3 ms·

Some of my hard requirements for a media device are that it must not share any of my personal information with any third party and it must fully cache the full-

Some of my hard requirements for a media device are that it must not share any of my personal information with any third party and it must fully cache the full-resolution and complete media content prior to beginning playback. If it's going to be connected to the Internet it must receive regular security updates for anything that's not written in a memory- and type-safe language like Go or Rust. While Go and Rust aren't necessarily magic pixie-dust that can account for all types of security vulnerabilities, if I'm going to be faced with the possibility of some project being abandoned at some point for the next new shiny thing that everyone would rather work on, I'd at least like to give it a fighting chance of remaining secure for some time after abandonment without any updates. Ideally it would be a Rust userspace media management package running on Debian Stable getting unattended upgrades every night. Since nothing like that exists I've recently decided to give CoreELEC/Kodi a try on an ODROID-N2+, albeit disconnected from any network. I was surprised at how seamless and integrated everything was. The remote control for my television "just worked" with it out of the box thanks to HDMI CEC support. Arrow buttons, play/pause, back, etc. all did just what I expected them to do. It's a marked improvement from the last time I built a custom media box, which I had running MythTV on Gentoo, when I needed to jump through hoops to set up an IR blaster. And you can't argue with a 12v/2a power supply. For now I'm keeping it off my home network and am "sneaker-netting" content on a USB drive between my trusted devices and the ODROID. When I get tired of doing that I might add some firewall rules to my router to only allow it to talk to a locked-down VM doing nothing but hosting a read-only file share. But some day I hope to look forward to building a similar form-factor box that has all the media gadgets and gizmos with a Rust userspace that respects my privacy and auto-updated Debian Stable so I can actually connect it to the Internet.

m463 2y ago
Learn to set up vlans. I use openwrt for my routers/switches, and when I first set up a "home jail" network, it was the best. next step was to set up privoxy, so I could point devices at a proxy for updates, and privoxy could whitelist the machines to proxy to.
- steelframe 2y ago
  I am running my own custom-built Debian-based router in a VM and architected an encapsulated networking infrastructure at a FAANG once, so I know perfectly well how to get the device securely connected to the Internet while isolating it from the rest of my network. While I may trust the CoreELEC image I downloaded and audited at one point in time, I won't trust the people-and/or-org that controls the servers it connects to and pulls down updates from in perpetuity. So long as it is stable and has all the features I want in it, it won't ever be talking to anything on the Internet and will be left alone. If a feature or bug ever comes along that I feel I absolutely must get an update for, I'll be pulling an updated image, auditing it, and then flashing it to the eMMC device from another trusted host. But so far I don't imagine that will ever be necessary.

m463 2y ago

Learn to set up vlans. I use openwrt for my routers/switches, and when I first set up a "home jail" network, it was the best. next step was to set up privoxy, so I could point devices at a proxy for updates, and privoxy could whitelist the machines to proxy to.

steelframe 2y ago
I am running my own custom-built Debian-based router in a VM and architected an encapsulated networking infrastructure at a FAANG once, so I know perfectly well how to get the device securely connected to the Internet while isolating it from the rest of my network. While I may trust the CoreELEC image I downloaded and audited at one point in time, I won't trust the people-and/or-org that controls the servers it connects to and pulls down updates from in perpetuity. So long as it is stable and has all the features I want in it, it won't ever be talking to anything on the Internet and will be left alone. If a feature or bug ever comes along that I feel I absolutely must get an update for, I'll be pulling an updated image, auditing it, and then flashing it to the eMMC device from another trusted host. But so far I don't imagine that will ever be necessary.