7 ms·
This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of t
by drnick1 3mo ago
This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited.
- WarOnPrivacy 3mo ago> Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited. Why single out bad Chinese coding? Bad US IoT coding has a longer history.
- copperx 3mo agoAll of there IoT devices will be slop coded soon, and I wonder whether that will be an improvement or not. I bet that security will be better.
- shakna 3mo ago> I bet that security will be better. Not doxing myself, but... Company with a known name vibecoded a dashboard with Claude. Which also hardcoded a password into the client-side of the dashboard, which I caught. I reckon security will be about the same.
- fakwandi_priv 3mo agoWhen I'm reading reviews of plans created by an agent especially on security boundaries it's suggesting huge matrixes to test even the very obscure situations, but then I'm also reading things like this and I just don't understand. Are we even using the same tools?
- titularcomment 3mo ago1. It depends on model and tokens spent 2. Models talk the talk but not always walk the walk
- shakna 3mo agoManagement think models mean juniors can do senior work. Juniors don't know the footguns. Juniors can't read the code that the system outputs. Models get overwhelmed in any decent sized codebase. Why would you be surprised there are failures?
- budsniffer952 3mo ago[flagged]
- shakna 3mo agoProd bugs up 260% since AI approval? Yeah, I'm gonna disagree. BAs using AI make worse designs, management makes seniors redundant making code worse, and then QA is also laid off to make room for agentic testing. The results are not a surprise in anyway.
- jknoepfler 3mo agoRefusal to consider evidence to the contrary is certainly symptomatic of something, and it isn't a well-reasoned argument. "Us" sounds like the corporate leadership I work with that have actively pushed teams to incur mountains to tech debt. I was walking over org metrics this week and sure enough, there's a rising tide of unplanned work for bugs, performance problems, and security snafus introduced during an aggressive push into GenAI with pressure to "just make agents do it." All of which was, of course, predicted by management, reported upwards, and ignored.
- orbital-decay 3mo agoTools are already preventing IoT companies from doing a ton of things they do, by default. It's a problem of the process, churn, and culture, not tools. I don't have any doubts that if given a coding agent that cares more than they do they'd still force it to hardcode a password or something because they feel like it's more convenient. Nobody cares there.
- franga2000 3mo agoA large part is also how much you read back what the model writes. The good models generally write quite secure code, but they also often implement temporary solutions that they tell you to fix later. For example, if secret storage methods aren't specified in the prompts, a model might decide to be clever and implement a generic secret access interface, with a default implementation that hardcodes everything. It will probably tell you that this is not production ready and you should write or specify your preferred secret storage implementation, but if you don't read or understand that, you'll just leave it as is and push to prod.
- x______________ 3mo ago> Not doxing myself Seems irrelevant to the comment to add this, James. It just screams to do it a-la Streisand effect..
- Namidairo 3mo ago> All of there IoT devices will be slop coded soon Soon? I've already seen multiple of TP-Link's firmware engineers leave their LLM history public and indexed by search engines. It's quite obviously them as well.
- inigyou 3mo agoHow did you find that?
- forestry 3mo agoThere’s bad, and then there’s egregious.
- maccard 3mo agoPlenty of US companies have egregious vulnerabilities
- close04 3mo agoThere’s egregious and there’s malicious.
- Filligree 3mo agoYeah, we’ve seen that as well.
- deleted 3mo ago[deleted]
- izacus 3mo agoLike iRobot recording people on the toilet and uploading the videos? Yeah, I agree - at least Chinese Roborock gives very granular controls for privacy.
- everdrive 3mo ago>Why single out bad Chinese coding? You know precisely why anyone would single out China here. They are egregiously bad, and you know it, and everyone else knows. No amount of "what about this other bad thing that's also bad" could possibly allow any normal person to escape this conclusion.
- jwrallie 3mo agoBetter to buy devices that can work without internet and just blacklist them at the router level. Price or origin is not a good metric to ensure no leaks.
- petra 3mo agoConsumers just don't care about security. It is what it is.
- tjoff 3mo agoThere is no reasonable way to assess security for the average consumer.
- drdaeman 3mo agoEven if there’d be a way, there’s no culture of asking questions about how things work, especially outside the single “happy” path.
- tjoff 3mo agoBecause there are too many things. We've built society on the notion that you don't have to know. Which of course unethical corporations try to exploit. But if people knew how easy it was to use the camera they bought to spy on their family, then I bet many would care.
- petra 3mo agoTrue, that's probably the biggest issue. But the only solution here is very expensive marketing, so...
- alexloom 3mo ago[flagged]
- petra 3mo agoI agree. The market doesn't work well around this. You can ask chatgpt.not a great way. And when you ask it you the secure answers cost 3x more. And than require an installar. And some(Google) require a monthly subscription. And even about the good systems, the chat recommends, since there's no mathematical guarantee for security, that you "Switch them off or physically cover the lenses while you are home.".
- qurren 3mo ago> Chinese-made hardware Honestly, I'd rather it leak my GPS to the Chinese government than the US government. They don't have jurisdiction over me anyway. > should not be allowed to communicate over the public Internet It would be a no-go for non-techies. One of the biggest draws to IoT devices for "average Joes" is being able to view and control them from remotely, and they aren't going to have the skills or know-how to set up a VPN correctly with dynamic DNS so that their phone can VPN into their home and then sideload/jailbreak their phone to load a custom app to control it. "It just works from anywhere" is a big sell for them.
