The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
As if domestic products aren't a hot mess of security issues and sloppy engineering. Lol
My security camera shipped a GitHub admin token in its login page
81–90 of 265 posts
Re: My security camera shipped a GitHub admin token in its login page
#82Earlier quoted context omitted.
"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"
192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for…
I doubt any endpoints are entirely ipv6.
So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow.
I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for.
No human said “hey, networking sucks. Please make it much harder at my level!!”.
Re: My security camera shipped a GitHub admin token in its login page
#83Earlier quoted context omitted.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs. 22.0.0.0/8 - it's basically free real estate!
I also do this, except 7.0.0.0/8 instead. Its great for not conflicting with hotel wifi dhcp.
Re: My security camera shipped a GitHub admin token in its login page
#84Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)
How can there be a baseline check when you operate by getting the most inexperienced cheapest person possible to do the work?
Re: My security camera shipped a GitHub admin token in its login page
#85Earlier quoted context omitted.
"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"
192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for…
One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally.
I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.
Re: My security camera shipped a GitHub admin token in its login page
#86This blog's misuse of the external link icon irks me.
The CSS selector they used (`a[href*="://"]::after`) is meant to only target only external links, but assumes any internal links will be using relative paths like `href="/about"`. The problem is that this site uses absolute URLs (`href="https://hhh.hn/about"`) for its nav links, so every link ends up with an icon.
You could fix this by adding an exception to the CSS rule so it skips links starting with your site's name:
a[href*="://"]:not([href^="https://hhh.hn"])::afterRe: My security camera shipped a GitHub admin token in its login page
#87Earlier quoted context omitted.
192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for…
I doubt any endpoints are entirely ipv6. So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow. I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for. No human said “hey, network…
I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct.
like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated.
To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.
Re: My security camera shipped a GitHub admin token in its login page
#88Earlier quoted context omitted.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.
I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.
Re: My security camera shipped a GitHub admin token in its login page
#89Earlier quoted context omitted.
I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.
Didn't AT&T do that and Cloudflare made them change it when they aquired that space?
Funny enough their problems really began in earnest about seven or eight years ago...
Re: My security camera shipped a GitHub admin token in its login page
#90Earlier quoted context omitted.
Didn't AT&T do that and Cloudflare made them change it when they aquired that space?
I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security. Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, even…
Quantenna used 1.1.1.1 for RPC to their wifi chip in their SDK by default. Should not have been exposed to global routing but of course people screwed that up.
https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-...