Ubiquiti's response is not surprising. Of course they would lie and deflect about the severity of the attack. They have terrible customer support and awful software update communications; besides, they are hostile to analysts and the press. Either Ubiquiti made false material statements, or the company is negligent. In both cases, it will get them into hot water.

In Ubiquiti's defense, I once brought a disclosure to their attention on Twitter a few years back and they very swiftly issued an update. I guess things have gone downhill since then. It boggles the mind why a company whose core business is catering to the self-hosting crowd, would try to force self-hosters onto its cloud plantation, when it can't even protect its own house.

Platforms like GitHub and GitLab should support a workflow consisting of series of patches instead of a specific commit on a particular branch. They could probably even show pull requests from email in their interface.

It could be as easy as adding some toggle to enable sending a patch series when you push to a specialy named branch, to relevant people (mentioned in the patch message for example, via Cc: tags).

Something like:

    git push master:email/v1

Email/v1 branch would not be created, it would just be a virtual target branch name for this functionality.

You can easily make a git hook script to do it with regular ssh/http based git hosting.