Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way.
I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced.
Not exactly open firmware, but something like ONVIF on an isolated network is pretty close. An ONVIF camera should talk to basically any NVR (network video recorder), there are several open-source ones available.
There are tons of ONVIF-compliant and cheap PoE cameras, and with this setup you really don't care about the security of the manufacturer firmware since you aren't exposing them to the network publicly. However, you do need to be extra diligent when configuring your VLAN/network segmentation.
makefu 1 days ago [-]
There is also https://thingino.com/ which has a clear set of supported cameras. The installation is straight forward if you choose a cam with SD-Card flashing support. I upgraded two of the Sonoff Slim Gen2 without any issues.
dns_snek 9 hours ago [-]
I found Thingino to be very buggy and frustrating to use despite using 2 different supported cameras. The stream would constantly drop out, services would sometimes crash and wouldn't get automatically restarted. I tried tweaking all available parameters, resetting, updating but eventually I just gave up (a few months ago).
> We're not quite sure what went wrong. You can go back, or try looking on our homepage.
badatnames 1 days ago [-]
Huh, it was working an hour ago. The outdoor 8MP variant was around the 85 euro mark.
cenamus 1 days ago [-]
Czech for 'page not found'
kevin_thibedeau 18 hours ago [-]
You would be better served using a USB capable camera behind an RPi to have assurance that broken firmware isn't compromising your network.
ButlerianJihad 18 hours ago [-]
I was working with Raspberry Pis, starting with a college honors project, around 2018.
For a while, I thought about building a network of surveillance cameras around the interior of my home. The Raspberry Pi seemed like a tempting platform to hook up a bunch of cameras to it. Sadly, I could not find a backend surveillance app or system that was suitable for running such a network. The best one I found was some kind of modular Linux app that was for-pay, and actually seemed based in Russia or something, and personally I wasn't comfortable about handing over my domestic surveillance needs to Russia!
I also considered exterior sensors, such as a camera, or perhaps a nice little weather station, outside on my balcony, running on the little Raspberry Pi.
Then I recalled two things: I live in the Sonoran Desert, where the desert highs can go up around 115℉, and any plant on my balcony was guaranteed to wither and die, not to mention the blowing dust and thunderstorms we have.
I determined that there was basically no way to house or protect a Raspberry Pi, as well as supply it with connectivity and electric power, and keep it outside on the balcony in conditions where I'd benefit from those active sensors. Sad but true!
necovek 12 hours ago [-]
As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention.
There are non-IP cameras and coax interfaces, which would expose a USB video device on any Linux system, RPi included.
Plenty of software to handle that, though don't know what's the state of the art.
shakna 8 hours ago [-]
> They absolutely have no interest in your domestic matters
This is categorically, not true, I'm afraid. Reaching into domestic networks, where you can find influential people through mass harvesting, is an actively exploited technique by the spy agencies of our world.
How do you find the gardener of someone influential? You target all gardeners.
necovek 2 hours ago [-]
We are talking here about someone at least technically savvy who would know if they are of interest or not (ok, maybe not). They'd also be able to monitor their outgoing traffic.
We are also not talking about a potential Russian product that will reach into large number of homes since — being paid and privacy focused — it is already a niche product. So getting into someone's home of interest would need a lot of luck, and there are probably better ways to do it.
Telemakhos 9 hours ago [-]
Why should I want to hand mu domestic surveillance over to any company? Why wouldn’t I prefer a private solution that lets me host my own data?
necovek 2 hours ago [-]
Being more comfortable with a foreign company compared to a domestic one does not suggest you should be comfortable with either ;)
mschuster91 5 hours ago [-]
> As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention.
Unfortunately, that isn't exactly true. Sure, they don't have any usage for your porch camera and its data, but the fact that it is hooked up to an IP classified as "US residential" or "US small-business" is the valuable thing. DDoS nodes, "residential IP proxy" malware or running botnet campaigns all benefit from a high bandwidth connection that is 99% not getting flagged in any list.
necovek 2 hours ago [-]
That is certainly a different matter: "handing over domestic surveillance" vs enabling a foreign company to run a node on your network.
However, that is mostly about trusting or not trusting someone's business. Eg. DJI drones and action cams and gimbals are omnipresent, and they have the potential to do the same when it comes to China.
But they also have plenty to gain from building a great product and selling it and not reselling your IP addresses.
12 hours ago [-]
numpad0 1 days ago [-]
Not exactly what you have asked for, but ESP32 based M5Stack and Seeed Xiao modules might fit the bill. They are not so expensive, are Linux-free, and there's no report so far of secret ping home features in the SDK.
mschuster91 5 hours ago [-]
ESP32 are powerful enough to run realtime image processing?! Wtf.
em3rgent0rdr 1 days ago [-]
ESP32-CAM
LastTrain 1 days ago [-]
I so want these to be a viable solution but man my experience so far is that it can barely be made to work and only in the most favorable environments. Compare that to the blink cameras I used to run outside where it occasionally went below -20F and they still went over a year on a couple batteries.
Thank you. Ordered one to play around and see if this is a viable alternative.
TaLiTr 1 days ago [-]
I wish...
The best I've found is https://openipc.org/ which is a very manufacturer unsupported way of reflashing certain chips with open-source firmware. It seems very fiddly as only certain SoCs are supported and good luck finding out if a specific Chinese camera has one.
Would it be so difficult to include a simple plastic case? Having to find/design 3D printed cases adds time to getting these projects set up. I don’t have a 3D printer and have to go to the local maker space to make anything.
radredgreen2 23 hours ago [-]
[dead]
grommz 1 days ago [-]
The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
hhh 1 days ago [-]
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
anonymars 1 days ago [-]
Interesting -- seems like the side effect would be to basically prevent use by the DoD but not really anyone else. Bonus points if they sell a "government" version for higher cost
accrual 1 days ago [-]
I also know of a company who does this. The reason in their case is they act as a network concentrator, bridging hundreds of client IP spaces, so this helps them avoid conflicts with their own space without having to NAT constantly. There is still a lot of NAT for the more common ranges.
inigyou 1 days ago [-]
If they converted to IPv6, they could easily have a globally unique address space. Real globally unique, not probabilistic.
oasisbob 22 hours ago [-]
The fact that the network concentrator co uses DoD v4 address space to avoid conflicts implies that their clients are bringing v4 addresses, so IPv6 is utterly irrelevant in this situation.
inigyou 5 hours ago [-]
It's common for a network to address its own devices with v6 while carrying v4 traffic either natively or by tunneling. Saves v4 space.
18 hours ago [-]
20 hours ago [-]
Arrowmaster 20 hours ago [-]
I don't remember which but one of the major US cellular networks was using the DoDs 7.0.0.0/8 internally. It was never an issue since the DoD kept that /8 offline but the IPs would show up in traceroutes. I had to tell many people to ignore it.
ErroneousBosh 1 days ago [-]
I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated".
