmware Update -> Method : Disabled
System Management -> Auto Provisioning -> ITSP Provisioning -> Method : Disabled
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
Dialing **5 + nnnn in response to the OBiTALK Web Portal's Add Device prompt allows the OBiTALK Web Portal to take full control of an OBi again and in the process re-enables:
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Periodically
Voice Services -> OBiTALK Service -> Enable : (checked)
For the purposes of this discussion, the only two parameter settings you need to touch are the ones associated with the OBiTALK Service. This makes sense, given the desire here is to configure the OBi device so it is untethered to the OBiTALK service.
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
With these settings, the OBi device has no association to OBiTALK services and features as described in my original post to this topic.
The Obihai platform is quite different from it's peers in the industry in the way it supports multiple services (including the OBiTALK service) and how it approaches multiple provisioned services to be supported simultaneously, e.g. ITSP + OBiTALK.
The Auto Firmware Update parameter is found in the System Management area of the OBi device management system architecture. This is for use by individuals and organizations who want to remotely manage the firmware residing on their OBi device(s). When not disabled, the Auto Firmware Update Method parameter will invoke a firmware update based on the settings and syntax of a couple other parameters called Interval and Firmware URL. There are also UN and PW parameters that can be set to further control how the OBi updates it's firmware.
A similar approach is used for the OBi device configuration profile management when the device is managed by a service provider. These parameters are found in the ITSP Provisioning area of the OBi device management system architecture. Again, the Method setting, when not disabled, will key on its sister parameters that tell the OBi when (Interval) to retrieve its service provider provisioned profile and from where to get it (URL).
These parameters, their function and usage are described in the OBi Device Provisioning Guide found in the Documents and Downloads section of the Obihai Support web page (Click Here (http://www.obihai.com/docs-downloads.html)).
@RonR - Yes. When a user adds their device to the OBiTALK portal, dialing **5 allows OBiTALK to associate the OBi with the correct user's account. But then you have probably never done that. ;)
Quote from: ShermanObi on May 11, 2012, 07:05:54 PM
@RonR - Yes. When a user adds their device to the OBiTALK portal, dialing **5 allows OBiTALK to associate the OBi with the correct user's account.
So, even with:
System Management -> Auto Provisioning -> Auto Firmware Update -> Method :
DisabledSystem Management -> Auto Provisioning -> ITSP Provisioning -> Method :
DisabledSystem Management -> Auto Provisioning -> OBiTALK Provisioning -> Method :
DisabledVoice Services -> OBiTALK Service -> Enable :
(unchecked)The OBiTALK Web Portal is still able to take control of an OBi and change its configuration to:
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method :
PeriodicallyVoice Services -> OBiTALK Service -> Enable :
(checked)
Quote from: ShermanObi on May 11, 2012, 07:05:54 PMBut then you have probably never done that. ;)
LOL that was the funniest line in the whole thread. ;D
Quote from: ShermanObi on May 11, 2012, 07:05:54 PMThe Obihai platform is quite different from it's peers in the industry in the way it supports multiple services (including the OBiTALK service) and how it approaches multiple provisioned services to be supported simultaneously, e.g. ITSP + OBiTALK.
Different from its peers is not always a bad thing. Look at Google Chrome. First major web browser to use/push SILENT UPDATES to all clients -- no user response and no notifications. Firefox seems to have now followed suit. While it raises some legitimate privacy concerns, I can see some benefits, as long as end users have an opt-out option as described above.
Quote from: RonR on May 11, 2012, 07:15:37 PM
Quote from: ShermanObi on May 11, 2012, 07:05:54 PM
@RonR - Yes. When a user adds their device to the OBiTALK portal, dialing **5 allows OBiTALK to associate the OBi with the correct user's account.
So, even with:
System Management -> Auto Provisioning -> Auto Firmware Update -> Method : Disabled
System Management -> Auto Provisioning -> ITSP Provisioning -> Method : Disabled
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
The OBiTALK Web Portal is still able to take control of an OBi and change its configuration to:
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Periodically
Voice Services -> OBiTALK Service -> Enable : (checked)
Don't get me wrong here I love my OBi and have recommended them to many other folks as well.
That being said I think a direct answer to my question has been side stepped here. My question is broader than "untethering OBiTALK" but rather includes settings necessary to completely disable anyone other than myself from gaining control of my OBi's.
Based on the above from RonR (I haven't tried the test myself) the reason my broader question has not been addressed, would appear to be that if there are settings which would dis-allow access by anyone other than myself, they are not being presented; since if what RonR says is true then OBiHai can certainly regain control via it's web interface even when the settings referenced thus far are all configured to dis-allow external control. And it follows that if OBiHai can regain control then someone else may be able to use the same method(s) to gain control.
So once again are there settings which will prevent ANYONE other than myself from gaining control of my OBi's? This is a yes or no question.
Quote from: ShermanObi on May 11, 2012, 07:05:54 PM
@RonR - Yes. When a user adds their device to the OBiTALK portal, dialing **5 allows OBiTALK to associate the OBi with the correct user's account. But then you have probably never done that. ;)
Then I guess we better not dial **5 + nnnn, or create an account to associate with.
.
Quote from: VaHam on May 12, 2012, 12:57:03 AMif what RonR says is true then OBiHai can certainly regain control via it's web interface even when the settings referenced thus far are all configured to dis-allow external control.
What RonR says is partly true. Keep in mind that in order for Obihai to regain control, the user of the device would need to dial **5xxxx. Based on what I've seen here, the function of **5xxxx appears to be to turn on OBiTALK Provisioning and OBiTALK Service, and add the device to OBiTALK.
So yes, if you turn on OBiTALK Provisioning and OBiTALK service, then OBiTALK Provisioning and OBiTALK service will be turned on.
Disclaimer: don't consider this me defending Obihai. I absolutely do not agree with automatic firmware updates turned on by default, and I
really don't agree with how it's not obvious this is happening, or that the way to disable it is not intuitive.
Quote from: Mango on May 12, 2012, 08:29:35 AM
What RonR says is partly true. Keep in mind that in order for Obihai to regain control, the user of the device would need to dial **5xxxx. Based on what I've seen here, the function of **5xxxx appears to be to turn on OBiTALK Provisioning and OBiTALK Service, and add the device to OBiTALK.
I guess I will have to setup a test to answer my question; by blocking network access to the OBi and then dialing the **5nnnn to see if the update and provisioning bits are enabled by the **5nnnn internal to the OBi itself or are switched on only after access to the OBi network is achieved. The reason I wonder about this is Sherman's earlier statement:
QuoteAuto Firmware Update & ITSP Provisioning are parameters used primarily by ITSPs (and managed services VARs). OBiTALK does not use either of these parameters. Some individuals & organizations may use the Auto Firmware Update as described in this FAQ:
(emphasis added)
If these are not used by OBiTALK then why are they being enabled by OBiTALK?
System Management -> Auto Provisioning -> Auto Firmware Update -> Method : Disabled
System Management -> Auto Provisioning -> ITSP Provisioning -> Method : Disabled
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (checked)
So even though Auto Provisioning in the above is disabled Auto Provisioning & Auto Firmware Update can still occur if OBiTALK Service -> Enable : is (checked)?
Update: I guess this is the answer to the above, "To maintain OBiTALK OBi-to-OBi calling functionality (and related features), Obihai may make configuration or software modifications to devices that use the OBiTALK Service. Otherwise, when there is a 'service' affecting issue, we may need to update its config or software. This is memorialized in the OBiTALK terms of service and this is what we did on Wednesday." It appears they can override the "OBiTALK Provisioning -> Method : Disabled" setting.
Quote from: Mango on May 12, 2012, 08:29:35 AM
What RonR says is partly true. Keep in mind that in order for Obihai to regain control, the user of the device would need to dial **5xxxx. Based on what I've seen here, the function of **5xxxx appears to be to turn on OBiTALK Provisioning and OBiTALK Service, and add the device to OBiTALK.
So yes, if you turn on OBiTALK Provisioning and OBiTALK service, then OBiTALK Provisioning and OBiTALK service will be turned on.
This is NOT the case. Dialing **5nnnn does NOT turn on OBiTALK Provisioning nor the OBiTALK Service. I tried numerous variations and tests, with and without rebooting, etc. **5nnnn always reports that nnnn was sent to the provider but no change occurs to the OBi at that point. It's only when the OBiTALK Web Portal receives the expected nnnn that the OBiTALK Web Portal sends the necessary commands to the OBi that OBiTALK Provisioning and the OBiTALK Service are re-enabled and the OBi is again under Obihai control.
It's very clear that setting:
System Management -> Auto Provisioning -> Auto Firmware Update -> Method : Disabled
System Management -> Auto Provisioning -> ITSP Provisioning -> Method : Disabled
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
does NOT prevent Obihai from taking control of an OBi.
I think your test was incorrect - by dialing **5nnnn you will trigger communication from Obi to Web Portal, and by the end of this communication ObiTalk service will be enabled on your device.
That does not mean that Web Portal (or other service) would be able to do this without you doing ***5 first.
The only way to be 100% sure that Obi can not get access to the devices - is to sniffer the traffic...
However, I do not thing it is worth to do.
P.S. I have ObiTalk service disabled and did not get firmware upgrade.
Quote from: shap on May 12, 2012, 11:23:03 AMThat does not mean that Web Portal (or other service) would be able to do this without you doing ***5 first.
Bingo. With no NAT hole open in your router and no communication initiated by the device, no one from outside could possibly gain access to your device. This is basic networking 101.
FTR, I've been running Wireshark to monitor my OBi110 for the past two days and so far can confirm that Sherman's statements are correct.
