Sorry to be that guy but if you can't even bother to capitalize your sentences then I won't bother to read your blog.
My security camera shipped a GitHub admin token in its login page
201–210 of 265 posts
Re: My security camera shipped a GitHub admin token in its login page
#202Earlier quoted context omitted.
You would be better served using a USB capable camera behind an RPi to have assurance that broken firmware isn't compromising your network.
I was working with Raspberry Pis, starting with a college honors project, around 2018. For a while, I thought about building a network of surveillance cameras around the interior of my home. The Raspberry Pi seemed like a tempting platform to hook up a bunch of cameras to it. Sadly, I could not find a backend surveillance app or system that was suitable for running such a network. The best one I found was some kind o…
As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention.
There are non-IP cameras and coax interfaces, which would expose a USB video device on any Linux system, RPi included.
Plenty of software to handle that, though don't know what's the state of the art.
Re: My security camera shipped a GitHub admin token in its login page
#203Earlier quoted context omitted.
I was working with Raspberry Pis, starting with a college honors project, around 2018. For a while, I thought about building a network of surveillance cameras around the interior of my home. The Raspberry Pi seemed like a tempting platform to hook up a bunch of cameras to it. Sadly, I could not find a backend surveillance app or system that was suitable for running such a network. The best one I found was some kind o…
As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention. There are non-IP cameras and coax interfaces, which would expose a USB video device on any Linux system, RPi included. Plenty of software to han…
[deleted]
Re: My security camera shipped a GitHub admin token in its login page
#204[flagged]
Re: My security camera shipped a GitHub admin token in its login page
#205Sorry to be that guy but if you can't even bother to capitalize your sentences then I won't bother to read your blog.
At least it's written by a human and not AI slop.
Re: My security camera shipped a GitHub admin token in its login page
#206Earlier quoted context omitted.
Lack of NAT doesn't imply lack of firewall, though. And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.
But lots of people want to do things like open up a few ports for a gaming console. You can obviously do it, but the inside network/outside network/poke a hole/simple ip addresses mental model makes it harder for people to just get frustrated and disable it. Of course absolutely nothing is impossible or more difficult from a technical networking perspective using IPv6. People want to learn as little as humanly possib…
how is it a different mental model? instead of opening the port in NAT via forward feature, you open the port in the firewall. it is in fact significantly simpler while overall being the same actions you take when you want to "forward"
Re: My security camera shipped a GitHub admin token in its login page
#207Earlier quoted context omitted.
you fling around words like "network maintainers" quite casually, dont you? :) its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?
Fling it around? There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?
nobody suggests they should be, the ONLY difference is that the routers will block inbound connections by default, and you open your port in the firewall section instead of the shitty router instead of the nat/port forwarding
Re: My security camera shipped a GitHub admin token in its login page
#208Earlier quoted context omitted.
Lack of NAT doesn't imply lack of firewall, though. And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.
But lots of people want to do things like open up a few ports for a gaming console. You can obviously do it, but the inside network/outside network/poke a hole/simple ip addresses mental model makes it harder for people to just get frustrated and disable it. Of course absolutely nothing is impossible or more difficult from a technical networking perspective using IPv6. People want to learn as little as humanly possib…
I have ipv6 here in Europe. The router firewall configuration works basically the same as IPv4 port forwarding. You can add a firewall exception as easily as you can add a port forward. You can also turn the firewall off, globally or per device.
Re: My security camera shipped a GitHub admin token in its login page
#209Earlier quoted context omitted.
Fling it around? There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?
NAT is good. It's CGNAT that's bad, because that's NAT imposed on subscribers, and not NAT that they control.
NAT is bad. CGNAT is worse.
Re: My security camera shipped a GitHub admin token in its login page
#210Earlier quoted context omitted.
(Pedantically) Maximum prefix length of /64 is only required if you want/need SLAAC. If you're assigning static addresses or using DHCPv6 for assignment you can go as small as you want. It's not weird to see /127 for tunnel subnets, for example.
I didn't want to encourage non-standard behavior, but you are correct. Tunnels are a common use the same way /31s can be used in IPv4. Going smaller than /64 is against best practice and unnecessary. People coming from IPv4 need to understand that trying to be careful with subnet sizing for purposes of preserving space is not a thing in IPv6 below /64. Maybe if a residential user has a /64 from their crappy ISP setti…
If you have a network full of static addressed servers, you can go as small as you want. For WiFi networks random devices may connect to, you should just let them pick their own address in a /64 with SLAAC. You may choose to also let servers use SLAAC if you want to, in addition to their static address.