You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.
mr_mitm 1 days ago [-]
I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.
inigyou 1 days ago [-]
As long as it's strictly separated from the internet it works. The Internetwork Packet Exchange, used for cellular roaming, is a parallel global internet with its own addresses and allocation policies.
prerok 1 days ago [-]
This story is so silly it must be true. Thank you, made me laugh out loud.
tracker1 1 days ago [-]
LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers.
On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.
zrobotics 24 hours ago [-]
I dunno, seems like it could be a bit vague. Does 45 refer to 45 Webley or 45 GAP? Could possibly also refer to 45 Colt I guess, if you're boring. But 45 Colt, 45 ACP, 45 Colt Government?
Also, just in case this comment isn't pedantic enough, 10.22 would be a firearm range, not an ammo range. And AFAIK they only ever chambered that for .22 rimfire cartridges. ;)
jabart 1 days ago [-]
Didn't AT&T do that and Cloudflare made them change it when they aquired that space?
tracker1 1 days ago [-]
I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security.
Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.
hackernudes 1 days ago [-]
Quantenna used 1.1.1.1 for RPC to their wifi chip in their SDK by default. Should not have been exposed to global routing but of course people screwed that up.
My ISP won't give me the router credentials because they claim that that would somehow risk their network interconnectivity or something. I have no idea how this makes any sense since a router (shouldn't) give me that level of access, but maybe I'm missing something?
bityard 23 hours ago [-]
If the router is also the modem, it can have diagnostic stuff that could (I am careful to point out: theoretically) cause them a big support headache in one way or another.
Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire multiple public IPv4 addresses via DHCP.
ethin 20 hours ago [-]
Really? I didn't know ISP-provided modems could even do that, I assumed they were like routers and isolated to the local network and what the ISP gives them access to. I just wish they would give me more than "well it's for security and it's corporate policy" or something, it just seems like some excuse, and their remedy is "buy your own router" (which isn't an option for me, too expensive).
Melatonic 1 days ago [-]
Or they didn't want you to know the IP(s) so you could easily block it
Sounds like they blocked Cloudflare but couldn't block Google
ErroneousBosh 1 days ago [-]
Funny enough their problems really began in earnest about seven or eight years ago...
cyanydeez 1 days ago [-]
Sounds like someones on the path to sovereign citizenship. I can't wait for our cyber-sovereign citizenships who deny various IP ranges coming from the government's domain naming system.
inigyou 1 days ago [-]
Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range.
If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.
Matuzy 1 days ago [-]
> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range
I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.
inigyou 1 days ago [-]
All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range.
The point of IPv6 was to make the addresses so long they are easy to manage.
SV_BubbleTime 1 days ago [-]
>The point of IPv6 was to make the addresses so long they are easy to manage.
lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.
tracker1 1 days ago [-]
I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even.
Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.
DrewADesign 1 days ago [-]
It seems to have absolutely terrible ergonomics as a technology, in nearly every conceivable way.
inigyou 1 days ago [-]
It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.
DrewADesign 1 days ago [-]
The length isn’t the only thing that makes the ergonomics suck. The lack of backwards compatibility sucks. The “you don’t have to use NAT anymore” is great theoretically, but it renders a lot of casual network maintainers mental model of network security obsolete without a clear and simple alternative. The shorthand is not intuitive (though it’s not CIDR-level counterintuitive). Really, there’s way too much about working in IPv6 that’s not intuitive with even very solid IPv4 network knowledge.
So yeah, having to relearn a bunch of basic network knowledge that worked just fine for decades is a PITA, and I’m 100% positive a design process that focused more on the people that need to configure networks could have yielded a much friendlier, and therefore a much easier to adopt standard.
ndriscoll 22 hours ago [-]
Instead of forwarding a port to a specific machine on the NAT page, you allow incoming traffic on that port to that machine on the firewall page. You'll want to add a stable IP to the host (in addition to the SLAAC rotating privacy IP if it already has one. One interface can have multiple addresses). That's pretty much it, except now you can allow the same port to multiple machines, where previously you could only forward to one (helpful for gaming, voip, etc. Wherever p2p works well). Firewall should already default deny incoming traffic just like ipv4.
ssl-3 21 hours ago [-]
That sounds easy, but I think you just inadvertently demonstrated the quagmire that many seem to perceive.
Suppose I've got a machine on the LAN and I want to open it up to the world on port 1025 with IPv6.
This can't happen with SLAAC? It has to be a new address? Does the ISP pick the prefix for that address? And one can't centrally-manage that address (because people keep saying that DHCPv6 isn't worth stuffing around with)? What happens when the router fails over to a backup ISP? How does dynamic DNS fit in with all of this?
Those questions don't really exist with IPv4, wherein: One can just set up a static DHCP assignment, forward port 1025, and [optionally] set up dynamic DNS -- and this all happens within the confines of a single home router.
ndriscoll 19 hours ago [-]
If it's MAC based SLAAC, it'll be stable, so you could use it. Otherwise you add a stable address. You could use DHCP if you want. If you're using a backup ISP with dynamic DNS, your failover should be the same as ipv4. You can already have ips from both prefixes on the interface. You're also way past clueless home user stage if you have that setup at all, so I can't imagine ipv6 is the stumbling block.
Things would be nicer if NAT66 were used by default for home users though so the question of prefixes would disappear, and it'd perhaps match the "more advanced" home user ipv4 mental model. You'd just use e.g. fd00::2 as your server address.
redeeman 1 days ago [-]
you fling around words like "network maintainers" quite casually, dont you? :)
its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?
DrewADesign 22 hours ago [-]
Fling it around?
There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?
inigyou 3 hours ago [-]
Actually I think most people really do want that stuff accessible from the internet. Currently that requires a central server and a subscription, but imagine if it didn't. Imagine if you could log into your washing machine from anywhere instead of only when you're at home, and it would keep working even if LG went bankrupt.
ssl-3 21 hours ago [-]
Lack of NAT doesn't imply lack of firewall, though.
And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.
DrewADesign 18 hours ago [-]
But lots of people want to do things like open up a few ports for a gaming console. You can obviously do it, but the inside network/outside network/poke a hole/simple ip addresses mental model makes it harder for people to just get frustrated and disable it. Of course absolutely nothing is impossible or more difficult from a technical networking perspective using IPv6. People want to learn as little as humanly possible to solve their problems. If the default easiest path is ‘disable the firewall, and suddenly you can use the LAN pvp mode with your 6th grade classmate’ then you better fucking believe that’s exactly what they’re going to do. The “well it’s not really that complicated” perspective is the main reason adoption of user-facing FOSS is lightyears behind commercial options.
inigyou 10 hours ago [-]
I have ipv6 here in Europe. The router firewall configuration works basically the same as IPv4 port forwarding. You can add a firewall exception as easily as you can add a port forward. You can also turn the firewall off, globally or per device.
redeeman 10 hours ago [-]
how is it a different mental model? instead of opening the port in NAT via forward feature, you open the port in the firewall. it is in fact significantly simpler while overall being the same actions you take when you want to "forward"
DrewADesign 3 hours ago [-]
You’re right. That’s why everybody uses it and nobody is confused by it.
inigyou 3 hours ago [-]
Everyone whose ISP offers it uses it, yes.
redeeman 10 hours ago [-]
nobody suggests they should be, the ONLY difference is that the routers will block inbound connections by default, and you open your port in the firewall section instead of the shitty router instead of the nat/port forwarding
LocalH 22 hours ago [-]
NAT is good. It's CGNAT that's bad, because that's NAT imposed on subscribers, and not NAT that they control.
inigyou 10 hours ago [-]
NAT is bad. CGNAT is worse.
unethical_ban 1 days ago [-]
No network is "smaller" than /64. All end-networks are /64.