Quote from: Mango on May 12, 2012, 12:31:37 PM
I've been running Wireshark to monitor my OBi110 for the past two days and so far can confirm that Sherman's statements are correct.
With everything disabled and without being logged into any OBiTALK account, dial **5 + any4digitnumber and watch Wireshark. You'll see your OBi's product information (SerialNumber/OBiNumber/etc.) being sent off to Obihai. I guess in addition to the disabling Auto Provisioning and the OBiTALK Service, there needs to be a warning to never dial **5 as there's no way to disable it (as far as I'm aware).
Quote from: shap on May 12, 2012, 11:23:03 AM
I think your test was incorrect - by dialing **5nnnn you will trigger communication from Obi to Web Portal, and by the end of this communication ObiTalk service will be enabled on your device.
That does not mean that Web Portal (or other service) would be able to do this without you doing ***5 first.
The only way to be 100% sure that Obi can not get access to the devices - is to sniffer the traffic...
However, I do not thing it is worth to do.
P.S. I have ObiTalk service disabled and did not get firmware upgrade.
Note: RonR says that no changes take place until after a successful connection to the OBi servers using the correct 4 digit authentication code. You don't need to sniff with wireshark or even block the OBi's ip at the border router to test this. Simply make up a four digit code which will be incorrect (i.e. **51234). The Obi will announce in voice that the code has been sent to the server however since the code is incorrect no changing of the bits takes place. What this tells you is, that it is the sequence of commands being returned to the OBi which in fact modifies these bits and regains control of the device. The control bits are not being changed autonomously by the **5nnnn command executed in the device itself without successfully connecting to the OBi server. Thus it is the server and not the device command which changes the control bits.
What that means is there must be some sequence of commands being returned by the OBi server which actually turns on or allows the Auto Provisioning and Firmware Update control bits to be changed.
If that is the case, then if OBiHai can do it then it may also be possible that the same commands could be hacked and used by someone else to do the same thing.
While the OBi can happily work behind a firewall, a firewall should not be required in order to assure protection of the device. What about remote users who have the OBi connected directly to a modem?
I am also still puzzled by the statement that OBiTALK does not use these control bits; why are they then being changed by OBiTALK?
Quote from: VaHam on May 12, 2012, 02:09:51 PM
Quote from: shap on May 12, 2012, 11:23:03 AM
While the OBi can happily work behind a firewall, a firewall should not be required in order to assure protection of the device. What about remote users who have the OBi connected directly to a modem?
Not always. My Obi works fine behind a firewall with Google Voice but there was nothing I could do with the 3600 HGV to let it work properly with Localphone, with the result that my Obi is in DMZ and open to such possible attacks.
I am not overly concerned with Obihai's access to my device nor with privacy which is quite an elusive thing in these days and latitudes, but I definitely think that Obihai should spend some effort in order to make the device secure from hackers.
Quote from: VaHam on May 12, 2012, 02:09:51 PMWhile the OBi can happily work behind a firewall, a firewall should not be required in order to assure protection of the device. What about remote users who have the OBi connected directly to a modem?
I wouldn't suggest you run a VoIP device - or any Internet-connected device for that matter - without a firewall.
With Voice Services -> ObiTalk -> Enable -> UNchecked, dialing **5 alone is harmless. After a few seconds the Obi plays Fast Busy [error] and does nothing, as it should.
Update; I also tried **5 + [random 4 digit #] and did not see any changes in any Obi settings, even after a manual reboot.
Quote from: ProfTech on May 12, 2012, 07:18:24 PM
With Voice Services -> ObiTalk -> Enable -> UNchecked, dialing **5 is harmless. After a few seconds the Obi plays Fast Busy [error] and does nothing, as it should.
Of course. But try **5 + 4 or more digits and watch with Wireshark.
Quote from: ProfTech on May 12, 2012, 07:18:24 PM
Update; I also tried **5 + [random 4 digit #] and did not see any changes in any Obi settings, even after a manual reboot.
Correct. But if you send the 4 digits that the OBiTALK Web Portal is expecting for an Add Device, the OBiTALK Web Portal can still take control of your OBi even though you have Voice Services -> ObiTalk -> Enable ->
UNchecked.
Quote from: RonR on May 12, 2012, 07:43:39 PM
Quote from: ProfTech on May 12, 2012, 07:18:24 PM
Update; I also tried **5 + [random 4 digit #] and did not see any changes in any Obi settings, even after a manual reboot.
Correct. But if you send the 4 digits that the OBiTALK Web Portal is expecting for an Add Device, the OBiTALK Web Portal can still take control of your OBi even though you have Voice Services -> ObiTalk -> Enable -> UNchecked.
Oh, get real. First of all, sending a firmware update (even one you may not have expected) is not the same as "taking control of your Obi" except in your paranoid way of thinking. Second, only an idiot would dial **5 plus the four digit code that the Obihai portal expects if they did not want to use the Obihai portal to manage their device.
You have beat this horse until it is dead and rotting, and now that it has been shown how to disable Obihai's access to your device (unless you go out of your way to re-enable it) you seem to be grasping for any straw to make the case that Obihai is doing something bad. Now it appears you are at the point where you are saying that if someone deliberately tries dialing something that is only normally used to associate an Obihai device with the OBiTALK portal, they should be upset if it actually does get associated with the OBiTALK portal and the portal functions as intended.
If you hate Obihai so much — and you really must, considering the way you are always backstabbing them on BroadbandReports (and possibly other places we don't know about) — why don't you sell your Obihai devices and make a graceful exit, instead of sounding like a nagging wife that has grown to hate her husband, but would rather torment him than get a divorce?
I think you fail to understand that probably 99% of Obihai users really don't care if Obihai sends them a firmware update that fixes a problem. It's only the people who have taken your bad advice, and a few other more technically oriented types, that would even try to disconnect from using the OBiTALK portal (not counting service providers here because they probably already knew about this) and even many of those people probably wouldn't really care if they received a firmware update, as long as it doesn't break anything. So you have the handful of people who do have a valid reason for not wanting a firmware update, plus perhaps a few others who have an unreasonable paranoia, and it always amazes me that the latter group has an Internet connection to begin with. They'd really be freaking out if they only knew what information their web browsers are sending out!
Whose interests should Obihai be more concerned about, the ~99% that just want their devices to keep working with minimal intervention on their part, or you and the handful of others that think like you, or that you have influenced? Believe it or not, keeping
you happy is probably NOT Obihai's primary concern.
It seems to me like there are a handful of people at most that are still really concerned about this — I keep seeing the same few names on posts that are still raking the muck over this issue. The rest of the Obihai users just don't care, because they aren't like you. For one thing, they
want to use the OBiTALK portal because it makes it so much easier to configure their device, and for another, they might actually see it as an advantage if Obihai is proactive about keeping their devices working correctly. Now, you might say "but I don't want Obihait to do that on my device!" Well, fine, you now know how to disable Obihai's access to your device. But if you still don't trust Obihai, there's always eBay or Craigslist — use one of them to sell your devices and find some other device manufacturer to stab in the back (and I suspect you would). Or, you could try just giving it a rest already, and not being so damn annoying!
I had hoped to avoid giving hackers ideas but it seems that the concern of some here is being missed; so I will spell it out.
Since as Sherman stated OBiHai does not "use" (read that as honor) the allow firmware upgrade and allow Remote Provisioning control bits as evidenced by the fact **5nnnn works even when the control bits have both been disabled locally this means that any server spoofing the OBiHai server could do the same thing after cracking the OBiHai authorization scheme provided they have access to the proper ports. I will not go any further in talking about how that may accomplished; but I can envision scenarios where this can take place. As someone pointed out being behind a good firewall is a great layer of security; but even that cannot be 100% since the OBi device has to have some port(s) open, at least at times, in order to function as a VOIP device and no I will not discuss that any more; those of you who understand probably already know about such things.
The assumption is that issuing the **5nnnn, by the connected phone, is the only method which would allow a sequence of commands between the OBi device and the server is to perform firmware upgrades or provisioning or as we have seen even re-enable the control bits. I am not convinced this is the case. The only way to be certain would be if OBiHai honored the control bits themselves internal to the code running on the OBi device.
You need only to look at the methods used to unlock SPA2102 to see how to do that sort of thing by making a device think it is connecting to a provisioning server.
Yes I realize that for this to take place remotely DNS modification would be required but if you think this is not possible then you should take a look at https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS and study the background surrounding that issue.
Call it paranoia, if you will, however I have been around long enough to know that if there is a way, there there is a will to exploit it by some; who are willing to go to great lengths to do so. Scrutiny normally makes products better.
Does having the ability to perform a remote firmware upgrade constitute taking control? Well if someone can change your firmware then yes they have completely taken control.
I can understand why OBIHai designed their software to be able to regain control even though the control bits have been set by the user to dis-allow this. It is so that non-savvy users who have disabled these can be accommodated in spite of themselves.
IMHO this does leave a potential security hole no matter how small which could be plugged with a very simple change to the OBi devices internal software; namely honoring the control bits absolutely. (including when connecting to the OBi servers)
I love my OBi's and I want them to continue to be GREAT devices!!!!!!
I agree with you on principle about how the devices should function. However...
Quote from: VaHam on May 13, 2012, 09:53:26 AMAs someone pointed out being behind a good firewall is a great layer of security; but even that cannot be 100% since the OBi device has to have some port(s) open, at least at times, in order to function as a VOIP device
As long as you're not using manual port forwarding or DMZ, and your router uses restricted cone NAT, the ports would be open only to your VoIP provider, and the router should still block incoming traffic from other sources.
