@theregister @TechCrunch @briankrebs @metacurity
it does not bode well that when i explained what the issue was, and several other folks chimed in, frenk, HA's lead dev, closed the issue and told us all to get stuffed. closed/wontfix.
Oct 16, 2026, 8:47 PM@Viss @theregister @TechCrunch @briankrebs@infosec.exchange @metacurity well I opened a PR now. It’s claudeslop but it’s like five lines so whatever. Makes it opt-in the supervisor config.
@Viss @theregister @TechCrunch @briankrebs @metacurity Since I’m just now getting to this a few hours later (and haven’t gone through my timeline yet, so apologies if you’ve seen it), he came back, apologized, clarified the issue, and is working on the documentation.
@gregatron5 @theregister @TechCrunch @briankrebs @metacurity
its not finished yet.
he's taken the position that this is a documentation issue and not a "we installed plumbing that loots your secrets without your consent" issue
@Viss @gregatron5 @theregister @TechCrunch @briankrebs @metacurity The scan itself is a betrayal of trust.
@donburi @gregatron5 @theregister @TechCrunch @briankrebs @metacurity anyone watching the replies and seeing people who self label as 'infosec' or 'developer' advocating for nonconsensual transmission of secrets should be painting a real solid picture in their minds for why shinyhunters are so effective
@Viss @donburi @gregatron5 @theregister @TechCrunch @briankrebs @metacurity
This should be 100% opt-in, of it needed to exist at all.
I'm not sure why HA should need to care about this at all in the first place.
@fennix @donburi @gregatron5 @theregister @TechCrunch @briankrebs @metacurity its because self-important devs think they know whats best for a massive global userbase, and they sit squarely in the 'ask for forgiveness not permission' camp.
so now every HA user has their creds being shipped upstream without their consent because a handful of guys thought it was fine