Split subnets at four bit chunks.
Allocated networks, like to a home or small office, should be /56 or /60.
Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination.
I have a rough draft of a beginner document but it's not ready. :)
zrail 1 days ago [-]
(Pedantically) Maximum prefix length of /64 is only required if you want/need SLAAC. If you're assigning static addresses or using DHCPv6 for assignment you can go as small as you want. It's not weird to see /127 for tunnel subnets, for example.
unethical_ban 1 days ago [-]
I didn't want to encourage non-standard behavior, but you are correct. Tunnels are a common use the same way /31s can be used in IPv4.
Going smaller than /64 is against best practice and unnecessary. People coming from IPv4 need to understand that trying to be careful with subnet sizing for purposes of preserving space is not a thing in IPv6 below /64. Maybe if a residential user has a /64 from their crappy ISP settings they'd need to do it, but not in a properly configured scenario and certainly not in enterprise.
inigyou 10 hours ago [-]
If you have a network full of static addressed servers, you can go as small as you want. For WiFi networks random devices may connect to, you should just let them pick their own address in a /64 with SLAAC. You may choose to also let servers use SLAAC if you want to, in addition to their static address.
inigyou 1 days ago [-]
How many /24s does your organisation have? With IPv6, one block is almost always sufficient.
ErroneousBosh 1 days ago [-]
It's mental that my fairly techy-orientated but otherwise pretty standard UK ISP provides me with a /48 as default.
So I have 1.2 million million million million IPv6 addresses available.
That ought to be enough, eh?
kemotep 5 hours ago [-]
Of course, we could hand all 8 billion people on the planet a thousand /48’s each and still have trillions and trillions to spare.
inigyou 3 hours ago [-]
Realistically, allocation is more complicated than that, and there are arguments that the current allocation scheme isn't futureproof enough. But if that happens, there's enough room to change it and still keep all existing allocations working.
ConceptJunkie 1 days ago [-]
The point of IPv6 was to make the addresses so long that we don't run out of them in 20 years or so.
There fixed that for you.
ralph84 1 days ago [-]
The problem is NAT solved the same problem more easily and cheaply. It was at the cost of making it difficult for every host to talk directly to every other host, but it turned out most of the people building networks didn't want that feature anyway.
inigyou 10 hours ago [-]
It's been a strong centralisation pressure on the internet. Centralisation is bad.
inigyou 1 days ago [-]
We already ran out of ipv4 about 15 years AGO.
64 bits would be enough to avoid run out, but hierarchical allocation would still be a problem. 128 bits is long enough for many levels of hierarchy. (And yes, you can subnet all the bits, not just the first 64)
vitally3643 1 days ago [-]
The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address.
It's not about low adoption, it's that there are unimaginably many IPv6 addresses.
...which is a major reason for why it has low adoption
Matuzy 1 days ago [-]
Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)
Respectfully I don't think they explained it well.
fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with RFC 1918.
There's even a website (sites?) to register your ULA space on a volunteer basis to reduce collision chances.
inigyou 1 days ago [-]
If you can't remember 192.168 you definitely can't remember a randomly picked ULA. So just use fd00. It's not any worse than 192.168.
unethical_ban 1 days ago [-]
True, I was thinking more about the allocation discussion than the "easy to remember".
Anyone in IT who allocates 1.1.1.0/24 because 192.168.0.0/24 is hard, should be allocated to trash pickup.
inigyou 10 hours ago [-]
also easy to remember is 10.anything.anything.anything
kowbell 1 days ago [-]
"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"
iso1631 1 days ago [-]
192.168.0.0/24 -> fd00:0::/64
192.168.1.0/24 -> fd00:1::/64
192.168.2.0/24 -> fd00:2::/64
192.168.240.0/24 -> fd00:240::/64
It's not a great idea, but its no harder.
No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem.
Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.
ianburrell 17 hours ago [-]
The proper way to do ULA is to generate random 40-bit ID. Then your ULA are likely unique. Which means that if you want to connect or merge with another company, the networks are distinct.
IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.
inigyou 10 hours ago [-]
If someone can't remember 192.168 they definitely can't remember their own chosen random 40 bits.
tracker1 1 days ago [-]
One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally.
I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.
tredre3 1 days ago [-]
> Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6.
SLAAC is the only way that works across all IPV6 devices. In that mode, the router advertises the prefix and the device assigns its own address (prefix + its mac address).
DHCPv6 exists but is poorly supported. It sucks for people who like assigning IPs individually from an authoritative place (through static dhcp entries on the router). But people like us are "doing it wrong", you see? We must accept that in this brave new worlds an IP means nothing.
tracker1 1 days ago [-]
Which doubly sucks in terms of assigning a DNS name to an IP/PC... and/or opening the assignment to less restricted access... feels just problematic to me.
Again, I don't know any of IPv6 enough to use it really right or wrong.
inigyou 3 hours ago [-]
If your ISP offers it, you should just try it. If not, do you have a website on a VPS or something? Try making that work with v6. It's really not a scary monster, it's mostly the same thing again but with long addresses, and a few convention changes that come with long addresses.
Examples of convention changes: end devices can each get several addresses for privacy and for being on multiple networks concurrently. SLAAC is stateless because addresses in a /64 are so endless there's no need to keep a central registry of which ones are already used. NAT is rare because it's no longer necessary, even though there is no internet police to stop you from using it (please try to avoid it). P2P is so much easier - applications can be written under the assumption connectivity is end-to-end with firewall hole punching.
inigyou 1 days ago [-]
And there's always static configuration, useful for servers.
inigyou 10 hours ago [-]
Home routers with IPv6 should have this enabled by default, at least by law in Europe, and you can turn it off or add exceptions.
SV_BubbleTime 1 days ago [-]
I doubt any endpoints are entirely ipv6.
So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow.
I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for.
No human said “hey, networking sucks. Please make it much harder at my level!!”.
inigyou 3 hours ago [-]
Public websites almost always still have ipv4 to serve ipv4-only users who make up half of the American business internet. But note that v6 connectivity is better than v4 in basically every other country and basically every mobile network (which is where most of the users are).
toast0 1 days ago [-]
> I doubt any endpoints are entirely ipv6.
Lte and 5G can be v6 only, usually they also have NAT64 and DNS64 so you can get everywhere, but the less stuff that needs v4, the smaller their nat boxes are.
tracker1 1 days ago [-]
I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct.
like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated.