Quote from: VaHam on May 13, 2012, 09:53:26 AMYes I realize that for this to take place remotely DNS modification would be required but if you think this is not possible
It's certainly possible. The bigger issue is that if I'm using rogue DNS, I've already been compromised. Yes, a cracker could access my OBi device, but they could also access every other VoIP device I use, and any other device on my network.
Quote from: VaHam on May 13, 2012, 09:53:26 AM
Does having the ability to perform a remote firmware upgrade constitute taking control? Well if someone can change your firmware then yes they have completely taken control.
I've posted about this in the past, but those posts were quietly deleted with no comment or explanation.
The capability in question is not simply one of being able to remotely update the firmware. The code present in the OBi firmware allows Obihai to read (i.e. view) and write (i.e. change) all configuration settings (and presumably, any or all of the OBi's contents). This capability exists even though ALL Auto Provisioning options are set to Disabled and a strong Admin password is in place. This is not simply conjecture. This comes from first-hand personal experience. Although we're now told that disabling the OBiTALK Service (previously thought to be used only for OBi-to-OBi calls) will prevent such access, there's no way at this point to actually prove it with 100% confidence.
I've also stated in the past and want to reiterate that I'm not accusing Obihai of ever being involved in malicious behavior. The problem is that without clear disclosure and the ability to confidently opt out of such a capability, the possibility for abuse by a rogue employee, a security breach within Obihai, or hacking exists.
Quote from: Mango on May 13, 2012, 11:30:16 AM
I agree with you on principle about how the devices should function. However...
Quote from: VaHam on May 13, 2012, 09:53:26 AMAs someone pointed out being behind a good firewall is a great layer of security; but even that cannot be 100% since the OBi device has to have some port(s) open, at least at times, in order to function as a VOIP device
As long as you're not using manual port forwarding or DMZ, and your router uses restricted cone NAT, the ports would be open only to your VoIP provider, and the router should still block incoming traffic from other sources.
The key word there is should :)
If your router or any upstream DNS were infected with a rogue DNS (as some have been - ref: the fbi article) then the culprit could also masquerade as your voip provider. Again I think we both agree that having a good firewall is a sound practice for providing a layer of security; but it is only one layer. Most folks also have a second firewall running on their desktop computer (a second layer of defense). If all routers were perfect then the firewall on your desktop would be totally unecessary; alas they are not all perfect and hence IMHO having the firewall on my desktop is a valuable additional layer of security.
Do I view the way the OBi's are currently configured as some big security hole? Centainly not Do I think the minor weakness could be addressed? Yes
Quote from: VaHam on May 13, 2012, 09:53:26 AMYes I realize that for this to take place remotely DNS modification would be required but if you think this is not possible
Quote from: Mango on May 13, 2012, 11:30:16 AM
It's certainly possible. The bigger issue is that if I'm using rogue DNS, I've already been compromised. Yes, a cracker could access my OBi device, but they could also access every other VoIP device I use, and any other device on my network.
I agree that any other device on your network may be accessable but not that the culprit would have access to make any changes to the other devices configurations. Whether or not your other devices are susceptible to being compromised would be up to the design of those devices. A well designed device should itself have a layer of security internal to that device, just as your desktop computer uses a firewall.
The best method of assuring a devices security is to dis-allow modifications without physical access to the device. (i.e. pressing a button or having a jumper etc. on the device before allowing firmware updates). The next best thing would be to have a permission bit (honored by all) to allow webaccess to the device only from the sub-net the device is located on and honoring the permission bits for updates and provisioning. The latter could be implemented by OBiHai in a software update if they so chose. Both methods would allow the user/owner to make choices on whether they want to receive automatic updates or not.
And everyone should test their DNS security frequently but I doubt that many do.
I know in the past when an Obi had trouble, Obihai has only ask for an email including the Obitalk # for the device. They never asked to set provisioning in a certain way, just provide the number. This did suggest that they had a way to access the device with minimal effort, and without proprietary settings on the device. If that is bad (for anyone in particular), then so be it.
For those that do not use google voice, and those that do not want Obihai to update your firmware, perhaps the new knowledge for settings will help.
This recent occurrence involved only a google voice problem. If google was really providing a service they may have fixed themselves (or not caused it in the first place). Personally, I prefer my device remain operable with google voice, even if that mean letting Obihai maintain it for that purpose. And considering all the info I knowingly put out to the world, I can't think of anything anyone could get through my Obi device that would be detrimental.
Quote from: jimates on May 13, 2012, 02:01:51 PM
I know in the past when an Obi had trouble, Obihai has only ask for an email including the Obitalk # for the device. They never asked to set provisioning in a certain way, just provide the number. This did suggest that they had a way to access the device with minimal effort, and without proprietary settings on the device. If that is bad (for anyone in particular), then so be it.
For those that do not use google voice, and those that do not want Obihai to update your firmware, perhaps the new knowledge for settings will help.
This recent occurrence involved only a google voice problem. If google was really providing a service they may have fixed themselves (or not caused it in the first place). Personally, I prefer my device remain operable with google voice, even if that mean letting Obihai maintain it for that purpose. And considering all the info I knowingly put out to the world, I can't think of anything anyone could get through my Obi device that would be detrimental.
As you pointed out the settings do not prevent OBiHai or under certain rare circumstances (as we have beat to death) others from modifying the software on the OBi device.
If your only using Google Voice then probably not much damage could occur if someone gained control of your OBi; however if you use any paid sip provider then this is another matter. If they gained access and starting routing calls using your sip information then you'd get a bill for the use.
It is for that reason I only use pay as you go sip providers and never select auto pay. That way my liability is limited to the amount of funds I place into the account. Just another layer of security against a
$100,000 phone bill. (http://www.computerworld.com/s/article/9194041/Security_Manager_s_Journal_Slammed_with_a_100_000_phone_bill)
You might want to read the comments and take that article with a grain of salt.
I think it is great that they fixed there own service obi talk.. i use obi talk at 30 plus sites in fact it was the only thing working last week. when the gv died.. i knew that when i setup this phone system. that is why i have all the office call office to office using the obi talk service.. it should always work it is part of the service that obi takes care of.. i understand that they can make changes to the device to make sure that the obi talk service works.. in fact i am glad they do take such action to make sure there obi service is up and runing all the time.. as far as the post being removed.. i understand that calling a back door in a device that has service from a vendor it not correct.. if you have the service obi talk and take advantage of the service on the device then you can expect they will make changes to the deivce or service any time they want..
so the admin was correct in removing the post and in explaining how the obi talk service works..
I'm really surprised they don't delete more of RonR's posts. He may be a knowledgeable user in some areas (such as Obihai dial plans) but it is obvious he is no friend of Obihai.
The thing is that there is a small percentage of users, I'd guess under 10%, that are what I would classify as paranoid about security. They think you cannot possibly be too security conscious. These are people who would sacrifice usability for security. Every time they see an article where someone, somewhere in the world got hacked, they think they're next.
But the vast majority of people prefer usability to security. To prove that you only need look at the relative acceptance of Windows vs. Mac OS X or especially Linux. And while you could argue that OS X is getting more popular, that also has to do more with relative usability than with any sudden desire for increased security. But at this point Windows is still the most popular OS, even though it's widely recognized as the least secure. If the average user were more concerned about security than usability, Linux would have been the dominant OS a long time ago.
When it comes to a VoIP device, the vast majority of people just want it to keep working, and appreciate the update. In fact, if Obihai could guarantee that an update couldn't "brick" a device (because the power just happened to get disconnected in the middle of an update), I'd have no problem with them sending every firmware update automatically. So you have the vast majority of people who appreciate such updates, and a handful of complainers that are going to gripe about it. Which group should Obihai cater to? It's pretty clear that from the beginning they have wanted to create a device that average users (those without a lot of technical knowledge of VoIP) could set up and use.
Maybe guys like RonR will deem the Obihai too "insecure" for his tastes, since he seems to dwell on the negative and envisions bad things that might happen (the "if this, then that" fallacy, where in reality "that" does not, and in all probability never will, follow "this"). In that case, there are other VoIP devices out there that he could try; perhaps one of those would better meet his needs (personally I doubt it — I suspect he'd find some reason to complain about whatever device he uses). But if Obihai had let almost their entire user base remain in a state where their devices would not work as expected until they figured out that they needed to upgrade their firmware (since I suspect that most of the people that have purchased an Obihai have done so to use it with Google Voice), I suspect you'd have seen a lot more people badmouthing the Obihai as unreliable over the last few days.
Please keep in mind that Obihai has to think about their entire user base, not just a few vocal complainers. I'm not saying that they shouldn't attempt to satisfy as many users as possible, but sometimes if you do something that makes one group happy, it ticks off another. Look at Microsoft, they have grudgingly attempted to tighten security a bit, but I doubt they will ever adopt the cumbersome permissions/ownership security of Linux/Unix (OS X uses it too, but has been more successful in insulating users from it). They know who their users are and what they want, which is a computer that's as easy to use as possible. I think perhaps that's the market Obihai is trying to capture as well, not necessarily the "security paranoid" types.
If I report a problem, I want Obihai to be able to look inside my device and figure out what's wrong and fix it, and I really don't care if I don't have to flip some switch or set some bit — in fact, I'd prefer it if I didn't have to. If something that Google does requires a firmware update, I want Obihai to be able to send me the fix, and I might even prefer they do it before I miss any incoming calls because I don't know the problem exists. If someone strongly feels otherwise, and doesn't fully trust that the method Obihai has given for disabling such access will work, then perhaps they are in the same boat as the person who refuses to run Windows and will only use Linux because they just don't trust Windows. I'm not saying they are wrong, but they need to be realistic and understand that most people do not share their viewpoint.
