hey @theregister @TechCrunch @briankrebs @metacurity
you all wanna have a look at this?
home assisstant is doing some incredibly dumb stuff here and its worth getting the word out, because im sure nobody wants to be opted into some plumbing that scans their HA install, finds secrets and just .... sends them places without consent
@theregister @TechCrunch @briankrebs @metacurity
it does not bode well that when i explained what the issue was, and several other folks chimed in, frenk, HA's lead dev, closed the issue and told us all to get stuffed. closed/wontfix.
Oct 16, 2026, 8:47 PM@Viss @theregister @TechCrunch @briankrebs@infosec.exchange @metacurity well I opened a PR now. It’s claudeslop but it’s like five lines so whatever. Makes it opt-in the supervisor config.
@Viss @theregister @TechCrunch @briankrebs @metacurity Since I’m just now getting to this a few hours later (and haven’t gone through my timeline yet, so apologies if you’ve seen it), he came back, apologized, clarified the issue, and is working on the documentation.
@gregatron5 @theregister @TechCrunch @briankrebs @metacurity
its not finished yet.
he's taken the position that this is a documentation issue and not a "we installed plumbing that loots your secrets without your consent" issue
@Viss to be fair, the issue should be raised on the repo for the software if you want the software to change. making changes to the docs is the appropriate response to a request being made against the documentation repo
@jadedarko
Also the dev is right from the facts. It's impossible to retrieve the passwords from the request and actually it's an important modern security feature that Nextcloud, Firefox etc all implement nowadays.
See https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange
It's not constructive to exaggerate that. That said, an opt-in or opt-out (iirc in Nextcloud it is opt out) solution would be better IMHO. But the dev also showed how to disable it actually already. #HomeAssistant
@Viss
@Viss @theregister @TechCrunch @briankrebs @metacurity have I been pwned integration should have been opt-in from the get go.
I do appreciate the dev's detailed level-headed response and apology for being dismissive earlier.