To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.
inigyou 10 hours ago [-]
AFAIK this was one of several things that was tried, but failed for various reasons. It's called "TUBA" - TCP/UDP with Bigger Addresses - adding extra address bits at a layer above IP so that IP remains compatible.
I think one of the main problems with it is that you have to update the whole internet anyway, just like you do with IPv6, so you make the protocol stack stupider for no real benefit.
ianburrell 17 hours ago [-]
An alternate to IPv6 would have been to store the NAT addresses in IPv4 somehwere. But the IPv4 options are fragile and normal NAT would likely destroy them. It would still require rewriting all of the networking and software. It would have engrained NAT everywhere and made lots of routing problems, like is that your or mine 10. network.
pbhjpbhj 22 hours ago [-]
>limited to 10. and 102.168
I assume you meant 10.x.x.x and 192.168.x.x -- (and 172.16.x.x?), ie the standard subnets for home router-modems (which are non-routing and so can't be used on the internet).
inigyou 1 days ago [-]
you can use 1234 if you want, that's also unused space
Multicomp 1 days ago [-]
Agreed 100%! I know there's tough challenges to making this reality, but if https://serverspace.io/about/blog/ipv8-explained-what-we-kno... could be an IRL thing, I would buy company network equipment and use computer OSes that supported this draft standard.
It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits.
For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6.
IPv8 is more of a linux to unix than a plan 9.
inigyou 10 hours ago [-]
ipv8 is a "vibe coded" specification from someone who doesn't understand the problem at all. Just like ipv6, you can't use ipv8 without upgrading the whole internet. The internet is mostly ipv6 capable and not at all ipv8 capable so why do you want to throw away that progress and reset the clock?
It's also just a worse design, centralising a bunch of things and trying to authoritatively define what counts as "a network" on both sides of the communication, unlike v4 and v6 where you just have raw bits and can interpret them how you want. I mean ipv8 defines the internet as a bunch of networks and a network as a bunch of computers. And a network is something that has an ASN. Your computers would be on your ISP's big network, not your small home network because you can't have a network inside a network. It also decreases the number of bits than we already have (in ipv6), limiting futureproofing. It also says every network device will log in with OAuth. Yes, really.
ec109685 1 days ago [-]
Yeah I wanted to do that at previous company. Got talked out of it, but it's nice have all those ips available.
makr17 1 days ago [-]
I used to work somewhere that did that. Several of us in Eng pointed out that it was likely impossible to sell anything to DoD personnel since the reply would route internally. But I don't know if it was _fixed_, was still an issue when I left.
bflesch 1 days ago [-]
This will trip up most SOC workflows in funny ways, and I like it.
IPs having a global distinction between public/private is a convention, but local routing can widely differ.
Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.
192.0.0.0/24, 10/8, 172.16/12, and various other subslices of 192/8 are reserved for local use and are not publicly routable.
kotaKat 1 days ago [-]
there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs.
22.0.0.0/8 - it's basically free real estate!
walrus01 1 days ago [-]
the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?
xoa 1 days ago [-]
>the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?
Just to chime in agreeing with sibling comments, the issue is when it's not about just your house and you're deep into self-hosted stuff with a lot of different properties and businesses other people's houses all sharing resources. Without a lot of coordination and consideration, which in practice doesn't really happen easily given the adhoc nature such things tend to organically develop out of, and all the random stuff that wants specific addresses at least for setup, it actually gets pretty easy to run into collisions. Allocations typically are definitely inefficient in many respects but also made sense in the context they were first done and of course can be a certain amount of effort to change.
In an ideal world I sorta feel like "IPv6" should have been more along the lines of <12 octet prefix>:<IPv4>, everyone gets a prefix or set of prefixes that they actually own and are consistent worldwide, or at least only change when geographic location changes, and then can just have the entire 32-bit IPv4 space for LAN however they want. Then you only have to care about prefix between LANs and it could all be extremely automated, internally you only need to use something that looks like IPv4 with the network hardware transparently able to handle prefixes for WAN. Backwards compatibility story would be a lot more straight forward too. Oh well.
@kotaKat: that's a great idea and I don't know why I forgot I played with that like 15 years ago. Really handy as a backup space that almost certainly won't collide with any commercial hardware at least.
kotaKat 1 days ago [-]
i deal with a lot of nerds that are all interconnected with one another and nobody can agree on a common subnet for their houses when we all decide to exchange routes internally. ;)
myself248 1 days ago [-]
I deal with a lot of nerds, but starting in about 2008 we all segmented up the 10.x space and each of us has a /16, with each site we manage having typically a /24 or /22, so nobody overlaps. We can light up tunnels between each other and never have a collision. We have a little internal registry on a private wiki, and it's been serving us well for... oh dear, almost two decades now.
Crucially, we set aside the common 10.1 and 10.10 ranges as nonroutable, so any devices that default into those have to be dealt with before they can live on the wider network.
Newcomers get handed a block and have to renumber, or NAT into it, or whatever, but they cannot emit bogons. At a small scale (first-name basis), this works.
ErroneousBosh 1 days ago [-]
I work for a large organisation that has various blocks scattered around 10./8, some with highish values for the second octet and some with lowish values, so say 10.129.0.x/24 and 10.3.0.x/24 to pick just two out of a couple of thousand.
But one of our vendor networks uses 10.32.x.x/32 for various radio gateways, and the radios themselves all locally expose (this is where I give away too big a clue as to what I do) 10.0.0.101 as a management address that emits important link status data.
So you can imagine what a godawful bùrach everyone's routing tables are.
cryptonym 1 days ago [-]
I have seen ISP doing CGNAT on DOD IP space.
bityard 23 hours ago [-]
The CGNAT space (100.64.0.0/10) is also free real estate for container virtual/overlay networks when you don't want to (or can't, thanks to IT) use the RFC-1918 subnets.
webstrand 1 days ago [-]
I also do this, except 7.0.0.0/8 instead. Its great for not conflicting with hotel wifi dhcp.
walrus01 1 days ago [-]
> Note to self: never buy a Korean security product.
The Canadian Navy very recently made a major choice and agreed with you
The DoWD owns such a large chunk of the IP space, it can very easily be a coincidence
antonvs 19 hours ago [-]
That they used a public IP as an internal IP? That’s simply a mistake.
dev_l1x_be 1 days ago [-]
Or Korean IoT products. The ones I was working on had insane approach to security.
salvador-odil 15 hours ago [-]
can you elaborate on that approach?
RajT88 1 days ago [-]
As if domestic products aren't a hot mess of security issues and sloppy engineering. Lol
KPGv2 1 days ago [-]
> Department of War
n.b., it's the Department of Defense, just like the Kennedy Center doesn't have Trump's name attached, and the large body of water by Texas is the Gulf of Mexico.
