111–120 of 128 posts
I more and more tend to not buy any network-connected product if there's no open-source firmware to run on it. (Phones is one notable exception. I need contactless payments to work.)
Good thing some tapos do have alternative firmware like thingino.
>25000 devices exposed directly How does this happen? Doesn’t pretty much every ISP give a router with their modem? How do people manage this?
In ipv4 these will be src-natted and thus have a statefuo firewall by necessity. In IPv6 they likely will auto configure onto a public ip address which may not have a stateful firewall.
Earlier quoted context omitted.
An 'open S3 bucket' sounds really bad. If it were posted on an HTTPS site without authentication, like the firmware for most devices, it wouldn't sound so bad. Sure an open bucket is bad, if it's stuff you weren't planning on sharing with the whole world anyway.
Since firmware is supposed to be accessible to users worldwide, making it easier to get it is good. But how is an open, read-only S3 bucket worse than a read-only HTTPS site hosting exactly the same data? The only thing I can see is that it is much easier to make it writeable by accident (for HTTPS web site or API, you need quite some implementation effort).
Earlier quoted context omitted.
An 'open S3 bucket' sounds really bad. If it were posted on an HTTPS site without authentication, like the firmware for most devices, it wouldn't sound so bad. Sure an open bucket is bad, if it's stuff you weren't planning on sharing with the whole world anyway.
> An 'open S3 bucket' sounds really bad. Only to gullible, clueless types. Full blown production SPAs are served straight from public access S3 buckets. The only hard requirement is that the S3 bucket enforces read-only access through HTTPS. That's it. Let's flip it the other way around and make it a thought experiment: what requirement do you think you're fulfilling by enforcing any sort of access restriction? When…
I'm not shitting on anything except the wording in the article.
I guess I didn't word it clearly.
In our company we don't really serve directly from open buckets but through cloudfront. Though this is more because we are afraid of buckets marked open by mistake so they are generally not allowed. But I agree there's nothing bad about it. I just meant it sounds much worse (at least to someone in cybersec like me) and I don't like the effect used as such in the article.
Earlier quoted context omitted.
802.1x is quite trivial to bypass if you have an authenticated device (in this case the intercom) that you can transparently bridge[1]. [1]. https://www.defcon.org/images/defcon-19/dc-19-presentations/...
it still will block or slow down many. 802.1x is commonly deployed with macsec. will it be also trivial to bypass ?
PSA: Don't connect any TV used a dumb monitor to the internet. This is like connecting your toaster to the internet and begging for trouble.
Earlier quoted context omitted.
it still will block or slow down many. 802.1x is commonly deployed with macsec. will it be also trivial to bypass ?
Did you ever seen an intercom or IP camera with macsec support?
Earlier quoted context omitted.
Maybe listing shouldn't be enabled even if all the files are public.
> Maybe listing shouldn't be enabled even if all the files are public. I don't see why. Support for firmware upgrades literally involve querying available packages and downloading the latest ones (i.e., apply upgrades). Either you use something like the S3 interface, or you waste your time implementing a clone of what S3 already supports. Sometimes simple is good, specially when critics can't even provide any concret…
Earlier quoted context omitted.
Did you ever seen an intercom or IP camera with macsec support?
yes for example https://newsroom.axis.com/en-us/press-release/macsec-zero-tr...
Now we need to get an enterprise grade switch - doubt Cisco would add macsec into SOHO gear. Along with enterprise grade intercoms, cameras, doorbells...
And beloved by many Unifi is out of question - they still can't bake IPv6 support.
So looks like it's feasible but the cost wouldn't be good.
ADD: also read this article: https://news.ycombinator.com/item?id=41531699
Earlier quoted context omitted.
do you happen to have a guide on how to achieve this - I am fairly technical but still configuring Vlans and moving devices there would be good with some step by step instructions.
depends on your router, but you would want to stick to onvif or rtsp and connect to the camera using some sort of tailscale. Don't fail for installing open source firmware, there is only thingino and openipc, both are hard to install if you are a beginner, even if people say it's easy for technical specialist, it's not