u/terselated

I've had my Roborock Qrevo S for almost 2 years. Bought direct from Roborock (per this subs recommendation) and even bought the extended warranty through them. Good thing I did because this thing spontaneously breaks apart as if it's designed to. What's the old saying? "Rapid unplanned disassembly"?

In the two years I've owned it, I've had the plastic dock break apart twice. I've had the cover that holds in the roller break twice. The guiding wheel has broken. the internal arm that holds the mops has broken. I've had to ship it to support 3 times. The last time they "fixed it" they shipped it back even more broken than I sent it to them.

This time they gave up and said they were sending me a different, refurbished unit and sent me a strongly worded recommendation to not let it go anywhere it can get wet...

It's a mop. Getting the things wet is like half it's job.

Oh and that extended warranty I bought? Yeah they're no longer going to honor it on the replacement unit. Cause screw you, that's why.

Save yourself some drama and buy a robot literally from anyone other than these bozos. How's Eufy looking these days?

May your students all be respectful and your staplers never run out of staples.

May your students all be respectful and your staplers never run out.

I swear, these guys call me every other week and want to argue when I say they aren't a good fit for us.

But we just changed our pricing!

But we just implemented AI!

But now we do SaaS!

But we can reduce your onboarding times by 70%!

I used to use Auvik. I know it's a decent tool. Its just not a good fit for us. But at this point I'm not going to sign up for the product even if it is a good fit just because their sales people are such jerks.

No means no.

Woke up to 32 clients reporting down. SMH.

https://status.ninjaone.com/#

I'm at the point where I need to redo my storage setup in the trunk. Currently just a go duffle, a plano huntsman case, and a Subaru trunk organizer for groceries. Need to organize better so I don't have to unload everything when I need to get groceries. Started looking at side molle panels but they're so damn expensive. Kind of remember someone posted a pelican case that fits nicely between the wheel wells, but I can't find the post.

So show us your setup, bonus point for links or list out the products you use.

I have a local competitor who offices right down the street from our office. Bigger MSP than us, fairly mature, we've had a few clients off board from them to us. But we have never met up or talked shop or anything like that.

We did a deployment on a client that moved from them to us and the first night our MDR team notified us of a threat on one of the PCs. Confirmed that the previous MSPs tools had been on the machine in question, including their security stack (I won't bad mouth which one), and the issue was not caught prior to changing to our stack.

My question is do I reach out to the competitor and let them know about it? That potentially their MDR/EDR is missing things. Do I keep it to myself in the hopes that it leads to more clients jumping ship? I feel like professional courtesy dictates that I let them know. What would you do and how would you start a conversation like that?

Here is the MDR alert (sanitized).

Hi Team,

Security Incident Report — DESKTOP-*********

Date: July 17, 2026

Severity: Critical

Status: Mitigated — Further action recommended

---

We are reaching out to inform you of a critical security incident detected on one of your endpoints that required manual intervention by our MDR team and may need further action on your side

to fully resolve.

Summary

On July 17, 2026 at 00:28 UTC, our Managed Detection and Response (MDR) team identified a malicious Python-based implant executing on the endpoint DESKTOP-*********. The threat was initially detected by SentinelOne's EDR engine with a "suspicious" confidence level, which means the agent flagged the activity but did not automatically remediate it. Our MDR team reviewed the detection, confirmed it as malicious, and manually initiated full mitigation (kill, quarantine, remediation, and rollback).

What Happened

A malicious file disguised as image.png was executed from a hidden persistence directory (C:\Users\*******\AppData\Roaming\Microsoft\WindowsUpdate\). This directory mimics a legitimate Windows path but is not used by genuine Windows Update processes. Upon execution, the malware:

1. Masqueraded as a legitimate Windows process (svchost.exe)

2. Established a command-and-control (C2) connection to an external IP address (176.125.243[.]136) on port 56001

3. Performed process injection into multiple running applications over a 43-minute window, including browsers (Edge, Chrome), productivity software (Excel, Slack, Acrobat), and the SentinelOne security agent itself

Why Automatic Remediation Did Not Occur

SentinelOne classifies detections with a confidence level — either "malicious" or "suspicious." Only detections classified as "malicious" are automatically mitigated by the agent. In this case, the behavioral detection was classified as "suspicious," so the agent alerted on the activity but waited for analyst review before taking action. Our MDR team confirmed the threat and manually triggered full remediation.

Response Actions Taken

- The threat was detected and flagged by SentinelOne EDR

- Our MDR team confirmed the detection as a true positive

- A full mitigation was manually executed: the malicious process was killed, the file was quarantined, and system changes were rolled back

- The C2 IP address 176.125.243[.]136 has been identified for network-level blocking

Recommended Actions

1. Network isolation of DESKTOP-********* until a full forensic review is completed, to prevent further C2 communication in the event of re-execution

2. Full forensic sweep of the endpoint to identify and remove any remaining persistence mechanisms, particularly within the C:\Users\*******\ user profile

3. Review the "*******" local user account — this account was used to stage the malware and may have been created by the attacker. If it is not a recognized account, it should be disabled and removed

4. Block C2 IP 176.125.243[.]136 at the firewall/network perimeter level

5. Review network logs for any other endpoints that may have communicated with 176.125.243[.]136

Please let us know if you would like to proceed with network isolation or if you have any questions.

Guardz MDR Team

Looking for insight from other MSPs on how they are handling fringe services. Things that aren't traditionally MSP services.

Are you doing VOIP, Web design, ISP, hosting? Copier leasing (god forbid). When do you decide to do it in house vs farming it out for a cut of MRR?

Bonus question, are you partnering with another MSP to provide a service you dont?

Looking for input here. Small MSP (sub 10 techs) and growing rapidly. I initially calculated 150 user to tech ratio when I came on board with a goal to move it to 175 to 1 with in a year. I'm here at the end of q2 and it's looking more like 200-225 with the implementation of ai augmentation (thread) to our psa (halo). What ratio for high customer service are others seeing? I want to go in to the quarterly with optimistic but realistic estimates and future goals.

Are the quotes from rewst/pia/neoagent of 400+ user to tech ratios realistic or is that just crappy customer service. Is something like super magic a decent middle ground for a higher tier 1 to supported user ratio than what I'm estimating as a goal?

A: Marley Spoon

Bonus:When you contact support about it I just say "Thanks for the feedback!"