7 ms·
The future of Flipper Zero development
- AJRF 4mo agoEveryone I know who owns a flipper almost immediately installs some 3rd party firmware like Momentum on it.
- MomsAVoxell 4mo agoYes, this is the way things should be, imho - let the company building the hardware have the say on the base OS, but then let there be forks/contributions from the wider community, which will keep the hardware alive long past the cutoff valve on the production line. There are many good examples of this working out great for the community, one that I am playing with recently is the community firmware for the Synthstrom Deluge music production workstation, where the community is just taking it into the stratosphere in terms of capabilities beyond the original factory firmware. There will always be folks who want to share their work. Another good example is the pwnagotchi scene, where the project is kept alive by its users due to the open source nature of the original firmware images.
- natbennett 4mo agoFlipper Zero is one of the handiest little pieces of tech I’ve ever owned. Being able to copy RFID keys is occasionally fantastically useful.
- mikepurvis 4mo agoIs... that possible? I thought the whole point is that those were a challenge-response specifically to avoid ever them disclosing over the air the material necessary to impersonate one.
- givc 4mo agoI don’t know a whole lot about RFID, but some of the most basic cards can be copied very easily. When scanned, the reader always reads the same bits. I believe there are some more secure cards, like Mifare DESFire EV3 that do provide some security. You’d be shocked how insecure most RFID readers for security cards are.
- p_l 4mo agoRFID keys vary from utterly dumb ID-based, to hackable challenge-response, to actual NFC smartcard (very rare). Some of that can be trivially cloned.
- fragmede 4mo agoDepends on where you are. Newer systems are resistant to attack, but not everywhere has upgraded to newer systems.
- jchulce 4mo agoKeyfobs absolutely should use a secure challenge-response protocol in order to prevent cloning. Unfortunately, it's extremely common for RFID devices to simply use the tag ID which is trivially cloneable. Many of the systems that make some attempt at security still fail by using a broken protocol or a flawed implementation.
- aarjaneiro 4mo agoMost dont :)
- natbennett 4mo agoOh yeah that’s how you’re supposed to do it. But it’s entirely possible to set up a system that uses RFID key fobs that uh, doesn’t. In the case where it was most useful to make copies they did eventually replace the system with one where the keys weren’t copy able. Which was better!
- GuB-42 4mo agoSome cards don't have any form of security. For example Konami "e-amusement" cards are just an ID number, which is also written on the back of the card. It is a username so to speak, the password is the PIN you enter when you start the game. Some cards use some kind of challenge-response but are weak and are easily crackable. Some cards have an anti-copy protection based on rolling codes, be careful with these. The idea is that when you use it to, say, open a door, the card sends a code to the reader and if correct, that code is burned and the reader replies with the next code, which is stored in the card for the next time, making every other copy (possibly including the original) unusable. If the card emulator doesn't store the rolling code, you are completely locked out. Some cards have a proper challenge-response mechanism that works and can't be easily copied.
- ethbr1 4mo agoOof, that burned-code scheme sounds like it has some painfully sharp UX edges if something goes awry in the new code resync portion. But I'm guessing that's for serious security, where going to the guard shack is preferable to letting anyone unauthorized in?
- Rebelgecko 4mo agoMany RFID cards are literally just an ID number, and will happily allow you to copy that number to your own RFID card (look up "blue cloner guns", although they have their own downsides). Basically just security through obscurity. Cards that do fancy crypto stuff exist, but odds are your workplace badge, apartment fob, or hotel room key is the simple kind (because those are cheaper)
- account42 4mo agoFor a lot of applications someone being able to clone the card is also not that big of a problem. E.g. a hotel will invalidate the code on the card anyway when you check out so it doesn't matter for security whether a past guest has cloned the card.
- Larrikin 4mo agoIn my old apartment I was able to copy my fob from my apartment office. In my new one I had to record the interaction with the door and was then able to open the door
- Aachen 4mo agoYou're thinking of NFC, not RFID, and with NFC the owner might not have changed the default keys. It's a common mix-up (people barely differentiate between the terms anymore, though I'm surprised nobody in 2 hours mentioned it yet), basically RFID is (historically) an ID; a username. Like an ID field in a database. NFC is near-field communication: bidirectional. It does challenge-response and typically runs on hardened chips. But yeah people will call NFC chips RFID and RFID chips NFC all the time. Both are waterproof devices doing radio transmissions on wireless power and you can't tell them apart without using some equipment to try and read the chip type (even if most phones can do that nowadays), so I can understand the terminology generalisation
- account42 4mo ago> and with NFC the owner might not have changed the default keys Or the use case doesn't depend on any protected bits. A lot of NFC chips are being used as glorified ID tags even if the hardware could do more. And what actual security the hardware provides varies a lot - it's more like a gradient from dumb ID to full java card than a clean distinction.
