Skip Navigation

dan

@ dan @upvote.au

Posts
0
Comments
1076
Joined
3 yr. ago

Aussie living in the San Francisco Bay Area.Coding since 1998..NET Foundation member. C# fan https://d.sb/Mastodon: @dan@d.sb

  • 40K IoT cameras worldwide stream secrets to anyone with a browser.

    Jump

  • The good Chinese brands, if they do have a hard-coded password, usually make you change it on first login. I'm pretty sure newer Hikvision and Dahua models do this (plus their resellers/rebrands like Amcrest, Lorex, Annke, etc). You need to pay more than the garbage brands, but they're worth it.

    Of course, there's all sorts of junk on Amazon that don't follow any sort of standards.

  • 40K IoT cameras worldwide stream secrets to anyone with a browser.

    Jump

  • Hard-coded default passwords have been illegal in California since 2020, so it shouldn't be as much of an issue with newer devices. Companies aren't going to make California-specific versions of their devices, so they'll often just follow the California standards everywhere.

    To be legal in California, the device either needs to have a randomly-generated password unique to that device (can be listed on a sticker on the bottom of the device, or in the manual), or it needs to prompt to set a password the first time you use it.

    I still wouldn't ever expose a camera directly to the internet. Keep it just on your LAN (eg using a VLAN) and VPN in (eg using Tailscale) to connect to it remotely.

  • 40K IoT cameras worldwide stream secrets to anyone with a browser.

    Jump

  • 40K IoT cameras worldwide stream secrets to anyone with a browser.

    Jump

  • Any camera you expose to the internet with no protection is vulnerable. The issue is just that they're accessible over the internet without a password.

    Follow best practices by keeping your cameras on a separate VLAN that's isolated from the internet, and you'll be fine. Use a VPN like Tailscale to view your cameras while away.

  • A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account

    Jump

  • This doesn't really work in real life since IPv6 rate limiting is done per /64 block, not per individual IP address. This is because /64 is the smallest subnet allowed by the IPv6 spec, especially if you want to use features like SLAAC and privacy extensions (which most home users would be using)

    SLAAC means that devices on the network can assign their own IPv6. It's like DHCP but is stateless and doesn't need a server.

    Privacy extensions means that the IPv6 address is periodically changed to avoid any individual device from being tracked. All devices on an IPv6 network usually have their own public IP, which fixes some things (NAT and port forwarding aren't needed any more) but has potential privacy issues if one device has the same IP for a long time.

  • A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account

    Jump

  • Most service providers like Vultr provide /64 ip ranges, which provide us with 18,446,744,073,709,551,616 addresses. In theory, we could use IPv6 and rotate the IP address we use for every request, bypassing this ratelimit.

    This usually doesn't work, as IPv6 rate limiting is usually done per /64 range (which is the smallest subnet allowed per the IPv6 spec), not per individual IP.

  • Is there anybody over here who can tell me more about smart meters ?

    Jump

  • Smart meters automatically send usage data to the utility company (electricity, gas, water, etc) so they don't have to come and read it manually themselves. Are you interest in any particular detail about them?

  • Reddit sues Anthropic, alleging its bots accessed Reddit more than 100,000 times since last July

    Jump

  • I agree, but unfortunately it's a reality of a capitalist society that large private companies have a lot of the wealth, and so people set themselves up for retirement by owning a very tiny part of those companies.

  • I'm making a guide to Pocket alternatives: getoffpocket.com

    Jump

  • I was going to say that I use Hoarder and like it, but it looks like it's been renamed to Karakeep. I like the AI-powered tagging functionality.

  • Is there anybody over here who can tell me more about smart meters ?

    Jump

  • I can't see the link you posted. It goes to a Twitter login page.

  • Reddit sues Anthropic, alleging its bots accessed Reddit more than 100,000 times since last July

    Jump

  • A lot of people don't realise that around 40% of the value of the S&P 500, and the majority of the Nasdaq 100 (i.e. QQQM) is big tech companies.

    You could always build a portfolio that excludes companies you feel are unethical (for example, exclude oil and gas companies, exclude big tech, etc), but if you were to exclude all companies that have done something unethical then you'd probably end up with the S&P 0 (an empty list)

  • Reddit sues Anthropic, alleging its bots accessed Reddit more than 100,000 times since last July

    Jump

  • As much as I hate Facebook, they at least pay people to do moderation there, and regularly update their site

    Facebook pays content creators too (https://creators.facebook.com/earn-money ), including for things other than videos (like photo/image posts). Platforms like YouTube do too, but as far as I know, Reddit doesn't.

  • New federal employees must now write essays praising Trump's policies

    Jump

  • Is Trump actually following what the courts say though?

  • In North Korea, your phone secretly takes screenshots every 5 minutes for government surveillance

    Jump

  • Do those code snippets on the Stackoverflow post allow you to capture the entire screen regardless of which app is open, or do they only allow you to capture the app the code is running in?

    Capturing the app itself makes sense (for things like bug reports) but does Android really let any app capture whatever is on the screen?

  • In North Korea, your phone secretly takes screenshots every 5 minutes for government surveillance

    Jump

  • The one time I do connect the TV to the internet is when there's a firmware update that fixes an issue I'm encountering. That's rare though.

    I still have it on my network so I can control it using Home Assistant (eg have a backlight come on and dim the main lights when the TV is turned on) but it's on an isolated VLAN.

  • In North Korea, your phone secretly takes screenshots every 5 minutes for government surveillance

    Jump

  • This is why my TV is on a separate VLAN (with no internet access) and I use an Nvidia Shield for streaming. I haven't seen any indication that the Shield does anything like this.

  • In North Korea, your phone secretly takes screenshots every 5 minutes for government surveillance

    Jump

  • I was going to say "that article mostly just seems to debunk the 'my phone is always listening to me' conspiracy theory" but then I got to the part about over 50% of analyzed Android apps having permission to take screenshots :/

  • Silicon Valley cities hit with request for residents' emails to train AI

    Jump

  • is free

    What is their business model?

  • New Yorker is right

    Jump

  • The original use case was as an antidepressant (for humans). Its usage for dogs and for treating insomnia are both use cases that came later on.