Maybe someday, someone will come out with an open source VoIP adapter with airtight security, and it will take 10 years to get 5% of the VoIP adapter market (if what has happened with Linux is any guide). But I don't think that is the market that Obihai is aiming for.
(And no, I don't run Windows - I have machines with both OS X and Ubuntu Linux. I'm just making a point here.)
Hmmm, there just might be Linux under the hood.
arm processor custom image.. and hardware interface to that kernel image.. for the obi..device..
then all the features that we pay nothing for after we buy the device and the upgrades..are free..
man what do people expect.. i wonder some days how much work that people expect for an admin or a company to do now days.
man these people should buy a piece of cisco gear some time..and see how much the maintance contracts alone cost..lol
may the force be with obi staff .. you work is not in vain and i am proud to use your product and recommend it to others..
Good points made by each and every poster. (excluding myself)
Are we done here?
Correct. But if you send the 4 digits that the OBiTALK Web Portal is expecting for an Add Device, the OBiTALK Web Portal can still take control of your OBi even though you have Voice Services -> ObiTalk -> Enable -> UNchecked.
Then just add an IP block in your router... Your Obi will never be able to contact earth!
In my opinion attempting to degenerate people who are discussing technical issues by using terms such as ("paranoid about security", "handful of complainers that are going to gripe", "dwell on the negative", "a few vocal complainers") is uncalled for. Genuine skepticism (http://www.drgaryschwartz.com/TRUE-SKEPTICISM.html) is very good thing and often leads to better ideas and products. From the preceding link
Quote"Pseudo-skeptics often are typically disbelievers - i.e. they are firmly entrenched in believing "no" about certain things. Although they may "claim" that they are open to new information, they typically react with strongly unfriendly if not hostile criticisms when their beliefs and assumptions are challenged by new ideas and evidence."
Now back to technical issues!
First with regard to the notion that security conscious folks are paranoid, the old cliche comes to mind. Just because your paranoid doesn't mean there not out to get you. There are in fact many examples out there of people incurring costs as a result of voip hacking. Googling the terms "voip hack phone bill" yields over 1,450,000 links many many of which discuss real life instances where damage has been done.
I know for a fact, from my system logs, that my own home systems have been scanned by hackers looking for voip vulnerabilities. The following links also appear to deal with voip security concerns:
http://michigantelephone.wordpress.com/2011/04/30/do-you-use-webmin-to-configure-iptables-and-also-run-fail2ban-dont-forget-to-do-this/ (http://michigantelephone.wordpress.com/2011/04/30/do-you-use-webmin-to-configure-iptables-and-also-run-fail2ban-dont-forget-to-do-this/)
http://michigantelephone.wordpress.com/tag/security/ (http://michigantelephone.wordpress.com/tag/security/)
http://michigantelephone.wordpress.com/2010/11/16/link-interesting-security-technique-for-asterisk-and-freepbx-users-may-work-with-other-sip-based-pbxs-also/ (http://michigantelephone.wordpress.com/2010/11/16/link-interesting-security-technique-for-asterisk-and-freepbx-users-may-work-with-other-sip-based-pbxs-also/)
Most savvy people in addition to placing their PBX servers behind router firewalls use iptables (firewall) running on their servers and fail2ban to detect attacks and other techniques to enhance their security. I think the ratio of those savvy folks who are concerned enough about security to protect their PBX systems against attack to those who do not, would be more on the order of >90% who do to <10% who do not.
Regarding the issue of usability vs security I certainly would agree that most people would choose to have good usability. Security, problem detection/correction and functionality are all key to maintaining good usability and need not be mutually exclusive.
When questioned regarding how to control if and when updates occur the following statement was made:
Quote from: ShermanObi on May 11, 2012, 11:59:18 AM
To answer questions from RonR and VaHam...
The following parameter settings will disable OBiTALK services.
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
Voice Services -> OBiTALK Service -> Enable : (unchecked)
Auto Firmware Update & ITSP Provisioning are parameters used primarily by ITSPs (and managed services VARs). OBiTALK does not use either of these parameters. Some individuals & organizations may use the Auto Firmware Update as described in this FAQ: Click Here (http://www.obihai.com/FAQ.html#How-do-I-automate-upgrades)
This statement is of coarse true and if one is not using the ObiTALK service then presumably (and as Mango's tests have confirmed) the Obi device does not attempt to connect the mothership (ObiHai's server). If the device is not connecting then it's current ip address is not being reported to the ObiHai server and thus an update push cannot occur because OBiHai would not know what ip to send the push to.
Now think about Ron's test which have been confirmed by others that a **5nnnn does not in and of itself changed the ObiTALK Provisioning or ObiTALK Voice Services enable bits on and yet the ObiHai device gets provisioned. Provisioning (http://en.wikipedia.org/wiki/Provisioning) is a broad definition which in this case includes the ability to perform firmware update. ObiTALK provisioning is a separate function from use of the ObiTALK service. It appears to be that under normal circumstances the ObiTALK provisioning control bit is honored by ObiHai and when a new update is available that fact is displayed on the ObiTALK control webpage. The user can then at their discretion click and begin a firmware update. That decision however of whether to honor the control bits or not has to be taking place on the ObiHai servers and not in the devices firmware. IMHO that decision should take place in the devices firmware and if auto provisioning is dis-allowed then no firmware update should be possible by anybody. Apparently, although the ObiTALK auto provisioning and ObiTALK service are two separate functions, ObiHai has chosen to not allow the use of the OBITALK service without having the ability to auto provision so even if the ObiTALK provisioning bit is disabled under some circumstances such as last week they can push an update (provided of coarse they can find the ip address of the Obi to push the update to) at least that is what I deduce from Sherman's comments. I would be interested to hear if any folks who had the ObiTALK auto provisioning disabled but the ObiTALK service enabled received a push last week or not.
These decisions on how to act on control bit settings could easily be taken care of in the device itself instead of at the server. Thus no usability or functionality would be changed, but control of whether automatic updates take place or not, would be firmly in the hands of the customer where they can make their own choices.
I would have no problem with the ObiTALK auto provisioning and ObiTALK service control bits being enabled by default (as delivered), as a direct function of a **5nnnn or even with a firmware reset; provided the decision took place in the device itself, thus making certain that there are no ways for the devices to be modified without the users control ("back doors") if you will. Upon a power up I would expect them to be unchanged.
As MichiganTelephone eluded to in his statement " if Obihai could guarantee that an update couldn't "brick" a device (because the power just happened to get disconnected in the middle of an update), I'd have no problem with them sending every firmware update automatically". Which is an excellent reason why automatic (server push) firmware updates should not take place; since ObiHai has no practical way of knowing the current circumstances at the Obi device's location. If your in the middle of a big thunder storm performing a firmware upgrade would not be a wise thing to attempt, if you wish to avoid bricking your device. Now if I got my Obi's for free, or ObiHai agreed to replace any devices which became bricked during a server push firmware update I would not be concerned about that aspect of server push updates.
If the user, say has a UPS in place and is comfortable with accepting the risks associated with receiving automatic updates then they could also choose to turn on ObiTALK provisioning, which should be honored by ObiHai, and the push would take place without them being aware of it. I think that should be up to the user to decide absoultely.
The question was raised about promptly dealing with wide spread problems. One method would be to blast a phone message to ObiTALK service users to inform them that an update was available. The ObiTALK service has to be working in order for ObiHai to push out an update why not use it to inform the users, at least those using the ObiTALK service.
I would suggest a better method of dealing with that situation would be to send an email to all customers informing them of the problem and notifying them that an update is available. This method would help all and not just those customers using the ObiTALK service of the problem/solution. The update could then be performed by the user when practical for them (like when the thunder storm has passed) either thru the webpage or by dialing **X to trigger an update.
A combination of the voice blast and email would be even better since it would cover those who had immediate access to either the Obi's phone line or email if they for instance are mobile at the time and receive their email via cell phone etc.
Even the evil Microsoft allows users to choose their own settings for automatic updates. The user can opt not to receive them at all, receive them but not install them automatically or receive them and install them automatically. But it is the customers choice!!!!!
There are many ways to skin a cat and if you can accommodate all, fairly easily, without sacrifice to others then I would suggest that is the best scenario.
From the OBi Device Provisioning Guide:
QuoteAuto Recovery Mode
The OBi device may enter into an auto recovery mode to address and remedy a failure of a firmware upgrade, such as power lost in the middle of the upgrading procedure etc. In this mode, the OBi device tries to get firmware from the last URL where the firmware was successfully downloaded until the firmware is downloaded or the device is powered off. If the firmware is downloaded, the OBi will install the firmware automatically and restart itself, and progressively return to normal mode. While the device keeps retrying, the firmware can be installed from device management pages as well.
Quote from: Ostracus on May 15, 2012, 09:40:41 AM
From the OBi Device Provisioning Guide:
QuoteAuto Recovery Mode
The OBi device may enter into an auto recovery mode to address and remedy a failure of a firmware upgrade, such as power lost in the middle of the upgrading procedure etc. In this mode, the OBi device tries to get firmware from the last URL where the firmware was successfully downloaded until the firmware is downloaded or the device is powered off. If the firmware is downloaded, the OBi will install the firmware automatically and restart itself, and progressively return to normal mode. While the device keeps retrying, the firmware can be installed from device management pages as well.
I added the bold since it is this portion I would be worried about knowing how other devices behave under re-flash conditions. I don't really think this is a guarantee but I'd be happy to be corrected on that issue by OBIHai. :)
If you look through the postings you will see at least 1 person that reported that he was running with ObiTalk -> Enabled -> UNchecked and auto firmware update disabled and they did not receive the update. So I think that particular question has been answered.
