Is there a community specific to FOSS or just general privacy oriented IoT? With plenty of hardware discussion along with software. Routers, piholes, Meshtastic, anything IoT but open source. If it touches a network but you want it to do something it doesn’t. Flashing a doorbell camera with FOSS firmware. Hosting media servers on your phones Hotspot. Loading gcode to a printer from anywhere. There are so many things and possibilities.
If there isn’t someone should start one, OpenIoT or something catchy and relevant.
Probably homelab/self-hosted communities, but you’ll have to preface that you’re focussing on the security aspect than the usability of the application/device. With that said, I’d like for the kind of community you mention to be big and have a lot of engagement but I think it’s too niche even amongst niche communities like self-hosting.
With that said, the principles are largely the same. Netsec applies to everything that touches the network, FOSS or otherwise. If you’re using Zigbee, you’re going to have to read about RF and how to secure yourself (Zigbee uses symmetric encryption from what I’ve heard and I really don’t like the idea). Funnily enough, when I had posed a question on RF privacy here I was ridiculed and downvoted, seemingly by a community that “cares” about privacy.
Yes, there’s a lot of hypocrites here. Which is also another reason why you probably won’t find much traction for the community you’re thinking of. But I’ll stop there.
Edit: I completely missed the HA, Node-red and OpenHAB communities, but you’ll probably find them in other forums and not particularly active here other than Home Assistant
Your Https connections are also symmetric, so that’s a silly thing to dislike.
The handshake and key exchange are asymmetric, and used to establish a symmetric session key.
ZigBee encryption is fine for the use case, because you’re only adding devices you know are being added. You inherently trust that your physical ZigBee device is the device it claims to be.
There’s potentially an opportunity to hijack the key exchange between devices at network join, but you’d have to approve the listening device to your network in the first place.
https://development.libelium.com/zigbee-networking-guide/security-and-data-encryption
Thank you for clarifying, and my apologies
No apology needed, one thing about security is that paranoia is good. One problem with security is that paranoia leads to assumptions and misinformation, rather than understanding.
Symmetric key encryption is much faster than asymmetric, and can use much larger keys with less compute penalty. So we use acPU intensive asymmetric TLS handshakes to safely exchange the keys, and then switch to the faster method for the data.
So when ZigBee use AES 128, you can be reasonably sure the data packets are safe. The next question to ask is “do they exchange their keys safely?”
Which in this case would be “no” if you just leave the ZigBee controller in pairing mode all the time. However, you only allow pairing when you want it, and only pair with devices you explicitly allow. Unauthorized devices never get your network key.
Could you tell me more about how secure the key exchange is?
Check the link I posted above, or you can look at the 802.15.4 wiki for an overview.
https://en.m.wikipedia.org/wiki/IEEE_802.15.4, scroll to the security section.
Thanks
Yeah I know about all those, but unless they’re someone that’s privacy oriented, most people end up using closed oem solutions. It’s kinda weird how some people will get angry at people not using full open Linux, and then go and login to their ring account to check their door if the notification for their Amazon package is correct. I didn’t want to say it was a niche in my post but it is, so I wanted to expand that.
I’ll crack anything open to solder some jumpers to the rom(or more likely the existing open pin placements where they flash at the factory) and poke around or just fully flash hardware. Where are the other people that do this? It’s both hardware and software skilled. Lots of software people, lots of hardwares people. There should be a community to connect and build FOSS systems.
People like this usually hang around the microcontroller spaces since these people will almost always make a case with a 3D printer and order ESPs from Aliexpress and program their own device/install Tasmota or something. Some people maintain a happy medium with purchasing pre-built hardware and running FOSS on them, but IMO the real fun is when you do most of it yourself. Not discounting how good OEM hardware can be in terms of overall functionality, of course.
The downside to writing your own code is maintaining its security which is a pain though.
I don’t think you’ll find many people like the type you’re looking for here outside of the few in the communities I mentioned previously. You’ll have to look at other forums, unfortunately.
I am interested and also looking for good resources, buddies that do similar… So if you find the spot or create something I could see myself in there. I like to hardware tinker, solder, flash tasmota to sonoffs31 plugs, esp3266, esp32.
I guess I could make it, but I have zero desire to be a mod. Maybe if I make it I could pass it off relatively quickly to someone relevant that wants to do that type of thing.
Yeah I hear you on that.
Maybe just find a spot to start a conversation and see what comes of it. Maybe list a couple recent projects and what you want to do next. See what other folks are working on and If enough interest.
I’m currently working on some VLAN segmentation for IOT and have several IOT things blocked from accessing the Internet (like my network printer and some smart lights) (I run openHAB for home automation locally) , I also have some DNS blocking.
I have some USB logic analyzers and want to play with sigroc but haven’t got around to that. Also built an oscilloscope and want to learn to use it more (might make a signal generator so I can use some known frequencies and such) to ensure the oscilloscope is dialed in.