- Aachen 4mo agoAh yes, very true
- DaSHacka 4mo agoEven that process can be flawed, see: Crypto1 and all the shenanigans that followed. Recent UL-C/AES disclosure too IIRC
- miladyincontrol 4mo agoAs others have said, most are dumb, some just slightly less so. A few captured nonce values and a dictionary attack will crack most with ease.
- gonzalohm 4mo agoIs this something you do often? I could see a few use cases and also for copying garage keys. But I don't think I would use it enough to justify the investment
- gopalv 4mo ago> I don't think I would use it enough to justify the investment This is not a rational purchase - most of the rule breaking done with the zero is for fun or convenience, rather than being truly illegal. It used to be more fun before the hotels started handing out NFC unlocks with your phone. Still, being able to send each other a key for a hotel room on Signal is a nice trick if you are traveling with a sufficiently tech savvy group of people.
- natbennett 4mo agoNope! Only occasionally. But it’s handy on those occasions.
- HDBaseT 4mo agoYou can't even clone you garage door opener key anyway. Flipper Zero and its clones have always been pseudohacker nonsense. Fun little party trick I suppose.
- EricBetts 4mo agoSometimes you can clone them. My 20+ year-old condo uses non-rolling code "MegaCode". It's hit or miss.
- deleted 4mo ago[deleted]
- dzhiurgis 4mo agoIMO for garage much easier to just add garage door opener that works from your phone.
- gonzalohm 4mo ago
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- pornel 4mo agoI use it to clone remotes of "dumb" devices and emulate them with ESPHome to make them "smart" fully offline under my control.
- dzhiurgis 4mo agoCan you outline the process here? What transmitters do you use with esp32?
- pornel 4mo agoEverything you can capture with Flipper has off-the-shelf cheap simple components you can find in your DIY electronics/maker store: IR leds, 433Mhz antennas. Seeed xiao is also small enough that you can stuff it and a relay into appliances and simulate button presses.
- drunken_thor 4mo agoWhat a great tool and community they have built. I find my flipper0 is like a computer Swiss Army knife. It’s so fun to carry around a tool of my own trade.
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- yjftsjthsd-h 4mo ago> TL;DR: We've allocated resources to maintain Flipper Zero firmware and support community contributions. Is that the tldr? It sure sounds like it's still on minimal life support.
- hdgr 4mo agoIt is. As the article says, all development goals for FZ had been achieved and even overachieved - providing solid and feature-rich firmware, powerful SDK and developer tools. With that and development shift towards new products, updates to core firmare became infrequent - and we tried to address that. Src: I'm one of the developers behind Flipper Zero.
- throwing_away 4mo agoYou guys have done such a good job that I've thought about buying one even though I don't need one at all just to support the project. You've surely launched a generation of perhaps-someday-responsible hackers into the world.
- jagged-chisel 4mo agoWhy can't something be "done"?
- busymom0 4mo agoWas just reading something along those lines: https://infosec.exchange/@millie/115719943870742405 https://infosec.exchange/@millie/115719943870742405 > We need to normalize declaring software as finished. Not everything needs continuous updates to function. In fact, a minority of software needs this. Most software works as it is written. The code does not run out of date. I want more projects that are actually just finished, without the need to be continuously mutated and complexified ad infinitum.
- godelski 4mo agoTo be fair, some software does rot. But when you have control of the hardware and the software, rot is pretty uncommon. Honestly, I thought the whole point was to make a popular unified platform where the community could come together and expand on it. I really can't imagine a centralized player can predict nor create all features that users might want. But it seems like Flipper did the right thing: make the software flexible and easy to expand upon.
- terry12341367 4mo ago[flagged]
- ughitsaaron 4mo agoI get ads for this all the time but still have no idea what I could do with it.
- devmor 4mo agoAnything you might want to do with a radio or IR device but don’t have specialized hardware for. It’s kind of a swiss knife/leatherman tool for short range communications standards.
- Gigachad 4mo agoI think of it as the browser dev tools of radio. Most people will have no use for it but it brings visibility and interactability in to an otherwise invisible world.
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- quietsegfault 4mo agoI use mine mostly as a universal IR remote.
- nekusar 4mo ago[flagged]
- hananova 4mo agoWhat is the current go-to unofficial firmware? Mine had extreme but I think that one’s dead?
- rufo 4mo agoGiven they’ve had several skirmishes with customs and law enforcement agencies around the world, this always struck me as similar to the “don’t talk about installing retail Switch games on the Switch modding Discord” type of deal - everyone knows you can do that, but allowing mentions in official channels opens us to liability and causes nothing but headaches for both us and for customers, so if you’re going to do that, you need to talk about it somewhere else. I freely admit that’s an assumption on my part, though, and I don’t know if there’s something uglier there…?
- nekusar 4mo agoIts one thing to have a skid come in going "I wanna hack the RFID on the gubbmints's doors how can i do that?" Versus "we forked the firmware to include a wide range of pentesting tools" And then get banned for even saying the alternate firmware. And seriously, this little thing is a wonderful hacker multitool. You can seriously fuck shit up with the hardware they included. For fucks sake, thats WHY they created it.
