Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

191–200 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#191
post #180

Earlier quoted context omitted.

Fling it around? There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?

Lack of NAT doesn't imply lack of firewall, though. And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.

But lots of people want to do things like open up a few ports for a gaming console. You can obviously do it, but the inside network/outside network/poke a hole/simple ip addresses mental model makes it harder for people to just get frustrated and disable it. Of course absolutely nothing is impossible or more difficult from a technical networking perspective using IPv6. People want to learn as little as humanly possible to solve their problems. If the default easiest path is ‘disable the firewall, and suddenly you can use the LAN pvp mode with your 6th grade classmate’ then you better fucking believe that’s exactly what they’re going to do. The “well it’s not really that complicated” perspective is the main reason adoption of user-facing FOSS is lightyears behind commercial options.

Re: My security camera shipped a GitHub admin token in its login page

#192

Earlier quoted context omitted.

If they converted to IPv6, they could easily have a globally unique address space. Real globally unique, not probabilistic.

The fact that the network concentrator co uses DoD v4 address space to avoid conflicts implies that their clients are bringing v4 addresses, so IPv6 is utterly irrelevant in this situation.

[deleted]

Re: My security camera shipped a GitHub admin token in its login page

#193

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

You would be better served using a USB capable camera behind an RPi to have assurance that broken firmware isn't compromising your network.

Re: My security camera shipped a GitHub admin token in its login page

#194

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

You would be better served using a USB capable camera behind an RPi to have assurance that broken firmware isn't compromising your network.

I was working with Raspberry Pis, starting with a college honors project, around 2018.

For a while, I thought about building a network of surveillance cameras around the interior of my home. The Raspberry Pi seemed like a tempting platform to hook up a bunch of cameras to it. Sadly, I could not find a backend surveillance app or system that was suitable for running such a network. The best one I found was some kind of modular Linux app that was for-pay, and actually seemed based in Russia or something, and personally I wasn't comfortable about handing over my domestic surveillance needs to Russia!

I also considered exterior sensors, such as a camera, or perhaps a nice little weather station, outside on my balcony, running on the little Raspberry Pi.

Then I recalled two things: I live in the Sonoran Desert, where the desert highs can go up around 115℉, and any plant on my balcony was guaranteed to wither and die, not to mention the blowing dust and thunderstorms we have.

I determined that there was basically no way to house or protect a Raspberry Pi, as well as supply it with connectivity and electric power, and keep it outside on the balcony in conditions where I'd benefit from those active sensors. Sad but true!

Re: My security camera shipped a GitHub admin token in its login page

#195
post #35
post #30

Earlier quoted context omitted.

"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"

192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for…

The proper way to do ULA is to generate random 40-bit ID. Then your ULA are likely unique. Which means that if you want to connect or merge with another company, the networks are distinct.

IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.

Re: My security camera shipped a GitHub admin token in its login page

#196

Earlier quoted context omitted.

I doubt any endpoints are entirely ipv6. So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow. I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for. No human said “hey, network…

I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct. like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated. To me, that would make more s…

An alternate to IPv6 would have been to store the NAT addresses in IPv4 somehwere. But the IPv4 options are fragile and normal NAT would likely destroy them. It would still require rewriting all of the networking and software. It would have engrained NAT everywhere and made lots of routing problems, like is that your or mine 10. network.

Re: My security camera shipped a GitHub admin token in its login page

#198

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Pine cube

https://pine64.org/devices/pinecube/

Re: My security camera shipped a GitHub admin token in its login page

#199
post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

Or Korean IoT products. The ones I was working on had insane approach to security.

can you elaborate on that approach?

Re: My security camera shipped a GitHub admin token in its login page

#200
what a good blog to read. Have you found answer on why they use the same token across these bunch of files? Maybe they are tying to adopt the agentic code writing? One interesting questions, what does that gh token give access to? It is only read from private repo, is not it? You said "admin" privileges earlier.
Post reply on HN