BLKNSLVR 19 hours ago [-]
100% correct
DoW is a nickname if anything. I'm surprised Hegseth hasn't requested 'Secretary' get nick-named to something more masculine sounding.
lardosaurusrex 1 days ago [-]
just buy stuff you can put your own firmware/os on because it's either just the worst security in the world (aka anything not from china) or, well... china.
and while i currently don't hate china as much as i do US rn (because canadian; sorry) i can also say -- due to being an aforementioned leaflandian -- that due to very personal experience i have zero faith in anything from china that has the ability to connect to any type of network :')
And so yeah at this point if I can't at the very least get a whatever-wrt firmware (preferably a proper linux distro nowadays; not to say the *-wrt firmwares aren't a real OS but, y'know) on the device i just avoid them entirely since, well... it's all i can do at this point because even if there were baked in hardware-based backdoors i as an individual can't do much more than that.
prox 1 days ago [-]
That sounds horrible. I got an old PI4, would it make for a decent router, if at all possible?
myself248 1 days ago [-]
It's not quite ideal hardware due to only having a single NIC, but you can slap a USB NIC on it and make it work, if that's what's handy.
Old thin clients are typically in the same hardware class, and probably cheaper by the time you add the exploding MSRP of a Pi, and a PSU, and a case and heatsink, and maybe some storage that doesn't suck ass. But if you already own the Pi, yeah, go for it.
kingleopold 1 days ago [-]
Note to self: never buy any Korean hardware or software product.
/S
walrus01 1 days ago [-]
Note to self, never buy any hardware product, move to a yurt in the woods, start an alpaca ranch, write a manifesto
zrobotics 23 hours ago [-]
Oldie, bur relevant.
Tech enthusiasts: My entire house is smart.
Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don’t recognize
dev_l1x_be 1 days ago [-]
Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)
snoman 1 days ago [-]
As they say: in IoT the S stands for security.
1 days ago [-]
js4ever 1 days ago [-]
ID-IoT-S
folkrav 1 days ago [-]
There’s some irony to security not being a priority for security cameras. Different kind of security I know, but still.
daneel_w 1 days ago [-]
There's also some irony in people happily ignoring that so many of these products live-stream the inside view of their homes and offices to some foreign corporate cloud - and in the case of suspiciously many Chinese security cameras, a state-backed corporation's cloud. Because, wow, it really is convenient.
glitchcrab 24 hours ago [-]
Which is exactly why alll my cameras live in their own VLAN with no internet access, regardless of how trustworthy the company may be. Better safe than sorry and all that.
awakeasleep 1 days ago [-]
How can there be a baseline check when you operate by getting the most inexperienced cheapest person possible to do the work?
gxs 1 days ago [-]
Especially these days there’s really no excuse
Add a skill to your repo that does some basic checks at least, not that hard
tehlike 1 days ago [-]
A rule of thumb, put your cameras on a separate VLAN and never give that vlan internet access.
Least you can do.
RyJones 1 days ago [-]
When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.
You can curse the storm, but the wind will come.
netsharc 1 days ago [-]
how did "same MAC" lead to "access to everything"?
Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.
RyJones 1 days ago [-]
buy any dongle that sells for under $100 on amazon. they all have the same mac, and come with 'bespoke' apps to let you do things to your car. those apps are all thin wrappers on code widely shared; they use the MAC of the dongle as the keystone for ID.
Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.
Reminder: the Bluetooth logo comes, mostly, from self-certification.
andreareina 1 days ago [-]
Amazing! I have the same MAC address on my luggage!
walrus01 1 days ago [-]
I made things easier by setting the permission action link on all my nuclear weapons to zero
I bought 3 from 3 different vendors and they all have totally different Mac addresses.
Internally they're all Bluetooth to serial chips, and another pic16xxxx chip which does serial to canbus.
I guess the Bluetooth serial chips probably have programmable Mac addresses, but equally they normally ship with a globally default one unless you flash a different one onto it.
inigyou 1 days ago [-]
Why do the apps need auth?
1718627440 1 days ago [-]
How does this even work? A website doesn't know your MAC, that is only known in your local network.
1 days ago [-]
22 hours ago [-]
pak9rabid 1 days ago [-]
Perhaps they should just drop the 'security' from the name and simply call it a camera.
sodapopcan 1 days ago [-]
This blog's misuse of the external link icon irks me.
kyle-rb 1 days ago [-]
The CSS selector they used (`a[href*="://"]::after`) is meant to only target only external links, but assumes any internal links will be using relative paths like `href="/about"`. The problem is that this site uses absolute URLs (`href="https://hhh.hn/about"`) for its nav links, so every link ends up with an icon.
You could fix this by adding an exception to the CSS rule so it skips links starting with your site's name:
the same token copy-pasted into 30 files. not even a config file. they baked their github admin credentials into the firmware image like it was a version number.
IshKebab 1 days ago [-]
LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.
llm_nerd 1 days ago [-]
And it's worth considering that obfuscation only ever worked against casuals for whom tedious was a bridge too far. Nation state actors and criminal hacker groups, on the other hand, consider the tedious entirely worth it.
phh 1 days ago [-]
Yes, obfuscation was always a matter of cost: how much money do you need to break the protection? LLM just decreased that amount by a lot.
(Yes ok, RSA4096 is technically a matter of cost, you just need an infinite amount of money)
jaggederest 1 days ago [-]
The cool thing about cryptographic security is that it's an asymmetric amount of cost for both parties - to encode is cheap, to break is many orders of magnitude harder, unlike obfuscation where the difficulty is approximately symmetrical.
TeMPOraL 1 days ago [-]
All security is always a matter of cost. Clown theater starts once you lose track of it, and start doing security for security's sake.
RE obfuscation and nation states - nation states have finite budgets too, both in terms of resources and attention. They can crack any system at any time, but they can't afford to crack all of the systems all of the time.
inigyou 1 days ago [-]
Pirates checked Denuvo, once considered the king of DRM.
inigyou 3 hours ago [-]
cracked*
walrus01 1 days ago [-]
> consider the tedious entirely worth it.
Entirely without LLMs, I'm imagining an office of North Korean compsci graduates doing astonishingly tedious tasks, for whom an office job on a basic Linux computer and slightly better diet and nice apartment put them in the top 1-2% of living standard in the country.
p-e-w 1 days ago [-]
On the bright side, even a small local LLM can easily improve garbage code like that.
orbital-decay 1 days ago [-]
I'm 100% confident in hardware companies' ability to make infinitely incompetent software given infinitely smart agents. They do it because they don't care about software, not because they lack tools. No agent can turn them into software companies if they don't want it themselves.
Kim_Bruning 17 hours ago [-]
I generally run security cameras on a separate VLAN and use something like frigate or other floss dvr tool for them to talk to.
Never let a cheap networked security camera touch the actual internet. %-/
whalesalad 1 days ago [-]
I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.
Ecsta 1 days ago [-]
There's a lot of public keys that don't give you any special access, unless the dev is really bad.
Anyone who cares about security will be using App Attest or the Google store equivalent.
