Is there a community specific to FOSS or just general privacy oriented IoT? With plenty of hardware discussion along with software. Routers, piholes, Meshtastic, anything IoT but open source. If it touches a network but you want it to do something it doesn’t. Flashing a doorbell camera with FOSS firmware. Hosting media servers on your phones Hotspot. Loading gcode to a printer from anywhere. There are so many things and possibilities.
If there isn’t someone should start one, OpenIoT or something catchy and relevant.
Probably homelab/self-hosted communities, but you’ll have to preface that you’re focussing on the security aspect than the usability of the application/device. With that said, I’d like for the kind of community you mention to be big and have a lot of engagement but I think it’s too niche even amongst niche communities like self-hosting.
With that said, the principles are largely the same. Netsec applies to everything that touches the network, FOSS or otherwise. If you’re using Zigbee, you’re going to have to read about RF and how to secure yourself (Zigbee uses symmetric encryption from what I’ve heard and I really don’t like the idea). Funnily enough, when I had posed a question on RF privacy here I was ridiculed and downvoted, seemingly by a community that “cares” about privacy.
Yes, there’s a lot of hypocrites here. Which is also another reason why you probably won’t find much traction for the community you’re thinking of. But I’ll stop there.
Edit: I completely missed the HA, Node-red and OpenHAB communities, but you’ll probably find them in other forums and not particularly active here other than Home Assistant
Your Https connections are also symmetric, so that’s a silly thing to dislike.
The handshake and key exchange are asymmetric, and used to establish a symmetric session key.
ZigBee encryption is fine for the use case, because you’re only adding devices you know are being added. You inherently trust that your physical ZigBee device is the device it claims to be.
There’s potentially an opportunity to hijack the key exchange between devices at network join, but you’d have to approve the listening device to your network in the first place.
https://development.libelium.com/zigbee-networking-guide/security-and-data-encryption
No apology needed, one thing about security is that paranoia is good. One problem with security is that paranoia leads to assumptions and misinformation, rather than understanding.
Symmetric key encryption is much faster than asymmetric, and can use much larger keys with less compute penalty. So we use acPU intensive asymmetric TLS handshakes to safely exchange the keys, and then switch to the faster method for the data.
So when ZigBee use AES 128, you can be reasonably sure the data packets are safe. The next question to ask is “do they exchange their keys safely?”
Which in this case would be “no” if you just leave the ZigBee controller in pairing mode all the time. However, you only allow pairing when you want it, and only pair with devices you explicitly allow. Unauthorized devices never get your network key.
Yeah I know about all those, but unless they’re someone that’s privacy oriented, most people end up using closed oem solutions. It’s kinda weird how some people will get angry at people not using full open Linux, and then go and login to their ring account to check their door if the notification for their Amazon package is correct. I didn’t want to say it was a niche in my post but it is, so I wanted to expand that.
I’ll crack anything open to solder some jumpers to the rom(or more likely the existing open pin placements where they flash at the factory) and poke around or just fully flash hardware. Where are the other people that do this? It’s both hardware and software skilled. Lots of software people, lots of hardwares people. There should be a community to connect and build FOSS systems.
People like this usually hang around the microcontroller spaces since these people will almost always make a case with a 3D printer and order ESPs from Aliexpress and program their own device/install Tasmota or something. Some people maintain a happy medium with purchasing pre-built hardware and running FOSS on them, but IMO the real fun is when you do most of it yourself. Not discounting how good OEM hardware can be in terms of overall functionality, of course.
The downside to writing your own code is maintaining its security which is a pain though.
I don’t think you’ll find many people like the type you’re looking for here outside of the few in the communities I mentioned previously. You’ll have to look at other forums, unfortunately.
I am interested and also looking for good resources, buddies that do similar… So if you find the spot or create something I could see myself in there. I like to hardware tinker, solder, flash tasmota to sonoffs31 plugs, esp3266, esp32.
I guess I could make it, but I have zero desire to be a mod. Maybe if I make it I could pass it off relatively quickly to someone relevant that wants to do that type of thing.
