5 ms·

Device.farm Generates Linux+Docker Images for about 100 Arm Linux SBCs

58 points by burgrp 6y ago

ex3ndr 6y ago
I really hope some of such images are providing some user-friendly in field WiFi setup just like any smart home devices.
- LargoLasskhyfv 6y ago
  Can't speak for Raspian, but Armbian has https://docs.armbian.com/User-Guide_Armbian-Config/#network https://docs.armbian.com/User-Guide_Armbian-Config/#network Simple enough?
  - dividuum 6y ago
    I think that's not what op meant: If I understand your link correctly, that's a tool to help connect to various networks if you have a shell on the device. If you don't, that won't help. What you need in that case is that the device itself opens up a temporary access point that you can use to configure the device.
  - ex3ndr 6y ago
    99% of time i want to be able to connect device anywhere. For example, give it to customer, friend, family to check out. It is to much hustle to hardcode this to a device while i literally just want to be able to configure this on first run.
- hibbelig 6y ago
  The article says you enter the credentials and then the site generates an image that can connect to that WiFi.
  - draugadrotten 6y ago
    So these guys will have IP addresses, wifi network credentials and root passwords for all devices using their services. The site will provide you with a root password for your embedded device, and you will provide the site with the wifi network and credentials needed to access the network where the device is. That doesn't sound like good security practice.
    - asveikau 6y ago
      So... What is with this trend of making a web service out of something that ought to be a shell script? Reminds me of yesterday's hn post about making your PDFs look scanned by... Uploading to a web server that runs a ghostscript command. It's almost as if locally running software is deeply confusing to people and the perception is that you need to have a potentially privacy violating service if you have a friendly ui. Not to mention all the energy wasted running those servers. Is this how bad our society has gotten at writing software?
      - mappu 6y ago
        In 2020, most people's only device is a cellphone. They can't easily run ghostscript directly, and making a web service is easier than making an app (recompiling ghostscript for all CPU architectures, ...) despite the ongoing hosting costs.
        asveikau 6y ago
        Not just hosting costs. Energy costs. Destruction to our planet. That is also in addition to sending your documents to who knows who. You can probably compile ghostscript to javascript via emscripten or similar. I am not sure what this means for its AGPL license. But maybe this is more a discussion for that other thread.
        yjftsjthsd-h 6y ago
        > You can probably compile ghostscript to javascript via emscripten or similar. I am not sure what this means for its AGPL license. Shouldn't be any "worse" than running it server-side, since AGPL exists in order to apply to SaaS.
heavyset_go 6y ago
Is this tunneling traffic from devices to Device.farm's servers? That's what it looks like is happening here[1]. This is the message on both the ToS and Privacy Policy pages: > TO BE DONE... [1] https://www.cnx-software.com/wp-content/uploads/2020/05/device.farm-docker-running.jpg https://www.cnx-software.com/wp-content/uploads/2020/05/devi...
- burgrp 6y ago
  Yes, there is VPN tunel from the device to device.farm servers. It is openconnect VPN. device.farm server then acts as a reverse proxy. User needs to authenticate in order to access the device's service. We are sorry, there is no ToS and Privacy Policy available yet, it should appear in following days.
  - heavyset_go 6y ago
    Before I'd use something like this, I'd like to see a privacy policy and at least a simplified topology of the networking, where and if encryption is terminated, what information is sent or stored, etc. Looks cool, though! Are you running a standardized kernel for the images, or are the kernel builds board specific and thus different versions?
    - burgrp 6y ago
      I can understand your concern if there is no privacy policy nor documentation and whole thing seems like a black box. To be honest, the post on CNX-SOFTWARE was published a bit faster than we expected so we are catching a running train now :) Anyway, PP, ToS and documentation is the priority now. We would like to be as transparent as possible, most likely the whole solution will be open source in future. To your question about kernels: to simplify it for now, we are just modifying standard Armbian and Raspbian images available on their websites. Complete build process on our side is something we are considering to implement.
  - yjftsjthsd-h 6y ago
    > openconnect Any special reason? The main advantage that I would expect over ex. Wireguard is maybe better (pre-existing) authentication integration but I'd be curious about your reasons.
forty 6y ago
I discovered https://github.com/solo-io/packer-builder-arm-image https://github.com/solo-io/packer-builder-arm-image recently. The doc mention RPi/raspbian a lot but it works well for armbian on other devices for example. I use it to build images for my SBCs with ansible packer provisioner. Pretty cool.
throwaway49872 6y ago
And you are supposed to trust images not to have vulnerabilities?
olabyne 6y ago
I made a small script a few month ago, for anyone who wants to understand how generate a compact Raspbian image : https://github.com/Blafy/raspbian-build https://github.com/Blafy/raspbian-build It's a ~50Mb image, compatible for Raspi 1 to 4 !
- burgrp 6y ago
  Nice!
pjmartorell 6y ago
There is no warranty that these img files do not contain malware or vulnerabilities. Why the Dockerfiles are not public?
- burgrp 6y ago
  Which Dockerfiles do you mean, please? There are only Linux images. Dockerfiles are then prepared by owners of devices.