Modified: I re-read your post. I for one had Auto provisioning disabled but ObiTalk Enabled [checked] and yes I did receive the update but haven't been overly concerned about it. I have since unchecked ObiTalk since I don't really use it anyway. I need something more flexible and "Commercial".
Quote from: VaHam on May 15, 2012, 09:17:35 AM
I would be interested to hear if any folks who had the ObiTALK auto provisioning disabled but the ObiTALK service enabled received a push last week or not.
The first thing I set when I take a new OBi out of the box is:
System Management -> Auto Provisioning -> Auto Firmware Update -> Method : Disabled
System Management -> Auto Provisioning -> ITSP Provisioning -> Method : Disabled
System Management -> Auto Provisioning -> OBiTALK Provisioning -> Method : Disabled
I also change the Admin password from 'admin' to a private password known only to me.
The OBiTALK Service was always enabled as it had not been disclosed that by leaving it enbled, the above settings are negated.
With these settings, I have had the firmware in OBi's updated on numerous occasions (sometimes at inopertune times).
As I've previously stated, access to the OBi's contents is also open with the above settings as evidenced by the following response I received to a question I asked via email:
"We just checked your OBi's configuration 200 123 456
SP2's X_InboundCallRoute has {('asterisk'):}, ..."
I don't dismiss security concerns at all, however they need to be considered in terms of realistic exploits..
I've tracked network traffic from power-up through the the **5nnnn via wireshark.
The Obi110 requests addresses for 'prov.obitalk.com' and 'root.pnn.obitalk.com' (I have provisioning enabled). This DNS resolution appears to happen only at Obihai powerup. Also ntp servers and google server names are resolved by DNS. So yes we should be concerned about DNS security. Primarily wrt ISP name resolution.
The '**5nnnn' call causes the Obihai110 to make a tcp connection to 'root.pnn.obitalk.com' port 6800. Some minor tcp traffic takes place however the identification number for the ObiHai110 is sent unencrypted. Then it *appears* that an SSL.v3-like connection is setup on the TCP connection after exchanging some Obihai self-signed certs. The openSSL certs sent to the Obihai are not verified via any public service like Verisign, however that doesn't mean they aren't verified against an in-firmware cache. *Assuming* that the key exchange is secure and note the crypto selected (AES-256) is good - then the content of the traffic after SSL setup is quite safe. IOW the cert exchange and SSL means that Obihai device can be quite certain it is communicating to the Obihai server and not to a fake server, and the encrypted traffic is 'safe enough'. The security issue is similar to the concept of pointing your web browser to your bank and accepting the https certificate as assurance you have the correct site.
SO *ASSUMING* the key exchange is secure, and the certs are verified from firmware .... an exploit requires an evildoer to steal the private crypto key from Obihai, install a DNS or IP routing exploit to send traffic to his evil-server with a matching cert, and then he must arrange for the '**5nnnn' sequence to be entered on the phone, then he must download evil-firmware to the Obihia or at least change the settings.
I am greatly reassured knowing that there some sort of secure connection on this channel. I'd like to hear more about the cert verification issue - but so far I have no reason to doubt or distrust ObiHai's design decisions.
I wonder of the firmware download and ObiTalk remote settings use a similar secure channel ?
For anyone concerned, adding !**5S0| as the first sequence of your PHONE Port DigitMap appears to block access to this code.
Very nice work steve! I am handicapped at the moment since I loaned my only Ethernet hub to a friend and don't have it available to assist with wiresharking right now.
Quote from: stevea on May 15, 2012, 03:09:21 PM
I don't dismiss security concerns at all, however they need to be considered in terms of realistic exploits..
I've tracked network traffic from power-up through the the **5nnnn via wireshark.
The Obi110 requests addresses for 'prov.obitalk.com' and 'root.pnn.obitalk.com' (I have provisioning enabled). This DNS resolution appears to happen only at Obihai powerup. Also ntp servers and google server names are resolved by DNS. So yes we should be concerned about DNS security. Primarily wrt ISP name resolution.
It would also be nice to know the behavior of the Obi device, particularly at power up, with regard to under what circumstances the devices actually make connections to the ObiHai servers. You mentioned the DNS requests but was a connection to the ObiHai server also performed with provisioning enabled and the service disabled? I would suspect they would have to do that in order to determine the ip of the Obi so that provisioning could later be done if necessary and was enabled. If not then it would seem that auto provisioning could only really take place if the ObiTALK service is enabled which of coarse would require a connection and thus could be used to determine the ip of the Obi device.
Of coarse a complete functional test of the connection attempts would have to be done with all four combinations of the two control bits (provisioning and service) and noting the server, port and protocol the connections take place on.
Quote from: stevea on May 15, 2012, 03:09:21 PM
The '**5nnnn' call causes the Obihai110 to make a tcp connection to 'root.pnn.obitalk.com' port 6800. Some minor tcp traffic takes place however the identification number for the ObiHai110 is sent unencrypted. Then it *appears* that an SSL.v3-like connection is setup on the TCP connection after exchanging some Obihai self-signed certs. The openSSL certs sent to the Obihai are not verified via any public service like Verisign, however that doesn't mean they aren't verified against an in-firmware cache. *Assuming* that the key exchange is secure and note the crypto selected (AES-256) is good - then the content of the traffic after SSL setup is quite safe. IOW the cert exchange and SSL means that Obihai device can be quite certain it is communicating to the Obihai server and not to a fake server, and the encrypted traffic is 'safe enough'. The security issue is similar to the concept of pointing your web browser to your bank and accepting the https certificate as assurance you have the correct site.
SO *ASSUMING* the key exchange is secure, and the certs are verified from firmware .... an exploit requires an evildoer to steal the private crypto key from Obihai, install a DNS or IP routing exploit to send traffic to his evil-server with a matching cert, and then he must arrange for the '**5nnnn' sequence to be entered on the phone, then he must download evil-firmware to the Obihia or at least change the settings.
Not sure about that last pert of having to wait until a **5nnnn took place since that was not required when the push was performed last week. We really do not know what is required to initiate firmware push. The fact that a **5nnnn would cause one, even with the "control" bits have disabled tell us the process is completely at the desecration of the OBiHai servers though. Thus if the OBIHai server can determine your device's ip address then they have the ability to, as minimum, perform a firmware change so for all purposes they have complete control of your device.
Unfortunately to test the key exchange I think would require writing code to emulate the function of the provisioning server (including keys to further test the key exchange) and using iptables in the router to redirect traffic intended for the provisioning server to the emulator; which is a much harder task than testing normal communications.
Quote from: stevea on May 15, 2012, 03:09:21 PM
I am greatly reassured knowing that there some sort of secure connection on this channel. I'd like to hear more about the cert verification issue - but so far I have no reason to doubt or distrust ObiHai's design decisions.
I wonder of the firmware download and ObiTalk remote settings use a similar secure channel ?
I agree that using SSL is a good practice and like you would be willing to assume that they also are handling the key exchange properly. (I admit I am too lazy to develop something to test that ) Hopefully the firmware download and remote settings are handled properly. We know that OBiHai has the ability to push firmware updates at their will based on the fact they did last week. Testing has revealed that the control bits in the OBi device do not control the functions in the device but rather simply pass the preferences to the OBi server which OBiHai can honor or not.
That leaves the possibility of flash updates being performed at inopportune times a major reason one may wish to disable auto provisioning.
Unfortunately as we have been told, in this thread, that currently also means one must disable the ObiTALK service. Without the ObiTALK service I think the ObiApp becomes useless as well.
If one has to give up the functions of the Obi, then they may as well take the next step and block all connections to Obi in their border routers; once we have discovered all domain names/ ip addresses they use.
For the customer to be assured they can keep from having firmware updates pushed to them basically all remote features of the Obi devices must be sacrificed. I find this sad since as I suggested earlier it does not have to be that way.
Quote from: VaHam on May 16, 2012, 06:42:37 PM
I am handicapped at the moment since I loaned my only Ethernet hub to a friend and don't have it available to assist with wiresharking right now.
If your PC has two Ethernet ports, simply have Windows bridge them and have Wireshark monitor the bridge. Modem/Router on one port, OBi(s) on the other.
Quote from: VaHam on May 16, 2012, 06:42:37 PM
Unfortunately as we have been told, in this thread, that currently also means one must disable the ObiTALK service. Without the ObiTALK service I think the ObiApp becomes useless as well.
If one has to give up the functions of the Obi, then they may as well take the next step and block all connections to Obi in their border routers; once we have discovered all domain names/ ip addresses they use.
For the customer to be assured they can keep from having firmware updates pushed to them basically all remote features of the Obi devices must be sacrificed. I find this sad since as I suggested earlier it does not have to be that way.
OBi-to-OBi and smartphone calling can be accomplished using Single-Stage Dialing Through Any OBi Trunk Using SIP (http://www.obitalk.com/forum/index.php?topic=2454.0), which eliminates any reliance on OBiON Apps, the OBiTALK Service, and the OBiTALK Web Portal.
Quote from: VaHam on May 15, 2012, 09:17:35 AM
In my opinion attempting to degenerate people who are discussing technical issues by using terms such as ("paranoid about security", "handful of complainers that are going to gripe", "dwell on the negative", "a few vocal complainers") is uncalled for. Genuine skepticism (http://www.drgaryschwartz.com/TRUE-SKEPTICISM.html) is very good thing and often leads to better ideas and products. From the preceding link Quote"Pseudo-skeptics often are typically disbelievers - i.e. they are firmly entrenched in believing "no" about certain things. Although they may "claim" that they are open to new information, they typically react with strongly unfriendly if not hostile criticisms when their beliefs and assumptions are challenged by new ideas and evidence."
