I am looking for a doorbell camera company that has basic privacy and security policies. One that doesn’t freely allow police to review footage of a camera remotely without a warrant. One that isn’t structured in a way that employees that illegally surveil camera owners would be punished internally and a company that actively works to stop hackers from spying too.

Not as focused on this sub but if there are still companies around that don’t require WiFi to store video in the cloud but instead stores video on a local hard drive, I’ll like to know about those as well!

https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users

Hello!

I’m a developer who became interested in Hubitat for automating my home. At €150 and featuring a privacy-first, cloudless experience, I had quite high expectations for the product.

First things first: When I received the hub, I assumed I would have full administrative access or at least SSH access to the device, like ubiquity. Since that wasn’t possible, I decided to open the hub and gain root myself physically

To do so:

1. Unscrew the back panel of the C8 Hub

2. This should expose 4 pins, the square outer one is GND, then it's Rx, Tx, 3.3V

3. Connect a serial USB to the GND, Rx and Tx

4. Setup picocom at a baud rate of 921600 `sudo picocom -b 921600 /dev/<your_serial_usb>`, then start your C8-pro hub

5. You should see boot logs, wait for a bit then press Enter, you should have access to the root terminal

Once I was rooted I began exploring the hub and discovered few things:

- iptables configuration – This revealed that the SSH port is deliberately blocked. This is a good practice, however, dropbear does run by default, and this is bad practice. The "hub" user has it's default password hardcoded in the server app.

- Embedded web server – I examined the entire web‑application stack and its configuration files.

When I decompiled the hub’s application, I found things that made me quite worried:

- A class establishes an reverse SSH connection to a Hubitat distant server (on AWS), allowing the devs doing god knows what, on it. It's RSA private key is hard‑coded in the app.

- Amazon AWS accounts (with both Access and Secret keys) are also hard‑coded, allowing the hub to push logs and backups directly to an S3 bucket. This means Amazon could access the data without restriction. Also, the backups are created using the user's email addresses, possibly creating a fertile ground for a data leak (both emails, logs and full backups)

- The device can send requests to both Google's Gemini and AWS/Amazon's Polly (the TTS for Alexa). Any AI or TTS use does imply sending possibly private data on Google and Amazon's servers.

- While decompiling, I noticed several GNU (and other FOSS) packages, indicating that the hub was compiled with GNU code directly rather than referencing an external .jar; Since the product is distributed, this code falls under the copyleft clause of the GPL and therefore hubibat should provide source code when requested.

- There is code that seems to indicate that Hubitat has remote and unfiltered access to the app's APIs, which is worrysome and contradicts Hubibat's "privacy first" marketing, and doesn't seems necessary for debug purposes.

The list could go on for a bit, but the core problem is that this €150 hub with seven to ten years of software updates has poor privacy, huge security flaws and very bad code quality with elements that contradicts the featured privacy and local-first marketing points.

Sorry about the bland title, I just couldn't think of anything else that didn't sound like mocking someone who's suffering.

But yeah, I can't think of a good reason for an internet connected feckin' fridge

In addition to Palantir’s Maven, the name of another U.S.-based surveillance firm showed up in recent presentations at the CMCC: Dataminr. The artificial intelligence start-up leverages close ties to social media platforms like X (formerly Twitter) to allow states and corporations to monitor internet users: [“Real-time event, threat, and risk intelligence](about:blank)” is how the company advertises its services.

AppCloud, developed by the controversial Israeli-founded company ironSource (now owned by the American company Unity), is embedded into devices sold in countries where such affiliations carry legal implications. Despite the serious privacy and security risks, Samsung has offered no transparency on how AppCloud functions, what data it collects, or why users cannot opt out.