41–50 of 161 posts
A little off topic, but how is it possible that a tech startup named itself “Wyze” and didn’t get sued by Google over the “Waze” trademark? In some accents it sounds exactly the same, and they’re sort of in an adjacent product space.
“Don’t use Wyze” seems like the wrong takeaway from this. I’d go with “don’t put internet-connected cameras in your house if you don’t want those images on the internet”. I’ve got a Wyze in my garage looking over my mountain bikes, and for $35 I don’t really care if somebody else sees that image. But I’d never put one in my living space, regardless of their security track record.
Earlier quoted context omitted.
Do you think the issue was something else? "People randomly see other people's content" is an issue that would immediately make me think some issue with caching is the culprit. Given their openness in the rest of the communications, I don't see why they would make this part up. Edit: Of course, I'm also curious what the actual bug was. A discussion below is suggesting several plausible ways (e.g. concurrency issues,…
> I'm also curious what the actual bug was Hardware. Rowhammer-type effects occurring accidentally under sudden load spikes. The hardware has just got too dense. (I should clarify this is speculation, but reading the recent article included here on sudo using special maximum-distance bitfields to hold state internally ( https://news.ycombinator.com/item?id=39165342 )... it must be a problem that's being observed in t…
As an software engineer who's dealt with caches for large high throughput services, this does not make sense to me why they are blaming a caching client. It's your own code that will decide what is the cache key, and what value to pass as the cache key. Did the caching library have a bug where when you ask for a given key, it returned results for a different key? Or more likely did your own code have a bug where you mixed up the keys? I think we need more details on what went wrong in here.
“Don’t use Wyze” seems like the wrong takeaway from this. I’d go with “don’t put internet-connected cameras in your house if you don’t want those images on the internet”. I’ve got a Wyze in my garage looking over my mountain bikes, and for $35 I don’t really care if somebody else sees that image. But I’d never put one in my living space, regardless of their security track record.
What is the point of filming your mountain bikes? Do you watch them from your office with fondness of your most recent ride? Will that prevent them from being stolen? I doubt so.
Unless the camera has lasers, it isn't very good at stopping said theft. ;)
Earlier quoted context omitted.
Or buying cheap, no-brand or upstart brand cameras with cloud capabilities. I had a heck of a time finding a proper POE recording DVR camera system for my mom's house without online or cloud bullshit, but still I isolated it on the network to not take any chances of UPnP port opening or dial-home crap. The only system I would trust would be one that laid out their security model, source to their apps, and had a self-…
Got any brand/model recommendations? I also want to run full local.
The cameras are a wide variety of IP POE cameras which is helpful as I am not stuck to a single brand.
Earlier quoted context omitted.
What is the point of filming your mountain bikes? Do you watch them from your office with fondness of your most recent ride? Will that prevent them from being stolen? I doubt so.
The primary use case for a camera watching something that might get stolen is to provide proof of theft for insurance. In some cases it can provide clear evidence of what exactly was stolen, and in some cases information about who stole it. Unless the camera has lasers, it isn't very good at stopping said theft. ;)
Not my project but I have had great success with https://github.com/gtxaspec/wz_mini_hacks & V3 model. The V3 models need to be downgraded to a specific firmware first and patching it exposes RSTP streams using https://github.com/AlexxIT/go2rtc . Everything doable without ever installing Wyze app on an environment air gapped environment with no internet.
1. all cameras (firmware v4.36.9.139) have 64gb+ micro SD cards and record to local storage -- many people seem to have issues with anything greater than 32gb in v3's but I've found that this Verbatim tool [0] formats FAT32 at high capacity with no problems
2. all cameras have wz_mini_hacks [1] on the SD card with RTSP enabled
3. all cameras are connected via ethernet instead of wifi using this adapter [2] and wz_mini_hacks config
4. network blocks all outgoing internet connections for all cameras to keep them LAN-only -- this means I have to connect to VPN to review video when outside the house, but I'm cool with that
5. all RTSP streams are also recorded over the network via Agent DVR [3] to a NAS
6. the Wyze app (free tier, not paid) works normally with all of the above in place -- I find it much more intuitive to review recent videos in-app (streamed off the SD card), and then review the very occasional older video from a computer off the NAS (scrubbing through in VLC on a computer)
For what it's worth, I don't use them like a Ring camera where you're responding to realtime video events / talking through the camera to a delivery person -- this is mostly just for 24/7 recording. I have all object/motion detection events turned off, just a straight uninterrupted feed recording local and on the network.
Links:
0. https://www.verbatim.com/index/search.php?words=fat32+tool
1. https://github.com/gtxaspec/wz_mini_hacks
>The outage originated from our partner AWS and took down Wyze devices for several hours early Friday morning. ... As we worked to bring cameras back online, we experienced a security issue. Some users reported seeing the wrong thumbnails and Event Videos in their Events tab. ... The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received…