58 points by burgrp 6y ago

I really hope some of such images are providing some user-friendly in field WiFi setup just like any smart home devices.

LargoLasskhyfv 6y ago
Can't speak for Raspian, but Armbian has https://docs.armbian.com/User-Guide_Armbian-Config/#network https://docs.armbian.com/User-Guide_Armbian-Config/#network Simple enough?
- dividuum 6y ago
  I think that's not what op meant: If I understand your link correctly, that's a tool to help connect to various networks if you have a shell on the device. If you don't, that won't help. What you need in that case is that the device itself opens up a temporary access point that you can use to configure the device.
- ex3ndr 6y ago
  99% of time i want to be able to connect device anywhere. For example, give it to customer, friend, family to check out. It is to much hustle to hardcode this to a device while i literally just want to be able to configure this on first run.
hibbelig 6y ago
The article says you enter the credentials and then the site generates an image that can connect to that WiFi.
- draugadrotten 6y ago
  So these guys will have IP addresses, wifi network credentials and root passwords for all devices using their services. The site will provide you with a root password for your embedded device, and you will provide the site with the wifi network and credentials needed to access the network where the device is. That doesn't sound like good security practice.
  - asveikau 6y ago
    So... What is with this trend of making a web service out of something that ought to be a shell script? Reminds me of yesterday's hn post about making your PDFs look scanned by... Uploading to a web server that runs a ghostscript command. It's almost as if locally running software is deeply confusing to people and the perception is that you need to have a potentially privacy violating service if you have a friendly ui. Not to mention all the energy wasted running those servers. Is this how bad our society has gotten at writing software?
    - mappu 6y ago
      In 2020, most people's only device is a cellphone. They can't easily run ghostscript directly, and making a web service is easier than making an app (recompiling ghostscript for all CPU architectures, ...) despite the ongoing hosting costs.
      - asveikau 6y ago
        Not just hosting costs. Energy costs. Destruction to our planet. That is also in addition to sending your documents to who knows who. You can probably compile ghostscript to javascript via emscripten or similar. I am not sure what this means for its AGPL license. But maybe this is more a discussion for that other thread.
        yjftsjthsd-h 6y ago
        > You can probably compile ghostscript to javascript via emscripten or similar. I am not sure what this means for its AGPL license. Shouldn't be any "worse" than running it server-side, since AGPL exists in order to apply to SaaS.

heavyset_go 6y ago

Is this tunneling traffic from devices to Device.farm's servers? That's what it looks like is happening here[1]. This is the message on both the ToS and Privacy Policy pages: > TO BE DONE... [1] https://www.cnx-software.com/wp-content/uploads/2020/05/device.farm-docker-running.jpg https://www.cnx-software.com/wp-content/uploads/2020/05/devi...

burgrp 6y ago
Yes, there is VPN tunel from the device to device.farm servers. It is openconnect VPN. device.farm server then acts as a reverse proxy. User needs to authenticate in order to access the device's service. We are sorry, there is no ToS and Privacy Policy available yet, it should appear in following days.
- heavyset_go 6y ago
  Before I'd use something like this, I'd like to see a privacy policy and at least a simplified topology of the networking, where and if encryption is terminated, what information is sent or stored, etc. Looks cool, though! Are you running a standardized kernel for the images, or are the kernel builds board specific and thus different versions?
  - burgrp 6y ago
    I can understand your concern if there is no privacy policy nor documentation and whole thing seems like a black box. To be honest, the post on CNX-SOFTWARE was published a bit faster than we expected so we are catching a running train now :) Anyway, PP, ToS and documentation is the priority now. We would like to be as transparent as possible, most likely the whole solution will be open source in future. To your question about kernels: to simplify it for now, we are just modifying standard Armbian and Raspbian images available on their websites. Complete build process on our side is something we are considering to implement.
- yjftsjthsd-h 6y ago
  > openconnect Any special reason? The main advantage that I would expect over ex. Wireguard is maybe better (pre-existing) authentication integration but I'd be curious about your reasons.

forty 6y ago

I discovered https://github.com/solo-io/packer-builder-arm-image https://github.com/solo-io/packer-builder-arm-image recently. The doc mention RPi/raspbian a lot but it works well for armbian on other devices for example. I use it to build images for my SBCs with ansible packer provisioner. Pretty cool.

throwaway49872 6y ago

And you are supposed to trust images not to have vulnerabilities?

olabyne 6y ago

I made a small script a few month ago, for anyone who wants to understand how generate a compact Raspbian image : https://github.com/Blafy/raspbian-build https://github.com/Blafy/raspbian-build It's a ~50Mb image, compatible for Raspi 1 to 4 !

burgrp 6y ago
Nice!

pjmartorell 6y ago

There is no warranty that these img files do not contain malware or vulnerabilities. Why the Dockerfiles are not public?

burgrp 6y ago
Which Dockerfiles do you mean, please? There are only Linux images. Dockerfiles are then prepared by owners of devices.