VaHam, my comments are really about the (in my opinion) one backstabbing person who tries to play expert/authority in this forum, then goes on BroadbandReports.com and appears to have some desire to trash Obihai's reputation any way he can. It just amazes me that he still even uses Obihai products, given his apparently low opinion of the company. When they try to help him, or fix bugs that he's reported, he gets mad because they don't consult with him before pushing a firmware update first, whereas typically a person would be happy that their problem was addressed. And I think perhaps his negativity may have rubbed off on one or two others. so I say there may be "a handful of vocal complainers" but it's pretty clear there is one ringleader. Most of this thread would probably not have existed except for his provocation, nor would the threads on BroadbandReports that kick Obihai all over the place.
I'm not saying this is an issue that should be hidden, and in fact I think Obihai did the wrong thing by deleting that entire initial thread, when they could have just deleted the posts containing the bad information. But this has been a case of making a mountain out of a molehill. When you think of Obihai's overall customer base, most of which bought an Obihai specifically to use with Google Voice, you have to realize that most are probably quite happy that their devices were fixed with no intervention on their part. The only ones who are unhappy are the type that see "an enemy behind every tree", so to speak, and think that maybe someone's just chomping at the bit to hack their Obihai devices. If such a thing had ever happened, I would be a lot more concerned, but I've never seen a bona fide report of anyone hacking an Obihai device. Oh, and those who didn't want a firmware update were also unhappy, but most people do want firmware updates, particularly when they fix problems.
I'm not really upset that this issue has been discussed; in fact I wrote about it in a couple of articles in my blog. But at some point a reasonable person would have to conclude, as I did, that there's not much to see here. Yes, Obihai probably should have made it clearer how to disable firmware updates that come directly from Obihai, but now we know, and as I say, the majority of Obihai users don't want to do that anyway (and they shouldn't, in my opinion, except under special circumstances). What does tick me off just a bit, even though it probably shouldn't, is the way one person can come into this forum and try to project the image of being the go-to guy for Obihai questions, then go into other forums and essentially trash talk Obihai devices. How can someone do that? WHY would someone do that? Where is the loyalty? Again, I'm NOT saying you can't ever criticize a product you like, heck, just about all of us have done that, but to keep beating the drum of negativity over this issue the way he's done is something else entirely.
And please understand that I am not feeling this way because I got free review units from Obihai - in fact, it would probably bother me a lot more if I had actually paid out of pocket for the devices I have, because then it would be as if he's attacking my wisdom in purchasing a device. It would be like telling someone who's bought a new car that they just spent their money on a piece of junk, vs. telling someone who was given a free car that it's not the greatest brand ever made — you know which would be more likely to get you punched in the nose!
There are appropriate ways to address this issue and many of the posts in this thread have, in fact, addressed it appropriately. But we must remember that it's not just us "expert users" that read these threads. Suppose that a new user found this thread via a Google search — if he didn't fully understand what he was reading, he might come to the conclusion that Obihai devices have this huge security hole, when in fact that's simply not the case. Just because something doesn't work the way one guy, or a few people think it ought to work doesn't mean it's insecure. I appreciate those who have the expertise and have taken the time to run tests using Wireshark and provide actual information, not wild speculation. I appreciate those who have contributed suggestions on how this problem can be addressed. I don't appreciate those that just want to bleat constantly about what a bad company Obihai is because no one at Obihai will kiss their ring (or some other part of their anatomy) when they say something should be done a certain way. Obihai is certainly not perfect (probably in part because they are a small company, and there are only so many hours in the day, and they are in the middle of rolling out new products) but they are a LOT more responsive than many other companies we interact with. Ever tried to get a response from Google when you have an issue with Google Voice? You might have better luck trying to get the President (or Prime Minister for you Canadians/Brits) to come sit and have coffee with you while you tell him what's wrong with the government!
You made some good suggestions near the end of your post. I'm sure the folks at Obihai will think twice before pushing any more automatic firmware updates but the fact remains that there are probably more people who are glad they did it then those annoyed by it — but most of those who are glad they did may never visit this forum. So I think there is some tension between what is best for the "typical user" vs. what will keep the "expert users" that tend to hang out in this forum happy, and I'm not sure they will ever be able to keep everyone happy all of the time!
Quote from: RonR on May 16, 2012, 07:03:30 PM
Quote from: VaHam on May 16, 2012, 06:42:37 PM
I am handicapped at the moment since I loaned my only Ethernet hub to a friend and don't have it available to assist with wiresharking right now.
If your PC has two Ethernet ports, simply have Windows bridge them and have Wireshark monitor the bridge. Modem/Router on one port, OBi(s) on the other.
Good tip! Basically as I admit I am lazy. I have ethernet cards I could install in the desktop here however it has only one currently. My Router and OBis, PBXs and other voip devices are located in a room at the other end of the house so it is not real convenient to move stuff around. I usually just plug the hub into my border router and then temporarily move the cat5s from my desktop and the device under test to the hub when wiresharking. If it is one of the PBXs then I just use tshark running on the PBX and save the result file, download it to my desktop and run wireshark on it here.
Quote from: RonR on May 16, 2012, 07:03:30 PM
OBi-to-OBi and smartphone calling can be accomplished using Single-Stage Dialing Through Any OBi Trunk Using SIP (http://www.obitalk.com/forum/index.php?topic=2454.0), which eliminates any reliance on OBiON Apps, the OBiTALK Service, and the OBiTALK Web Portal.
Again good tips! Yes those provide ways to regain most of what unfortunately one would have to give up if they have to block the OBi servers in order to have control over the OBi device. I did however use the OBi console for configuration and have in the past recommended using it to new comers
I actually think OBiHai did a very good job of simplifying the provisioning process with their web portal, which is especially helpful to users who have never dealt with voip before, and found using the expert mode met my needs in customizing the OBis. But, I have no problem myself with using device's own web gui to provision it either so to me that is not a big deal.
Quote from: MichiganTelephone on May 16, 2012, 08:25:47 PM
I'm not saying this is an issue that should be hidden, and in fact I think Obihai did the wrong thing by deleting that entire initial thread, when they could have just deleted the posts containing the bad information.
I would rather see the title of this thread be something more like "A discussion of OBiHai firmware updating procedures". I don't like the idea of deleting entire threads either and this one certainly has not been. The current title sounds like somebody is trying to hide something and I don't really think that is the case. I also think OBiHai took the action they did last week to help the majority of their current customers using only Google Voice as do you. The action did raise my awareness of the detailed workings of the device however; especially after I learned that even with auto provisioning set to off that it took place. That then leads one to ponder all the other ramifications of that capability. If auto provisioning cannot be positively disabled within the device one should examine all of the possibilities that may arise as a result of that.
You raised a very good point about inopportune firmware updates with regard to power stability during the firmware re-flash; one that hadn't even occurred to me up until that time, but has been known to cause problems in many other devices.
As I said earlier even the remote risk of some security issue is not a big problem if your only using Google Voice and that if your using a paid sip provider that you could limit any big liability there by incremental funding and pay as you go.
I don't know if Google Voice will remain free forever which has no doubt been a big benefit to OBiHai sales. I know the Obi device preceded free Google Voice and IMHO I prefer the OBi devices over other ATAs and think they will dominate in the future even if Google Voice ceases to be free.
I would think that practices which may be acceptable in a consumer product using only Google Voice and OBiTALK network may not be acceptable for commercial type use. If I were an ITSP providing the devices to my customers I certainly wouldn't want updates pushed to them automatically.
Quote from: MichiganTelephone on May 16, 2012, 08:25:47 PM
The only ones who are unhappy are the type that see "an enemy behind every tree", so to speak, and think that maybe someone's just chomping at the bit to hack their Obihai devices. If such a thing had ever happened, I would be a lot more concerned, but I've never seen a bona fide report of anyone hacking an Obihai device.
Well in the big scheme of things the OBi's are fairly new devices so if there are vulnerabilities which could be exploited they may have just not been found yet. So far none have been uncovered but I for one find it an interesting technical issue if nothing else to explore the possibilities before any thing bad could happen. The OBi's would certainly make attractive targets for voip thieves. There are or will be many more of them than PBXs to exploit, if they can be, and most are I suspect operated as you pointed out by novices.
I think the OBi's are great products but there is room for improvement even in great products.
I see that RonR has been punished. Anyone else notice it?
Quote from: QBZappy on May 17, 2012, 08:52:03 AM
I see that RonR has been punished. Anyone else notice it?
I was apparently demoted yesterday from 'Beta Tester' to simply 'Forum Member' with no rating.
Several posts that had resulted in getting users operational by having them log into their OBi's directly were also deleted. Apparently, any suggestion of directly accessing an OBi is now grounds for censorship.
Quote from: RonR on May 17, 2012, 09:24:54 AM
Quote from: QBZappy on May 17, 2012, 08:52:03 AM
I see that RonR has been punished. Anyone else notice it?
I was apparently demoted yesterday from 'Beta Tester' to simply 'Forum Member' with no rating.
Several posts that had resulted in getting users operational by having them log into their OBi's directly were also deleted. Apparently, any suggestion of directly accessing an OBi is now grounds for censorship.
I may not always agree with your opinions regarding the Web portal for configuration since I think it is pretty good and that provisioning via the device's web gui is probably better left to advanced users.
But I recognize the great amount of time and contributions you have made in this forum helping others!!! My first experience here was responded to by you and your input was appreciated greatly by me. If you were to get fed up and stop helping folks then I wonder if any one else would pick up that slack and respond to requests for help as prolifically as you have.
Alas, it turns out that currently the only way to keep firmware updates from being pushed is to disable all of ObiTALK services, then the web portal is also not usable so anyone who chooses not to receive the pushes will be forced to use your preferred method of provisioning directly with the devices web gui.