- JacobAsmuth 4mo ago[flagged]
- dimbletimbers 4mo agoIt’s definitely a meme if nothing else that the cybersecurity community has a distribution of furries that would not reflect the general population’s.
- rebolek 4mo agoIs there some study to explain why? Do they feel more safer pretending to be human sized...furry animal?
- kstrauser 4mo agoMy hypothesis, based purely on personal experience and what friends have told me. I am not a furry. I feel like infosec was one of the earliest "no one cares who you are if you have skills" user groups. Online, you were just a handle. Man, woman, both, neither, no one knew until if/when you met up IRL. Until then, all you had was your reputation. I think that led to people having a pretty good idea about the attitudes of people they were talking to online, staying away from people who were going to be jerks about identity or pastimes, and a lot of conversations like "General Mayhem is weird, but he's our weird, so no one mentions that fox tail he wears everywhere." Over time, that was a positive feedback loop: people who weren't cookiecutter felt safer around infosec folks than most other crowds. => That increased the "weird density" of infosec meetups. => People who don't like being around uncommon appearance or behavior stayed away from infosec meetups. => Those meets became safer for uncommon folks. => Repeat. I don't know if that's right, but again, that's what friends have expressed to me before. It seems plausible. Note: When I say weird, I mean it affectionately. I've never met anyone in infosec who didn't have some quirk not far below the surface. Frankly, I love that. And because of that, and the virtuous circle I described, I've never had one single person in infosec confess to me that they weren't OK with gay or trans or furries or other type of behavior/identity/etc. I'm a straight white middle class dude, and unfortunately I have had people confess such things to me in other circles, mistakenly assuming that since I was in their demographic, I'd agree with them or at least be OK with it.
- stevage 4mo agoIt's slightly funny that the post says firmly that they aren't doing any form of real time engagement with the community anymore, then ends by announcing an AMA date and time.
- cindyllm 4mo ago[dead]
- pastaj36 4mo agoTough spot with community that expects firmware updates while hardware sells only once
- EricBetts 4mo agoIt's sort of a self imposed problem as well because the community produces a bunch of pull requests, but only the corporate staff members can approve and merge them into the official firmware. It begs the question why have an official firmware if it's not at least slightly maintained.
- godelski 4mo ago> why have an official firmware if it's not at least slightly maintained. Because it's still useful to have a blessed child so that people getting into the space have somewhere to start. You could accept zero additional PRs and it would still be a useful thing to have. The hardware is static so the rate of software rot is pretty low. It can effectively not be maintained as long as it's already in a stable state. Adding new features is cool and all but it also adds more bugs. But the great thing is that there's a community, all using the same hardware, and people can fork. So people can still get those updates that they want. Maybe the only thing to do is create a community fork that is much more open but doesn't come with the same stability promises. But that can still be a lot of work, even if you get community maintainers
- miki123211 4mo agoWhich is just another way of saying "this is why most developers prefer subscriptions over one-time sales"
- abcd_f 4mo agoYeah, they do, but an actually fair to all sides model is that of one-time sales coupled with optional paid-for updates.
- vineyardmike 4mo ago
- asasidh 4mo agoWhy would they not consider open-sourcing the software side ? Its not like they make any money from the software.
- swiftcoder 4mo ago> Why would they not consider open-sourcing the software side ? What part of their GPL-licensed firmware that is hosted in a public GitHub, do you consider not to be open-source?
- egorfine 4mo agoI wonder whether that future includes sending me the device I initially backed on the very first kickstarter. It's been >4 years of back-and-forth with support.
- rickdeckard 4mo agoMight be an unpopular opinion, but: 1. They open sourced the entire Software under GPL from the start, and always pushed all their changes to that public github. 2. They supported the first-party firmware for years, including huge rewrites of the interfaces used by applications, etc. 3. They actively involved the community on many topics around the product and were always responsive. They did their job very well, financed ONLY by one-time sales of hardware. NO subscription or additional licensing fees were ever charged. There is still alot of potential in the hardware itself (e.g. Bluetooth/BLE, NFC Tag writing,...), and the Community is working on alot of different topics. -- Tl;DR: The Flipper team is free to go and invest resources elsewhere now. Thanks for your support, keep up the great work!
- hamburgererror 4mo ago[flagged]
- myrmidon 4mo agoThere are. LGBT+furries seem significantly overrepresented in embedded software/emulation (more so than in compsci), so this makes sense for the target audience.
- tzs 4mo agoHow do you know they are furries? The illustration could be set in a world where humans and anthropomorphic animals coexist, like the fictional worlds in movies such as "The Bad Guys" or TV shows such as BoJack Horseman or Teenage Mutant Ninja Turtles. Another possibility is that it is a medical and/or supernatural condition. They all appear to be canines. They could be werewolves, in a world where medicine and/or magic has developed a way to allow the change to just affect the body leaving their mind and personality intact.