VissViss@mastodon.social
Oct 16, 2026, 7:49 PMReplies
- VissViss@mastodon.socialOct 16, 2026, 8:00 PM
this is unacceptable
HA is sending credentials up the line without opt-in, and their head dev refuses to acknowledge that this is a problem.
this is the ssh xz issue all over again.
someone is gonna drop code into HA to abuse this mechanism and its going to be a big ugly disaster.stop updating home assistant immediately
- VissViss@mastodon.socialOct 16, 2026, 8:35 PM
hey @theregister @TechCrunch @briankrebs @metacurity
you all wanna have a look at this?
home assisstant is doing some incredibly dumb stuff here and its worth getting the word out, because im sure nobody wants to be opted into some plumbing that scans their HA install, finds secrets and just .... sends them places without consent - VissViss@mastodon.socialOct 16, 2026, 8:39 PM
@theregister @TechCrunch @briankrebs @metacurity
it does not bode well that when i explained what the issue was, and several other folks chimed in, frenk, HA's lead dev, closed the issue and told us all to get stuffed. closed/wontfix.
Jérôme Petazzonijpetazzo@hachyderm.ioOct 16, 2026, 10:04 PM@Viss ummm
You have a point on the opt-in but you also lose a lot of credibility by saying it "sends the credentials"
Afrer checking the GH issue, I feel very conflicted because you sound 50% like you have identified a Real Big Issue and you care and are rightfully raising a stink about it, and 50% like you can't tell the difference between a password and a hash - and I hope it's the former, but some of the simplifications that you're making aren't playing in your favor
(Sorry if that sounds adversarial, just trying to give you a candid external perspective here)
Perhaps spelling out the threat model more accurately would go a long way!