JTbane 1 days ago [-]
>Anyone who cares about security
I have something hilarious to tell you about IoT apps
tclancy 1 days ago [-]
A Venn diagram like a 6th grade boy's graffiti of boobs.
dhosek 1 days ago [-]
Just as a pedantic aside, people often use Venn diagram when they mean Euler diagram. A Venn diagram always has the overlapping circles and use shading or labeling describe the set relation. Euler diagrams let the circles describe the relation so two non intersecting sets in a Venn diagram might share the left circle green, the right blue and leave the intersection blank or grey. An Euler diagram will have two disjoint circles.
tclancy 22 hours ago [-]
A. I love a pedantic aside
B. I love that Euler is pronounced “oiler” which is North American slang for a drunk. I’ve been trying to find that constant my whole adult life.
sophacles 1 days ago [-]
The "S" in IoT stands for security!
yako21000 1 days ago [-]
That one made me giggle!
cute_boi 1 days ago [-]
Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.
CodesInChaos 1 days ago [-]
> Anyone who cares about security will be using App Attest or the Google store equivalent.
Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.
tehlike 1 days ago [-]
Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.
petepete 1 days ago [-]
I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage.
*almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**
It's not really something I want 'home rolled', I just want it to work.
Same goes for the boiler really. If it stops working I can phone Valliant and they'll send someone round to fix it.
zrobotics 23 hours ago [-]
Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access.
That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.
vhiremath4 19 hours ago [-]
What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.
dev_l1x_be 1 days ago [-]
In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.
fragmede 1 days ago [-]
@stake or L0pht?
inigyou 1 days ago [-]
Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.
tehlike 1 days ago [-]
Or claude/codex can.
fragmede 1 days ago [-]
Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.
avgDev 1 days ago [-]
It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.
inisirex 1 days ago [-]
[flagged]
salvador-odil 14 hours ago [-]
what a good blog to read. Have you found answer on why they use the same token across these bunch of files? Maybe they are tying to adopt the agentic code writing?
One interesting questions, what does that gh token give access to? It is only read from private repo, is not it? You said "admin" privileges earlier.
jwithington 1 days ago [-]
I've seen these systems at US defense industry tradeshows so I'm guessing they are in use somewhere.
hluska 6 hours ago [-]
It’s kind of interesting - I imported security cameras for a business roughly twenty hours ago. The security problems at the time were unbelievable to a point that any kind of wireless, IP or any type of service offering remote view was really scary. It was always stupid stuff - little oversights, things that were hard coded and shouldn’t have been or extremely old versions of insecure software running critical functions.
Apparently, nothing has changed in two decades.
OrangeMusic 13 hours ago [-]
Sorry to be that guy but if you can't even bother to capitalize your sentences then I won't bother to read your blog.
Ovah 11 hours ago [-]
At least it's written by a human and not AI slop.
limsungkee 1 days ago [-]
This kind of open source expands the world.
dare944 1 days ago [-]
> Why would Hanwha Vision need anything remotely related to the DoD? Is it possible that their CI is provided by some centralized team at their parent company Hanwha, where the needs of their sister company Hanwha Aerospace cause the shared platform to have these entries in the CI environment variables? Or maybe because of their other sister company, Hanwha Defense USA, where they make other large scary steel machines
Or... the Department of Warmongers (nee DoD) addresses on the device are evidence of a supply-side attack targeting the DoW and carried out using the aforementioned github admin token.
... I mean, while we're in here speculating about truffles and all.
asveikau 1 days ago [-]
My cameras are analog rather than PoE or IP based, but that's just because I set up the initial iteration of the system a long time ago. The standard now is to give your camera an IP address.
With many IoT type things I block access to the public internet. I think with cameras specifically a lot of people even set it up physically on a different network that can only talk to the NVR.
But tldr, basing the cameras on IP invites some of the things in this article. Anyone deploying these devices needs to think about securing them.
kiddico 1 days ago [-]
I have yet to find a pattern for when the author chooses to capitalize things.
bryanrasmussen 1 days ago [-]
it's not a bug, it's a freebie!
ButlerianJihad 19 hours ago [-]
Back in the mid-1990s, I was working at an ISP and also at a consulting firm. The consulting firm's #1 business at the time was to get businesses connected to the Internet, where these businesses already had significant LAN buildouts.
Now these were the days before IANA had officially assigned those "Private IP Network" numbers. Nobody had any private IPv4 space to work with! So the choices consisted of: make up some numbers and hope they don't conflict, or go ahead and register your IPv4 space and get public netblocks assigned, even if you're just using them privately.
So, needless to say, we encountered some bonkers configurations, and a lot of our job was undoing some really awful configurations in order to make them compliant with actual Internet connectivity, and so that different office LANs would interoperate properly.
We were also big advocates of security, firewalls, and the venerable "DMZ/Bastion" setups from back in the day, so those Private IP Network assignments would've been really useful, along with NAT, but we simply didn't have those tools at our disposal, and our clients were basically registering huge IPv4 blocks that they really didn't need to ever use.
hexxt-git 1 days ago [-]
true open source!
1 days ago [-]
1 days ago [-]
qweqwe14 1 days ago [-]
Why would you write like that? Not capitalizing the first word of a sentence makes the whole thing less readable. So that you can feel special? Really?
explorigin 1 days ago [-]
Who hurt you? It's his own blog. Let him write the way he wants.
gatekeephqpro 5 hours ago [-]
[flagged]
6 hours ago [-]
julian-vix 5 hours ago [-]
[dead]
tonyx1998 11 hours ago [-]
[flagged]
David_runai 1 days ago [-]
[flagged]
joka88xj 1 days ago [-]
[flagged]
hassanfree 8 hours ago [-]
[flagged]
4 hours ago [-]
hnscum 1 days ago [-]
[dead]
that_guy_iain 1 days ago [-]
I bet someone returned that security camera.
mikey_p 1 days ago [-]
No, if you read the article the author was downloading firmware from their website and still found the token.
aizk 1 days ago [-]
Department of War IP address? I feel this should be making headlines!
CodesInChaos 1 days ago [-]
Abusing IP ranges which were assigned to an organization but aren't actually used on the public Internet as private addresses is pretty common. Sure, it's bad practice, but not a big deal.
TeMPOraL 1 days ago [-]
Of course this looks entirely different when your corporate superstructure has a long and active history of developing military equipment.
caruasdo 1 days ago [-]
I know you're a mastermind when it comes to security, but you should provide more context about the tools and methods you're using in your article so we can better understand what it's all about and not have to Google every single step you're taking.
dust-jacket 1 days ago [-]
Oh I thought exactly the opposite!
I feel like every security blog (or even just tech blog) I've read recently has had paragraphs and paragraphs of largely LLM generated explainer waffle. This felt refreshingly focused and to the point.
hhh 1 days ago [-]
i’m not a mastermind, and I agree it could be more accessible. I treat this blog as somewhere to just dump my thoughts as unfiltered as I can while still being useful or entertaining, maybe for some other posts I will go more into depth
sophacles 1 days ago [-]
Seemed perfectly reasonable to me. Not everything has to be written for a target audience that includes you, besides you were able to look up what you needed it seems. Another tactic is to feed the article to your favorite LLM and interrogate it about what you don't understand.
Rendered at 21:06:44 GMT+0000 (Coordinated Universal Time) with Vercel.