- afavour 3mo ago> It would be a no-go for non-techies. There are better solutions, like Apple’s HomeKit. I’m able to watch a camera that has no internet access because it passed through my Apple TV, which serves as a home hub. I didn’t have to set any of this up, it just works when you have the required hardware.
- qurren 3mo agoHomeKit will take care of the VPN/remote access part, sure, but your devices still need to communicate with the HomeKit device, and that's usually over Wi-Fi, which puts the devices on the public internet, and carries the same security risk. There are various non-internet protocols for IoT devices, none of them good: * Zigbee: Requires some technical understanding to set up, devices randomly disconnect for hours even when they are 2ft from the coordinator, all-around horrible experience for non-techies * Non-standard Zigbee variants: even worse * Matter-over-Thread: horrendously designed from a UX perspective. Easy-to-lose barcodes stuck on cards in the packaging, weird 12-letter codes, and your non-techie cannot understand what the hell Matter or Thread is. Pairing is an absolute nightmare.
- holgerschurig 3mo ago> Zigbee Requires no technical understanding. At least not more than e.g. a WIFI router. > devices randomly disconnect for hours even when they are 2ft from the coordinator, You present this like a fact. But it is at most an anecdote. I present you a different anecdote: I have ~30 zigbee devices, in two different houses (first a house with concrete floors and cellar and level 1..3) and now one old woodwork structure house with 2 floors. Nowhere did I had even half an hour of disconnection. > all around-horrible ... excellent experience even for my ex-spouse, which is/was non-techie. However, that you present Zigbee here at all is weird. Zigbee doesn't have any way to transport a camera stream. It's mean for low-powered battery devices. My temperature sensors got a 1500mAh AAA chargeable batteries and they lasts now for over one year. Note that I have sensors from ~ 15 different brands. Mostly battery powered sensors and mains power switchable plugs. I also enjoy that these Zigbee devices are by design completely disconnected from any IP traffic. This, and their (intentional) low data rate make them almost impossible to misuse. E.g. as denial-of-service originators or amplifiers. It's like you present WIFI as long-range thingy but actually you'd want LORA for that. I'm not assuming that knowing for what kind of usage a tech was designed as "needing technical understanding". After all, no one would claim "you need technical understanding" to know that you better use a truck instead of a Porsche Cayman to transport 50 cubic meters of sand.
- locknitpicker 3mo ago> This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. TP-Link is a prominent maker of network hardware, including home and mesh routers.
- conorcleary 3mo agoYea, where? :-)
- ivlad 3mo agoTP-Link is absolute crap of network hardware. Not to mention “leftover debug code”: https://nvd.nist.gov/vuln/detail/CVE-2024-21827 https://nvd.nist.gov/vuln/detail/CVE-2024-21827
- inigyou 3mo agoAnd their network hardware is illegal to import into the USA because it's full of backdoors.
- BLKNSLVR 3mo agoSo, TP-Link isn't sold as consumer level devices in stores in the US? It's had the Huawei treatment? It's one of the primary networking electronics brands in Australia.
- ck2 3mo agorouters could solve this for consumers with a checkbox for "intranet only" 99% of consumers won't know how to setup a firewall but could handle a checkbox only problem I have is I can't seem to punch a hole for time sync and it won't use my local intranet time server
- ssl-3 3mo agoTime server can be specified with DHCP, if you want. Options 4 [deprecated, but that doesn't matter] and 42. No idea if that helps with your particular devices; they are, of course, free to ignore those fields.
- OptionOfT 3mo agoWhich is very hard, because most of these devices don't work locally. They communicate via the cloud to your app. In most cases companies don't want to give you Matter or HomeKit, because it means they cannot sell you more through their app. Wyze has ads everytime you open it. So does Honeywell. Hell, even the internet-loved Ecobee has a banner that shifts everything down most of the time that you open the app. And for that last one, you _have_ to use their app to control the fan, as they don't expose separate fan controls over HomeKit...
- drnick1 3mo ago> Which is very hard, because most of these devices don't work locally. Then don't buy those devices. All of my home devices are either Zigbee (local-only) or were bought specifically because they can be reflashed with open firmware to liberate them from the cloud. > Hell, even the internet-loved Ecobee has a banner that shifts everything down most of the time that you open the app. I don't want such apps. The only app I need is Home Assistant, and installing proprietary software on my phone (running GrapheneOS) is out of the question.
- codedokode 3mo agoI think no country can be trusted and therefore all IoT device communication (telemetry/updates) should go through government-controlled local servers in an unecrypted form. This way local government can enforce its policy over foreign manufacturers and has a "kill switch" if they misbehave. Also, all communication and telemetry should be opt-in and turned off by default. Government-controlled server would prevent foreign countries from collecting intelligence and pushing malicious updates.
- AnonymousPlanet 3mo agoThis is why I like Zigbee and am very uncertain about Matter that basically allows (or maybe one day requires) internet access.