Quote from: RonR on May 17, 2012, 09:24:54 AM
Quote from: QBZappy on May 17, 2012, 08:52:03 AM
I see that RonR has been punished. Anyone else notice it?
I was apparently demoted yesterday from 'Beta Tester' to simply 'Forum Member' with no rating.
Several posts that had resulted in getting users operational by having them log into their OBi's directly were also deleted. Apparently, any suggestion of directly accessing an OBi is now grounds for censorship.
Well aside from the deletion, does not being a beta tester really mean anything?
Quote from: Ostracus on May 17, 2012, 01:03:50 PM
Well aside from the deletion, does not being a beta tester really mean anything?
Nope. Obihai stopped participating and responding to our questions in the Beta Tester's section long long ago. New firmware releases are not previewed to Beta Testers before the general public. 'Beta Tester' carried no out-of-the-ordinary consideration whatsoever.
I'm actually pleased that I no longer have that designation in the forum as it has mistakenly led some users to think I'm affiliated with Obihai in some way.
More ...
With obitalk enabled, the obihai periodically sends a small (110 bytes of data) UDP packet from port 10000 to the server port 10870 and receives a ~424B return packet at regular intervals. The packet content seems to NOT be encrypted in it's entirety since there are a few repeated header bytes and a few fields are 'common' between most packets. However the data is binary - nothing easily decipherable. I suspect the packets have a sequence number or reply code embedded or something similar - since if the Obi doesn't get a reply then it resends the exact same packet repeatedly
The Obitalk reply packet (the ~400B ata transfer) can clearly contain the commands telling the obidevice to download new obitalk configs, (which it then does via webdav to the obitalk website) and likely also this mechanism command it to 'phone home' for an automatic firmware update.
Typical soho router firewall settings don't allow any external TCP initiation from outside to touch the obidevice. Nor can UDP packets be addressed to the Obidevice unless the Obi first sends an outbound packet to that system. So clearly the Obidevice has to initiate any route that permits Obiitalk to command an update. It appears this ObiTalk periodic traffic is the mechanism.
I've found that
ObiTalk Provisioning == disabled
OBiTALK Service Settings, Enable = UNchecked
Is sufficient to prevent the periodic ObiTalk UDP messages. And it therefore should prevent any externally generated control from ObiHai..
Firewall blocking UDP traffic to/from port 10000 on the Obi should enforce this decision.
Throughout this I think I've found potential means to examine someone's ObiTalk settings (again many requirements) ,but since the VOIP account passwords aren't there - it's not a serious problem I think.
Quote from: VaHam on May 17, 2012, 12:18:21 PM
Quote from: RonR on May 17, 2012, 09:24:54 AM
Quote from: QBZappy on May 17, 2012, 08:52:03 AM
I see that RonR has been punished. Anyone else notice it?
I was apparently demoted yesterday from 'Beta Tester' to simply 'Forum Member' with no rating.
Several posts that had resulted in getting users operational by having them log into their OBi's directly were also deleted. Apparently, any suggestion of directly accessing an OBi is now grounds for censorship.
I may not always agree with your opinions regarding the Web portal for configuration since I think it is pretty good and that provisioning via the device's web gui is probably better left to advanced users.
But I recognize the great amount of time and contributions you have made in this forum helping others!!! My first experience here was responded to by you and your input was appreciated greatly by me. If you were to get fed up and stop helping folks then I wonder if any one else would pick up that slack and respond to requests for help as prolifically as you have.
Alas, it turns out that currently the only way to keep firmware updates from being pushed is to disable all of ObiTALK services, then the web portal is also not usable so anyone who chooses not to receive the pushes will be forced to use your preferred method of provisioning directly with the devices web gui.
I absolutely agree with VaHam. Ron's contributions were have been not only useful, but highly needed by many of us. In a way he has been providing the level of customer service in certain areas Obihai should, but does not. Obihai would have less customers and worse ratings = less business without him.
Unfortunately, this type of actions are quite common on proprietary support forums. One great advantage on the Magic Jack support forum was that it was independent ( off course who needs Magic Jack these days!).
I know I'm new here and this is my first post, but been lurking a few weeks and I have been following this thread.
I do think that a few of you are
(http://www.pslhosting.com/picts/beatdeadhorse.gif)
QuoteRon's contributions were have been not only useful, but highly needed by many of us. In a way he has been providing the level of customer service in certain areas Obihai should, but does not. Obihai would have less customers and worse ratings = less business without him.
I couldn't agree more!
RonR should be on Obhai's Payroll!
He has helped many of us. I sometimes search the forum for "RonR" to read through his very informative and easy to understand posts.
Quote from: mrjoe on May 19, 2012, 11:36:18 AM
QuoteRon's contributions were have been not only useful, but highly needed by many of us. In a way he has been providing the level of customer service in certain areas Obihai should, but does not. Obihai would have less customers and worse ratings = less business without him.
I couldn't agree more!
RonR should be on Obhai's Payroll!
I couldn't DISAGREE more. Since you are new, the thing you may not have noticed is that while he tries to present himself as something of a "guru" in this forum, he then goes behind Obihai's back and trash talks them on other forum(s) (on BroadbandReports.com that I know of, and maybe others that I don't). I have
no inside knowledge on this, but I would almost bet that was part of the reason that Obihai might have gotten a little peeved with him.
Quote from: mrjoe on May 19, 2012, 11:36:18 AMHe has helped many of us. I sometimes search the forum for "RonR" to read through his very informative and easy to understand posts.
If he would just stick to what he knows, which is Obihai dial plans, and not try to get others to follow his entire philosophy on how an Obihai should be configured, I think that few of us would have a problem with him now. When he first came into this forum several months ago, he really managed to tick off some participants (including me), but that's water under the bridge. The problem is that even as his posts became more helpful and less abrasive, he still just couldn't stop beating the drum for not using the Obihai portal. And that's fine if you are an experienced user and know what you are doing, and more importantly, what you are giving up if you don't use the portal, but I have always said that it's horrible advice for new users, and really for anyone that ever expects Obihai customer support to help them resolve a problem with their device.
Personally, if I had been moderator of this forum, he wouldn't have lasted a month before I would have given him the boot. Maybe other users would have stepped in to do what he does (after all, he's not the only smart person on this forum) and maybe not, but chances are that no one else would have replied to questions as quickly as he did (often before anyone else even had a chance to see them). So that's why I say, if he had simply stuck to helping people with their dial plan questions, and not been so doggone pushy about his beliefs on the correct way to configure an Obihai device, he'd likely not be in hot water now.
Then add to that the raising of this "tempest in a teapot (http://michigantelephone.wordpress.com/2012/05/12/tempest-in-a-teapot-more-on-the-so-called-mostly-imaginary-back-door-in-obihai-devices/)" over what he's been calling a "back door" (which is possibly about the most pejorative terminology he could have used among a technically-oriented crowd) and you have what for all intents and purposes appeared to be a blatant attempt to smear Obihai's reputation. Maybe it was just extremely poor judgement on his part to frame the issue that way, but he managed to get many people worked up about it (I must confess that I even started to wonder about it), but in the end it turned out to be a non-issue, except for a very few people who in my opinion are probably so paranoid that you wonder how they can even stand to have an Internet connection at all.
In any case, the thing that NO company would want to see in an employee (and that's what he'd become if they were paying him) is disloyalty. By being so vocal about this issue, especially without knowing all the facts before raising a ruckus, he's probably just blown up any bridges he may have been building with Obihai. No way would any rational company put someone on their payroll that's been backstabbing them in other forums and/or trying to damage their reputation.
All of the above is simply my personal opinion. I don't speak for Obihai, and I'm not privy to any inside information. I'm just drawing what I believe are some obvious conclusions. I'm not saying you should not appreciate the help he has given you or others; if he has helped anyone then that's a good thing, and I'm not saying you should share my opinions. But if I were you, I would just keep in mind that someone else might have taken on the role of Obihai dial plan expert if he hadn't. No one is indispensable, especially not in a forum such as this one.
MT you are totally off topic in this thread. Please delete the above post.
TIA
Quote from: MichiganTelephone on May 20, 2012, 12:04:58 PMBy being so vocal about this issue, especially without knowing all the facts before raising a ruckus
I think this is what bothers me most about the situation. There have been several times where people have posted completely incorrect information, and - however unbelievable - it has been accepted as fact by other members. No one is doing themselves any favours by starting rumors, whether by genuine accident or on purpose.
Obihai has built some EXCELLENT VoIP devices and I'm thrilled to own one. If you don't like the default settings................then change them. ::)
I may not have been on these forums as long as the rest of you guys but RonR's contributions are great. He was one of the few people who quickly responded to my queries and gave me effective answers. Out of the several topics I've read on this forum, I have never seen him "force" anyone to follow his philosophy. He simply stated his solution, which worked if followed correctly. It is unreasonable to ask him (or anyone else) for all possible solutions to achieve the same results.
It is quite unsettling to me for Obihai to delete unwanted topics. I personally don't believe their reasoning is sufficient to delete any topic. Maybe they could relabel it and lock it or move it to another section of the forum.
Quote from: DocM on May 21, 2012, 11:52:43 AM
I may not have been on these forums as long as the rest of you guys but RonR's contributions are great. He was one of the few people who quickly responded to my queries and gave me effective answers. Out of the several topics I've read on this forum, I have never seen him "force" anyone to follow his philosophy. He simply stated his solution, which worked if followed correctly. It is unreasonable to ask him (or anyone else) for all possible solutions to achieve the same results.