I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced.
edit: seems there are some options now (or I missed them before), e.g. https://www.goodcam.io/#for-independent-developers
There are tons of ONVIF-compliant and cheap PoE cameras, and with this setup you really don't care about the security of the manufacturer firmware since you aren't exposing them to the network publicly. However, you do need to be extra diligent when configuring your VLAN/network segmentation.
e.g. https://github.com/themactep/thingino-firmware/issues/640
Some cameras do support thingino, so you can override their firmware. Then there's this: https://openipc.org/supported-hardware/featured
> Stránka nenalezena
> There's been a glitch...
> We're not quite sure what went wrong. You can go back, or try looking on our homepage.
For a while, I thought about building a network of surveillance cameras around the interior of my home. The Raspberry Pi seemed like a tempting platform to hook up a bunch of cameras to it. Sadly, I could not find a backend surveillance app or system that was suitable for running such a network. The best one I found was some kind of modular Linux app that was for-pay, and actually seemed based in Russia or something, and personally I wasn't comfortable about handing over my domestic surveillance needs to Russia!
I also considered exterior sensors, such as a camera, or perhaps a nice little weather station, outside on my balcony, running on the little Raspberry Pi.
Then I recalled two things: I live in the Sonoran Desert, where the desert highs can go up around 115℉, and any plant on my balcony was guaranteed to wither and die, not to mention the blowing dust and thunderstorms we have.
I determined that there was basically no way to house or protect a Raspberry Pi, as well as supply it with connectivity and electric power, and keep it outside on the balcony in conditions where I'd benefit from those active sensors. Sad but true!
There are non-IP cameras and coax interfaces, which would expose a USB video device on any Linux system, RPi included.
Plenty of software to handle that, though don't know what's the state of the art.
This is categorically, not true, I'm afraid. Reaching into domestic networks, where you can find influential people through mass harvesting, is an actively exploited technique by the spy agencies of our world.
How do you find the gardener of someone influential? You target all gardeners.
We are also not talking about a potential Russian product that will reach into large number of homes since — being paid and privacy focused — it is already a niche product. So getting into someone's home of interest would need a lot of luck, and there are probably better ways to do it.
Unfortunately, that isn't exactly true. Sure, they don't have any usage for your porch camera and its data, but the fact that it is hooked up to an IP classified as "US residential" or "US small-business" is the valuable thing. DDoS nodes, "residential IP proxy" malware or running botnet campaigns all benefit from a high bandwidth connection that is 99% not getting flagged in any list.
However, that is mostly about trusting or not trusting someone's business. Eg. DJI drones and action cams and gimbals are omnipresent, and they have the potential to do the same when it comes to China.
But they also have plenty to gain from building a great product and selling it and not reselling your IP addresses.
https://pine64.org/devices/pinecube/
https://pine64.org/devices/pinecube/
You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.
On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.
Also, just in case this comment isn't pedantic enough, 10.22 would be a firearm range, not an ammo range. And AFAIK they only ever chambered that for .22 rimfire cartridges. ;)
Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.
https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-...
Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire multiple public IPv4 addresses via DHCP.
Sounds like they blocked Cloudflare but couldn't block Google
If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.
I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.
The point of IPv6 was to make the addresses so long they are easy to manage.
lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.
Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.
So yeah, having to relearn a bunch of basic network knowledge that worked just fine for decades is a PITA, and I’m 100% positive a design process that focused more on the people that need to configure networks could have yielded a much friendlier, and therefore a much easier to adopt standard.
Suppose I've got a machine on the LAN and I want to open it up to the world on port 1025 with IPv6.
This can't happen with SLAAC? It has to be a new address? Does the ISP pick the prefix for that address? And one can't centrally-manage that address (because people keep saying that DHCPv6 isn't worth stuffing around with)? What happens when the router fails over to a backup ISP? How does dynamic DNS fit in with all of this?
Those questions don't really exist with IPv4, wherein: One can just set up a static DHCP assignment, forward port 1025, and [optionally] set up dynamic DNS -- and this all happens within the confines of a single home router.
Things would be nicer if NAT66 were used by default for home users though so the question of prefixes would disappear, and it'd perhaps match the "more advanced" home user ipv4 mental model. You'd just use e.g. fd00::2 as your server address.
its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?
There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?
And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.
Split subnets at four bit chunks.
Allocated networks, like to a home or small office, should be /56 or /60.
Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination.
I have a rough draft of a beginner document but it's not ready. :)
Going smaller than /64 is against best practice and unnecessary. People coming from IPv4 need to understand that trying to be careful with subnet sizing for purposes of preserving space is not a thing in IPv6 below /64. Maybe if a residential user has a /64 from their crappy ISP settings they'd need to do it, but not in a properly configured scenario and certainly not in enterprise.
So I have 1.2 million million million million IPv6 addresses available.
That ought to be enough, eh?
There fixed that for you.
64 bits would be enough to avoid run out, but hierarchical allocation would still be a problem. 128 bits is long enough for many levels of hierarchy. (And yes, you can subnet all the bits, not just the first 64)
It's not about low adoption, it's that there are unimaginably many IPv6 addresses.
...which is a major reason for why it has low adoption
fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with RFC 1918.
There's even a website (sites?) to register your ULA space on a volunteer basis to reduce collision chances.
Anyone in IT who allocates 1.1.1.0/24 because 192.168.0.0/24 is hard, should be allocated to trash pickup.
192.168.1.0/24 -> fd00:1::/64
192.168.2.0/24 -> fd00:2::/64
192.168.240.0/24 -> fd00:240::/64
It's not a great idea, but its no harder.
No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem.
Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.
IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.
I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.
SLAAC is the only way that works across all IPV6 devices. In that mode, the router advertises the prefix and the device assigns its own address (prefix + its mac address).
DHCPv6 exists but is poorly supported. It sucks for people who like assigning IPs individually from an authoritative place (through static dhcp entries on the router). But people like us are "doing it wrong", you see? We must accept that in this brave new worlds an IP means nothing.
Again, I don't know any of IPv6 enough to use it really right or wrong.
Examples of convention changes: end devices can each get several addresses for privacy and for being on multiple networks concurrently. SLAAC is stateless because addresses in a /64 are so endless there's no need to keep a central registry of which ones are already used. NAT is rare because it's no longer necessary, even though there is no internet police to stop you from using it (please try to avoid it). P2P is so much easier - applications can be written under the assumption connectivity is end-to-end with firewall hole punching.
So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow.
I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for.
No human said “hey, networking sucks. Please make it much harder at my level!!”.
Lte and 5G can be v6 only, usually they also have NAT64 and DNS64 so you can get everywhere, but the less stuff that needs v4, the smaller their nat boxes are.
like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated.
To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.
I think one of the main problems with it is that you have to update the whole internet anyway, just like you do with IPv6, so you make the protocol stack stupider for no real benefit.
I assume you meant 10.x.x.x and 192.168.x.x -- (and 172.16.x.x?), ie the standard subnets for home router-modems (which are non-routing and so can't be used on the internet).
