Conversation

Notices

1. Embed this notice
   Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:29:06 JST Adam

   I'd like to tell you about an open source hardware pasword manager (hardware, software and firmware are all open source). It's a case study that illustrates a number of common themes about #FOSS, both good and bad.

   The product is Signet. https://www.crowdsupply.com/nth-dimension/signet

   There's a newer version in this line called Signet HC (high capacity).
   https://www.crowdsupply.com/nth-dimension/signet-high-capacity

   It all started when I was setting up a new computer and wanted to compile the software to access the passwords on the signet...

   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:10 JST Adam

     in reply to

     It's a mess. Eventually I realized that I could download a compiled version of the client software, which isn't exactly what I want, but it at least gets me up and running.

     I spent all day sorting out what the issues are, whether they have already been reported, whether anyone knows of a fix or a workaround, which forks to investigate to see what problems they solve (if any).

     Eventually I was able to get everything to compile and I was hit with dozens of compiler warnings.

     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: repeated this.
   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:10 JST Adam

     in reply to

     I put together a fixed up system, but it is only the bare minimum.

     At first I was pretty annoyed at the company behind this product for basically abandoning their customers.

     But then I realized, this is the same thing big corporations do all the time. They're usually more explicit about it in announcing that it is unsupported, but it's the same punchline.

     #FOSS is supposed to insulate customers from this. If the creator abandons it, customers, or anyone else, can just pick it up run with it.

     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: repeated this.
   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:11 JST Adam

     in reply to

     The client doesn't compile.

     There are instructions on how to check out the base repo, but no instructions on how to build the firmware. Even if you know what to to, the scripts are broken and the toolchain doesn't even get downloaded.

     The signet-cli compiles, but it can't access any passwords, only backup/restore/wipe devices and so forth.

     There have not been any updates in years to any of the signet repos. There are open pull requests that are one line fixes that fix compilation.

   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:45 JST Adam

     in reply to

     So that's what I did. I cloned every single library from NthDimension (the creators of the Signet) and pulled in all the fixes from various repos. I documented at least the build instructions.

     After hours and hours of frustration, I did not have the energy to fix all the compiler warnings tonight. I would like to. I'd also like to set up CI/CD jobs to automate the build process.

     Honestly, I'm surprisingly okay with taking over all of this responsibility.

   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:58 JST Adam

     in reply to

     It'd be nice if I could be paid for my labor. The thing is, I don't want to be a hardware manufacturer, nor do I want to be a software vendor.

     In my mind, for a project like this, the hardware manufacturer(s) should be selling the hardware, collecting the money and giving a cut to the people who maintain the software they depend on. This includes people like me, but more than just that, also the libraries they use, the cross compiling toolchain, and so forth.

     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: repeated this.
   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:58 JST Adam

     in reply to

     The deal will be you get some cool stuff, the company gets paid, and I get a bigger pool of people who might help with reproducing issues, answering questions and forming a #community to help keep this project alive.

     Lets make it happen. Spread the good word.

     https://www.crowdsupply.com/nth-dimension/signet-high-capacity

   • Embed this notice
     Adam (adam@hax0rbana.social)'s status on Monday, 16-Jan-2023 14:30:59 JST Adam

     in reply to

     It is about sustainability. We should be able to use this hardware for years into the future. We should be supporting those whose work we build upon. Help them support and maintain it.

     I need your help.

     Spread the word.

     Anyone who is interested in, and can afford, one of these hardware password managers should get one. They are a cut above software password managers, two notches about cloud password managers, and even further from no password manager.

     I will personally support you with this.

     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: repeated this.