Hacker News Reader

Comment by voakbasda | Hacker News Reader

I have avoided all security cameras for the past couple of decades, because I do not trust the vendors that produce closed source implementations. They either cannot be trusted directly (because they use the cloud) or cannot produce up-to-date firmware for the lifetime of the camera (putting them at risk of hacking or becoming e-waste).

So HN, what are the best options for COTS open source cameras? Ideally, I want hardware as open as a RPi with software that has either zero or on-site cloud connectivity. Bonus points for being able to add a solar/battery system to run for weeks at a time and easy-to-deploy mesh network that allows me to daisy chain these deep into my forest and fields.

I have been lusting for this system for years, but it does not seem to exist.

View on HN

Shitty non-cloud cameras on their own network segment isolated from the internet, and use a VPN to remote in to view/manage them. This mitigates the firmwares' lack of security and prevents remote hacking (or makes it more difficult) as ideally there should be no way for an outbound connection to be made from this segment.

This is it. You gotta contain it and can't trust it on an open network.

This might work, but it is not something I want to do.

Metaphorically, I want to take the bullets out of the gun, not put on a bulletproof vest.

My wyze cam pan was compromised apparently by someone in my neighborhood who worked their way onto my home network router.

I had always been skeptical of the security on them. Thank goodness I had put up a rear-view blocking shield so that only the desired outside camera zone could be observed. The camera would frequently pan around to look into my living room and it would cut out any time that one particular person was on my doorstep with their mobile phone. IOT devices are overall unreliable revenue collection devices to which subscription pricing can be changed and instituted at any time. At least with the wyze cams, they are not particularly as expensive, but it does worry me about environmental pollution as these devices all get bricked. There should be better governance and probably service expiration dates posted on the boxes of each of them if this is to continue in any effective way.

I think the Raspberry Pi style cameras would be the standard, but so far as I know, it’s all still home built gear based on modules that you can buy. I’m not aware of anyone selling an all-in device that just needs to be installed, and only requires configuration and physical installation, and then ongoing monitoring.

If you’re looking for commercial standards based cameras (e.g., the ones that implement ONVIF), you have to be careful. The Chinese companies Dahua and HikVision have hundreds, maybe even thousands, of brands that they sell under. And both of these companies have been implicated in selling hardware and services to the Chinese government for exploitation and suppression of the Uighur Muslim minority population.

See https://securitycamcenter.com/dahua-oem-list/ and https://securitycamcenter.com/hikvision-oem-list/ for more information.

Any Chinese camera is right out. The bad players have ruined it for everyone. Too great a chance of spying with the stock firmware and horrible or non-existent documentation for porting an open stack.

Note that Wyze uses Dahua hardware, and then they provide their own firmware.

You can see an exact matchup in their models of cameras, if you carefully compare the hardware.

So, beyond the OEM listings above, there are other vendors selling into the market who just take existing hardware from Chinese vendors, and then resell that.

A lot of dodgy, cheap hardware is like that. My body scale shows ads. My daughter's trackable watch shows ads. My Mi phone default app for opening files shows ads.

Spying for governments is one thing, but ads suggest they're willing to sell all your privacy to the next person who bids on it.

Reply on news.ycombinator.com