5 ms·

Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?

by tym0 10y ago

Declanomous 10y ago
You could say that about almost every internet connected device. I know more than one "tech-savvy" individual who has disabled their firewall "temporarily" to get something working, and then never re-enabled it, or dropped a device in the DMZ, etc.
krylon 10y ago
If you have a Pi (or several) on a private network, say, behind a NAT router, there should be no problem either way. I guess a sufficient number of people have put Pis on the Internet, or the recent wave of IoT-DDOS attacks has spooked the Raspberry people sufficiently to make this change.
- alexellisuk 10y ago
  It feels like a pre-emptive precaution.. I'm sure most people running a Pi at home have no way for their SSHD port to be exposed and if they do set up NAT port forwarding they should look into how to make that more secure.
digitalsushi 10y ago
I think this change isn't really so much to improve security, as to shift the blame from them, to the owner. And I think I'd do the same thing if I were them. Edit: we should remember IPv6 is becoming a real thing, too. If I scan my web logs, see a pi in there, with v6, I might just try to ssh into it as the pi:raspberry user. Maybe I dont even need to decide it's a pi, just try it anyways.
shuntress 10y ago
I don't think this is over- or under- kill. This is the correct amount of kill and done earlier than it needs to be. This is a move that is always wished for in hindsight after something bad happens. In an alternate universe where they don't make this change and raspberry pis are included in a massive attack because of their intentionally well-known default root account is listening on a running-by-default sshd, everyone would be screaming about the raspi foundations rampant incompetence. The only place this will sting is in un-maintained 'how to set up your new raspberry pi's SD card' tutorials. I believe that most users who want to set up a headless pi can handle this change with no problem.
frio 10y ago
Sure, but in the age of IoT, you probably shouldn't consider your local network safe :). If your IoT lightbulb, toaster or television has UPnP-ed itself and been compromised, it may be quietly nmapping away to discover other easily exploitable widgets.

Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?

by tym0 10y ago

Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?

You could say that about almost every internet connected device. I know more than one "tech-savvy" individual who has disabled their firewall "temporarily" to get something working, and then never re-enabled it, or dropped a device in the DMZ, etc.

krylon 10y ago

If you have a Pi (or several) on a private network, say, behind a NAT router, there should be no problem either way. I guess a sufficient number of people have put Pis on the Internet, or the recent wave of IoT-DDOS attacks has spooked the Raspberry people sufficiently to make this change.

alexellisuk 10y ago
It feels like a pre-emptive precaution.. I'm sure most people running a Pi at home have no way for their SSHD port to be exposed and if they do set up NAT port forwarding they should look into how to make that more secure.

digitalsushi 10y ago

I think this change isn't really so much to improve security, as to shift the blame from them, to the owner. And I think I'd do the same thing if I were them. Edit: we should remember IPv6 is becoming a real thing, too. If I scan my web logs, see a pi in there, with v6, I might just try to ssh into it as the pi:raspberry user. Maybe I dont even need to decide it's a pi, just try it anyways.

shuntress 10y ago

I don't think this is over- or under- kill. This is the correct amount of kill and done earlier than it needs to be. This is a move that is always wished for in hindsight after something bad happens. In an alternate universe where they don't make this change and raspberry pis are included in a massive attack because of their intentionally well-known default root account is listening on a running-by-default sshd, everyone would be screaming about the raspi foundations rampant incompetence. The only place this will sting is in un-maintained 'how to set up your new raspberry pi's SD card' tutorials. I believe that most users who want to set up a headless pi can handle this change with no problem.

frio 10y ago

Sure, but in the age of IoT, you probably shouldn't consider your local network safe :). If your IoT lightbulb, toaster or television has UPnP-ed itself and been compromised, it may be quietly nmapping away to discover other easily exploitable widgets.