Hacking together something usable out of cloud-first piece of hardware you ended up with is respectable, but I would like to bring up another option to go with if you're choosing a new device: buy camera that doesn't require a phone app to initial setup and serves RTSP out of the box.
Wanted to spy on my dog, ended up spying on TP-Link
131–140 of 181 posts
Re: Wanted to spy on my dog, ended up spying on TP-Link
#132Earlier quoted context omitted.
Overall: yes, but it will get much harder for apps which need attestation, which is sort of the point, for better or for worse. As far as I know you'll still be able to OEM unlock and root phones where it's always been allowed, like Pixels, but then they'll be marked as unlocked so they'll fail Google attestation. You should also be able to still take an app, unpack it, inject Frida, and sideload it using your _own_…
So for people with any practical needs what so ever (like banking): No. At this point Android isn’t meaningfully an open-source platform any more and it haven’t been for years. On the somewhat refreshing side, they are no longer being dishonest about it.
>At this point Android isn’t meaningfully an open-source platform any more
Google Android as installed on 99% of stock android phones never was open source. AOSP continues to be open source and is not effected by any changes made in the proprietary google android and google play services eco system.
People would do good by stop conflating the two.
Re: Wanted to spy on my dog, ended up spying on TP-Link
#133I used to get in the kind of frustrated situations where, like the author, I spent two days reverse-engineering something I had just bought just to get it to do what I thought it obviously would when I bought it.
IOT things like the thing he bought are (were) typically the worst kind of offenders.
I just don't do that anymore. It used to bring me pleasure cracking the nut, and that's not the case any longer.
These days, if it does not do what I need more or less out of the box, I just return it / send it back and research the follow-up buy better.
Re: Wanted to spy on my dog, ended up spying on TP-Link
#134I know people who are still using the router their ISP gave them, and they’ve never even changed the default password. The thing is, they don’t even know it can be updated, let alone that there might be security vulnerabilities. To most users, if the internet works, that’s all that matters.
As it should be. The problem is that for ISPs, "Internet works" is defined as minimum possible service level that doesn't cause active revolt of majority of customers.
Good hardware? Costs money. Connecting to anything that goes beyond Netflix and Facebook requirements? Costs money, operations isn't cheap. Anything unusual (so much so as being seen borderline criminal) as hosting your own server, email, or $deity forbid networking hardware? Forget it, support costs money.
And so on.
Re: Wanted to spy on my dog, ended up spying on TP-Link
#135Side note - “full-proof” is an eggcorn of “foolproof”.
Re: Wanted to spy on my dog, ended up spying on TP-Link
#136Side note - “full-proof” is an eggcorn of “foolproof”.
And eggcorn means "a word or phrase that results from a mishearing or misinterpretation of another, an element of the original being substituted for one which sounds very similar (e.g. tow the line instead of toe the line )."
I'd never heard of it before
Re: Wanted to spy on my dog, ended up spying on TP-Link
#137Earlier quoted context omitted.
I agree that would be nice, but it also doesn't sound all that practical for a small vendor. I used to sell a home networking device,[0] and I wouldn't do what you're describing. If there were an issue where the labels calculate the wrong password or the manufacturer screws up which device gets which label, you don't find out until months later when they're in customer hands and they start complaining, and now you ha…
Ha! I actually use TinyPilot all the time, nice! > I agree that would be nice, but it also doesn't sound all that practical for a small vendor. Personalizing / customizing per device always introduces a huge amount of complexity (and thus cost). However, this is TP-Link we're talking about, who definitely have the ability to personalize credentials at scale on other product lines. And again, to be clear, I'm not tryi…
> Personalizing / customizing per device always introduces a huge amount of complexity (and thus cost)
For a hardware product mass produced like this, they should already have a custom label that has the unique serial number on it which is also programmed into each device, so they should already have the infrastructure to do that (potentially as part of automated board testing/flashing).
Adding a randomly generated password is hardly more work once you have the ability to do that.
Re: Wanted to spy on my dog, ended up spying on TP-Link
#138Earlier quoted context omitted.
So for people with any practical needs what so ever (like banking): No. At this point Android isn’t meaningfully an open-source platform any more and it haven’t been for years. On the somewhat refreshing side, they are no longer being dishonest about it.
Open source has nothing to do with hackability. Firmware which requires updates to be signed with a manufacturer key can still be open source. As long as its code is available publicly, under a license which lets the user create derivative works, it meets the definition. You can still make a version of it that doesn't contain that check, you just can't install that version on the device you bought from the original f…
> Open source has nothing to do with hackability.
That's not universally true, it depends on the license we're talking about.
As an arbitrary counterexample, the LGPL specifically requires you to give end users of your thing a way to link your object code with their own modified version of the LGPL'd library.
Re: Wanted to spy on my dog, ended up spying on TP-Link
#139Hacking together something usable out of cloud-first piece of hardware you ended up with is respectable, but I would like to bring up another option to go with if you're choosing a new device: buy camera that doesn't require a phone app to initial setup and serves RTSP out of the box.
What cheap camera doesn't require a phone app and serves RTSP out of the box?
Re: Wanted to spy on my dog, ended up spying on TP-Link
#140Earlier quoted context omitted.
TP-Link is far from being a small vendor, though.
I think he has it backwards: Easy for a small vendor, very hard for a large one.
For a large manufacturer, it can be flashed onto the device automatically by a machine as part of the production line. That's not easy to set up, but basically something they already need to have set up (you don't want to have humans have to plug in boards to flash firmware and load serial numbers, etc. on to every unit).