Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

131–140 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#131

Post by unethical_ban »

tracker1 wrote: post #80
SV_BubbleTime wrote: post #77

Earlier quoted context omitted.

>The point of IPv6 was to make the addresses so long they are easy to manage. lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even. Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

No network is "smaller" than /64. All end-networks are /64.

Split subnets at four bit chunks.

Allocated networks, like to a home or small office, should be /56 or /60.

Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination.

I have a rough draft of a beginner document but it's not ready. :)

Re: My security camera shipped a GitHub admin token in its login page

#132

Post by myself248 »

kotaKat wrote: post #16
walrus01 wrote: post #13

Earlier quoted context omitted.

the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

i deal with a lot of nerds that are all interconnected with one another and nobody can agree on a common subnet for their houses when we all decide to exchange routes internally. ;)

I deal with a lot of nerds, but starting in about 2008 we all segmented up the 10.x space and each of us has a /16, with each site we manage having typically a /24 or /22, so nobody overlaps. We can light up tunnels between each other and never have a collision. We have a little internal registry on a private wiki, and it's been serving us well for... oh dear, almost two decades now.

Crucially, we set aside the common 10.1 and 10.10 ranges as nonroutable, so any devices that default into those have to be dealt with before they can live on the wider network.

Newcomers get handed a block and have to renumber, or NAT into it, or whatever, but they cannot emit bogons. At a small scale (first-name basis), this works.

Re: My security camera shipped a GitHub admin token in its login page

#133

Post by unethical_ban »

inigyou wrote: post #122
unethical_ban wrote: post #74

Earlier quoted context omitted.

Respectfully I don't think they explained it well. fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with…

If you can't remember 192.168 you definitely can't remember a randomly picked ULA. So just use fd00. It's not any worse than 192.168.

True, I was thinking more about the allocation discussion than the "easy to remember".

Anyone in IT who allocates 1.1.1.0/24 because 192.168.0.0/24 is hard, should be allocated to trash pickup.

Re: My security camera shipped a GitHub admin token in its login page

#134

Post by TeMPOraL »

phh wrote: post #38
llm_nerd wrote: post #21

Earlier quoted context omitted.

And it's worth considering that obfuscation only ever worked against casuals for whom tedious was a bridge too far. Nation state actors and criminal hacker groups, on the other hand, consider the tedious entirely worth it.

Yes, obfuscation was always a matter of cost : how much money do you need to break the protection? LLM just decreased that amount by a lot. (Yes ok, RSA4096 is technically a matter of cost, you just need an infinite amount of money)

All security is always a matter of cost. Clown theater starts once you lose track of it, and start doing security for security's sake.

RE obfuscation and nation states - nation states have finite budgets too, both in terms of resources and attention. They can crack any system at any time, but they can't afford to crack all of the systems all of the time.

Re: My security camera shipped a GitHub admin token in its login page

#135

Post by myself248 »

prox wrote: post #59
lardosaurusrex wrote: post #44

Earlier quoted context omitted.

just buy stuff you can put your own firmware/os on because it's either just the worst security in the world (aka anything not from china) or, well... china. and while i currently don't hate china as much as i do US rn (because canadian; sorry) i can also say -- due to being an aforementioned leaflandian -- that due to very personal experience i have zero faith in anything from china that has the ability to connect to…

That sounds horrible. I got an old PI4, would it make for a decent router, if at all possible?

It's not quite ideal hardware due to only having a single NIC, but you can slap a USB NIC on it and make it work, if that's what's handy.

Old thin clients are typically in the same hardware class, and probably cheaper by the time you add the exploding MSRP of a Pi, and a PSU, and a case and heatsink, and maybe some storage that doesn't suck ass. But if you already own the Pi, yeah, go for it.

Re: My security camera shipped a GitHub admin token in its login page

#136

Post by zrail »

unethical_ban wrote: post #131
tracker1 wrote: post #80

Earlier quoted context omitted.

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even. Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

No network is "smaller" than /64. All end-networks are /64. Split subnets at four bit chunks. Allocated networks, like to a home or small office, should be /56 or /60. Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination. I have a rough draft of a beginner document but it's not ready. :)

(Pedantically) Maximum prefix length of /64 is only required if you want/need SLAAC. If you're assigning static addresses or using DHCPv6 for assignment you can go as small as you want. It's not weird to see /127 for tunnel subnets, for example.

Re: My security camera shipped a GitHub admin token in its login page

#137

Post by unethical_ban »

zrail wrote: post #136
unethical_ban wrote: post #131

Earlier quoted context omitted.

No network is "smaller" than /64. All end-networks are /64. Split subnets at four bit chunks. Allocated networks, like to a home or small office, should be /56 or /60. Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination. I have a rough draft of a beginner document but it's not ready. :)

(Pedantically) Maximum prefix length of /64 is only required if you want/need SLAAC. If you're assigning static addresses or using DHCPv6 for assignment you can go as small as you want. It's not weird to see /127 for tunnel subnets, for example.

I didn't want to encourage non-standard behavior, but you are correct. Tunnels are a common use the same way /31s can be used in IPv4.

Going smaller than /64 is against best practice and unnecessary. People coming from IPv4 need to understand that trying to be careful with subnet sizing for purposes of preserving space is not a thing in IPv6 below /64. Maybe if a residential user has a /64 from their crappy ISP settings they'd need to do it, but not in a properly configured scenario and certainly not in enterprise.

Re: My security camera shipped a GitHub admin token in its login page

#138

Post by cenamus »

nozzlegear wrote: post #130
badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Seems like the shop is broken? > Stránka nenalezena > There's been a glitch... > We're not quite sure what went wrong. You can go back, or try looking on our homepage.

Czech for 'page not found'

Re: My security camera shipped a GitHub admin token in its login page

#139

Post by TaLiTr »

badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

I wish... The best I've found is https://openipc.org/ which is a very manufacturer unsupported way of reflashing certain chips with open-source firmware. It seems very fiddly as only certain SoCs are supported and good luck finding out if a specific Chinese camera has one.
Post reply on HN