No, but it IS reasonable to ask him not to try to discourage new users from using the OBiTALK portal (even if only by including those settings in his "effective answers" when they are totally unnecessary to solve the problem at hand). Note that it's often a "sin of omission" — he's instructed people to disable Auto Provisioning or OBiTalk Provisioning as part of a longer procedure without explaining what they will lose by doing so, and in most cases without it being at all necessary (the same changes could just as easily be made from within the Expert Configuration mode of the OBiTALK portal). So you are correct in saying he doesn't "force" anyone to follow his philosophy — how could he, without having direct access to their device — but too often the
implication has been that you have to follow his philosophy to get your issue fixed or to achieve the result you want. And that especially impacts new users that probably most need the portal, but are least likely to understand that they don't need to disable it to achieve what they want.
Having said this, I will note that in some of the latest messages I've read from him, I haven't noticed him doing this as much (in fact I haven't noticed it at all in the last couple of weeks, but I obviously don't read everything he posts). So perhaps (I hope) he now realizes that it's not a good thing to steer new users away from the portal, despite whatever personal beliefs he may have about it (and it was certainly a slap in the face to the Obihai developers that worked very hard to get that portal implemented and make it useful).
Quote from: lhm. on May 20, 2012, 04:38:27 PM
MT you are totally off topic in this thread. Please delete the above post.
TIA
Considering that this whole thread is a reaction
against deleting posts, your post is ironic in the extreme. But my answer to you is this:
NOYWIA
Quote from: MichiganTelephone on May 22, 2012, 12:10:34 PM
Quote from: DocM on May 21, 2012, 11:52:43 AM
. So you are correct in saying he doesn't "force" anyone to follow his philosophy — how could he, without having direct access to their device — but too often the implication has been that you have to follow his philosophy to get your issue fixed or to achieve the result you want.
I have been trying to stay as polite as possible in this matter but sometimes it just is not easy.
So far, I have not seen the long line of people complaining about Ron's "disastrous " advise rather a long line of people being thankful to him for his help and advise. If somebody thinks here that his advise was so bad and unneeded, why did not he provide a better one? If somebody helps me, I do not give a damn what kind of philosophy he may or may not be carrying out as long as it helps me, especially if there is no one out there incl. the CS who would do that.
All of us here love OBi. And all of us want it to be a success and further improve. But a few things have to be said. Right now, it is Google Voice making Obi big. But what happens if GV starts charging for the service ? Obi is great in giving the opportunity to use SIP providers too, but here it is where customer service comes in. I bought my second Obi and I have been making warm recommendations to everyone I know. However, in the past I was about an inch away to sticking just to obi100 strictly for GV and getting a Cisco 187 or similar for SIP, because you get there a better customer support for the device both from manufacturer and from SIP providers. And that would have happened if it was not for a.o. people like Ron. I have neither the time nor desire to spend 3 months studying Obi in order to be able to solve issues on my own and there are lot of things there which are not all that logical or intuitive and where time consuming trial and error approach is needed and that is nothing for somebody who at this point of time wants to be nothing more than an informed consumer.
Censorship is always stupid( not even to speak about this childish "demotion")- it is far better to counter with what you believe is the proper information- and organizing witch hunts at helpful forum members is just bizarre. ::)
Quote from: carl on May 22, 2012, 04:19:33 PM
Quote from: MichiganTelephone on May 22, 2012, 12:10:34 PM
Quote from: DocM on May 21, 2012, 11:52:43 AM
. So you are correct in saying he doesn't "force" anyone to follow his philosophy — how could he, without having direct access to their device — but too often the implication has been that you have to follow his philosophy to get your issue fixed or to achieve the result you want.
I have neither the time nor desire to spend 3 months studying Obi in order to be able to solve issues on my own and there are lot of things there which are not all that logical or intuitive and where time consuming trial and error approach is needed and that is nothing for somebody who at this point of time wants to be nothing more than an informed consumer.
Well, one, I don't know why your original comment is in quotes. Second the documentation does leave something to be desired. That's why I wonder why no one's set up a Wiki were this issue can be worked on by both the community, and Obihai?
http://michigantelephone.wordpress.com/
Comment Policy:
"If you send a comment that is insulting or disrespectful, it WILL be moderated (a.k.a. "censored"), and you will be permanently banned from leaving further comments. It's okay to disagree, but be nice about it or you will be GONE!"
(Emphasis added)
Quote from: QBZappy on May 22, 2012, 07:46:33 PM
http://michigantelephone.wordpress.com/
Comment Policy:
"If you send a comment that is insulting or disrespectful, it WILL be moderated (a.k.a. "censored"), and you will be permanently banned from leaving further comments. It's okay to disagree, but be nice about it or you will be GONE!"
(Emphasis added)
Yep, that's my policy. I've never said that I agree with anyone who may think that Obihai had no right to delete the thread. They had
EVERY right — it's their forum and they can delete whatever they like. However, sometimes when you delete a thread in progress, people can get the wrong idea about why it was done, which apparently happened here. I don't know if anyone thinks that Obihai had no right to delete that thread, but anyone who may think that is absolutely, positively wrong. What some of us may be questioning is the WISDOM of deleting the entire thread, particularly when it was apparently just a few messages that contained bad or confusing information.
This is not the place to discuss my blog policy, but I don't see where it's at odds with anything I have said or done here (and even if you think it is, it's not your decision to make unless you are a forum moderator). Even when I disagree with people I have tried to be respectful about it. Some people apparently think I should keep some of my opinions to myself, but I happen to think they are relevant to this thread, and often are posted only as a counterpoint to someone else expressing their opinion first.
I've had people leave comments on my blog that disagree with something I say (sometimes almost everything I've said in an article) and I almost always allow those, but what I don't allow is the sort of comment that starts out with something like "You are a moron" or "You are a lowlife scumbag" or something like that. I don't talk that way to other people (I won't say I've never slipped and done it, but I am human) and I certainly don't believe I've talked about anyone that way here. I think it's possible to question someone else's actions and still not resort to the sort of frothing at the mouth hate that sometimes has permeated a comment in my blog. There are people who think that "being nice" means never saying a bad word about anyone or anything, whereas my definition is not going out of one's way to be antagonistic or to personally attack someone using name calling,
ad hominem attacks, or that sort of thing. But I can certainly disagree with someone's actions, or the sort of advice they are giving to other people, and just because someone else may disagree with what I say doesn't necessarily mean I'm not trying to express myself in a relatively "nice" way.
Of course, if you try to be TOO nice when saying something that might be perceived as disagreeable, then the amateur psychologists will say you're "passive-aggressive", so you just can't please everyone! ::)
EDIT: By the way, isn't it perhaps time to bring this thread to a merciful end? We're starting to drift further and further from the original topic, and it detracts from the purpose of the forum. And I will admit that I'm as guilty as anyone else in not letting this thread die, but I think all the points that can be made (at least by me) have been made, and I understand that some of you disagree with me, and that's okay — as I said before, my opinions are MY opinions; I'm not trying to convince anyone else to share them (perhaps unlike some others... sorry, couldn't resist). Anyway, it would be nice if this topic could drop off the front page in this forum, and to that end, I'm not going to respond to anything else in this thread. I think this horse is quite dead by now, and I, for one, am getting tired of beating it.
Since this thread was started as a result of
my initial topic being deleted, and since you are not planning to add to it, (however I'm not certain that you can resist) I would like to have the final word. It might offer it a sense of closure.
The thought occurred to me tonight that I could reply with your quotes all night. There are so many to choose from. By memory, some so outrageous that they have already been deleted by OBihai. Between the exchanges that you have had here on this forum, PBX in a Flash, freepbx, your own blog, and perhaps other forums, I see that you have been a prolific writer in your own right. You have also burned a few bridges along the way in those forums. You may not have 4,000 posts in this forum, however someone can certainly make the case that you have accomplished the equivalent, with all that entails, and perhaps have surpassed it since you have been doing this for a much longer period of time. Your blog shows the power of the written word. I believe that you have been able to shape the opinions of many of your readers. I don't think it would be too much of a stretch to think that is why you received the OBi202 for review. I'm sure that I speak for many of the forum readers here, including OBhai, that we take an interest in what you have to say. A word of advice from someone who has been around long enough, take heed of these wise words spoken to Spiderman, "With great power comes great responsibility." IMO you have squandered some of your credibility by publicly humiliating people.
I can write a lot more since it is practically writing itself, but suffice it to say that I leave you with a medley of some of your own words, saving my favorite for the end. By the way, the final part of the quote is not intended to be my opinion of you. It just happens to be your opinion of someone else after you didn't agree with him.
Quote from: MichiganTelephone on February 24, 2012, 03:55:20 PM
... You're just pulling "facts" out of your ass, with NOTHING to substantiate them.
... but hey, you'll just quote any old statistic that pops into your pea brain as long as it "proves" your point, won't you?
... unless you have some actual data in hand. If you don't, then once again you're just pulling stuff out of your ass.
... And I'll bet it really ticks you off when people don't want to follow your "advice." Guess what — there are many people, particularly in today's economic climate, that DO want to make their money go as far as possible, and they would be perfectly within their rights to tell you to "fuck off" when you offer your unsolicited and unwanted advice. You are not the ruler of the world, nor even an Obihai employee, so I don't know where you get off thinking that your opinion counts for any more than anyone else's. Use your Obihai devices the way you want to, but don't expect everyone else to do as you do — your priorities and theirs may be quite different. And when you tell other people what to do, they probably view you as some kind of buttinsky asshole, which would be the same opinion I've had of you since practically the start of this thread!
Emphasis added
I don't know if this is a cultural thing, (Canadian vs US) but I do find it bizarre how overbearing you can be at times. On that note, I think I am done with this thread.
Peace--
QBZappy
Amen. ::)