It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits.
For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6.
IPv8 is more of a linux to unix than a plan 9.
It's also just a worse design, centralising a bunch of things and trying to authoritatively define what counts as "a network" on both sides of the communication, unlike v4 and v6 where you just have raw bits and can interpret them how you want. I mean ipv8 defines the internet as a bunch of networks and a network as a bunch of computers. And a network is something that has an ASN. Your computers would be on your ISP's big network, not your small home network because you can't have a network inside a network. It also decreases the number of bits than we already have (in ipv6), limiting futureproofing. It also says every network device will log in with OAuth. Yes, really.
IPs having a global distinction between public/private is a convention, but local routing can widely differ.
Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.
192.0.0.0/24, 10/8, 172.16/12, and various other subslices of 192/8 are reserved for local use and are not publicly routable.
22.0.0.0/8 - it's basically free real estate!
Just to chime in agreeing with sibling comments, the issue is when it's not about just your house and you're deep into self-hosted stuff with a lot of different properties and businesses other people's houses all sharing resources. Without a lot of coordination and consideration, which in practice doesn't really happen easily given the adhoc nature such things tend to organically develop out of, and all the random stuff that wants specific addresses at least for setup, it actually gets pretty easy to run into collisions. Allocations typically are definitely inefficient in many respects but also made sense in the context they were first done and of course can be a certain amount of effort to change.
In an ideal world I sorta feel like "IPv6" should have been more along the lines of <12 octet prefix>:<IPv4>, everyone gets a prefix or set of prefixes that they actually own and are consistent worldwide, or at least only change when geographic location changes, and then can just have the entire 32-bit IPv4 space for LAN however they want. Then you only have to care about prefix between LANs and it could all be extremely automated, internally you only need to use something that looks like IPv4 with the network hardware transparently able to handle prefixes for WAN. Backwards compatibility story would be a lot more straight forward too. Oh well.
@kotaKat: that's a great idea and I don't know why I forgot I played with that like 15 years ago. Really handy as a backup space that almost certainly won't collide with any commercial hardware at least.
Crucially, we set aside the common 10.1 and 10.10 ranges as nonroutable, so any devices that default into those have to be dealt with before they can live on the wider network.
Newcomers get handed a block and have to renumber, or NAT into it, or whatever, but they cannot emit bogons. At a small scale (first-name basis), this works.
But one of our vendor networks uses 10.32.x.x/32 for various radio gateways, and the radios themselves all locally expose (this is where I give away too big a clue as to what I do) 10.0.0.101 as a management address that emits important link status data.
So you can imagine what a godawful bùrach everyone's routing tables are.
The Canadian Navy very recently made a major choice and agreed with you
https://www.google.com/search?client=firefox-b-d&q=hanwha+oc...
n.b., it's the Department of Defense, just like the Kennedy Center doesn't have Trump's name attached, and the large body of water by Texas is the Gulf of Mexico.
DoW is a nickname if anything. I'm surprised Hegseth hasn't requested 'Secretary' get nick-named to something more masculine sounding.
and while i currently don't hate china as much as i do US rn (because canadian; sorry) i can also say -- due to being an aforementioned leaflandian -- that due to very personal experience i have zero faith in anything from china that has the ability to connect to any type of network :')
And so yeah at this point if I can't at the very least get a whatever-wrt firmware (preferably a proper linux distro nowadays; not to say the *-wrt firmwares aren't a real OS but, y'know) on the device i just avoid them entirely since, well... it's all i can do at this point because even if there were baked in hardware-based backdoors i as an individual can't do much more than that.
Old thin clients are typically in the same hardware class, and probably cheaper by the time you add the exploding MSRP of a Pi, and a PSU, and a case and heatsink, and maybe some storage that doesn't suck ass. But if you already own the Pi, yeah, go for it.
/S
Tech enthusiasts: My entire house is smart.
Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don’t recognize
Add a skill to your repo that does some basic checks at least, not that hard
Least you can do.
You can curse the storm, but the wind will come.
Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.
Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.
Reminder: the Bluetooth logo comes, mostly, from self-certification.
https://www.google.com/search?client=firefox-b-d&q=permissio...
Internally they're all Bluetooth to serial chips, and another pic16xxxx chip which does serial to canbus.
I guess the Bluetooth serial chips probably have programmable Mac addresses, but equally they normally ship with a globally default one unless you flash a different one onto it.
You could fix this by adding an exception to the CSS rule so it skips links starting with your site's name:
(Yes ok, RSA4096 is technically a matter of cost, you just need an infinite amount of money)
RE obfuscation and nation states - nation states have finite budgets too, both in terms of resources and attention. They can crack any system at any time, but they can't afford to crack all of the systems all of the time.
Entirely without LLMs, I'm imagining an office of North Korean compsci graduates doing astonishingly tedious tasks, for whom an office job on a basic Linux computer and slightly better diet and nice apartment put them in the top 1-2% of living standard in the country.
Never let a cheap networked security camera touch the actual internet. %-/
Anyone who cares about security will be using App Attest or the Google store equivalent.
I have something hilarious to tell you about IoT apps
B. I love that Euler is pronounced “oiler” which is North American slang for a drunk. I’ve been trying to find that constant my whole adult life.
Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.
*almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**
Vailant boiler - I wonder if there's a debug interface you can use. Not knowing specifics of your model, i foudn this: https://github.com/jayme-github/esphome_vaillant
Codex can help probably further heh.
https://yalehome.co.uk/yale-sync-hub
It's not really something I want 'home rolled', I just want it to work.
Same goes for the boiler really. If it stops working I can phone Valliant and they'll send someone round to fix it.
That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.
Apparently, nothing has changed in two decades.
Or... the Department of Warmongers (nee DoD) addresses on the device are evidence of a supply-side attack targeting the DoW and carried out using the aforementioned github admin token.
... I mean, while we're in here speculating about truffles and all.
With many IoT type things I block access to the public internet. I think with cameras specifically a lot of people even set it up physically on a different network that can only talk to the NVR.
But tldr, basing the cameras on IP invites some of the things in this article. Anyone deploying these devices needs to think about securing them.
Now these were the days before IANA had officially assigned those "Private IP Network" numbers. Nobody had any private IPv4 space to work with! So the choices consisted of: make up some numbers and hope they don't conflict, or go ahead and register your IPv4 space and get public netblocks assigned, even if you're just using them privately.
So, needless to say, we encountered some bonkers configurations, and a lot of our job was undoing some really awful configurations in order to make them compliant with actual Internet connectivity, and so that different office LANs would interoperate properly.
We were also big advocates of security, firewalls, and the venerable "DMZ/Bastion" setups from back in the day, so those Private IP Network assignments would've been really useful, along with NAT, but we simply didn't have those tools at our disposal, and our clients were basically registering huge IPv4 blocks that they really didn't need to ever use.
I feel like every security blog (or even just tech blog) I've read recently has had paragraphs and paragraphs of largely LLM generated explainer waffle. This felt refreshingly focused and to the point.