Conversation

Notices

1. Embed this notice
   Viss (viss@mastodon.social)'s status on Saturday, 17-Oct-2026 07:33:03 JST Viss

   • ../kajer/.
   • Ryan Castellucci (they/them) :nonbinary_flag:

   @kajer @ryanc that was what i was trying to argue.

   fine if some people wanna run it, great, let them

   i dont want it on my system
   i didnt ask for it
   i didnt opt in
   what the fuck

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Saturday, 17-Oct-2026 07:33:02 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • ../kajer/.

     @Viss @kajer so, taking a moment to steelperson an argument here, n00bs exposing HomeAssistant to the intarwebz with weak passwords, and then shortly thereafter hosting a botnet node is a genuine problem, and those who need it most are not likely to opt in

     to be clear, i'm not saying I agree with this position, but it's how i'd justify it rather than being dismissive

   • Embed this notice
     ../kajer/. (kajer@infosec.exchange)'s status on Saturday, 17-Oct-2026 07:34:44 JST ../kajer/.

     in reply to

     • Ryan Castellucci (they/them) :nonbinary_flag:

     @ryanc @Viss then the integration should be in the UI and very forward about what it is and what it's doing, and be like any other integration that you can disable.

     If I don't want the weather integration, great, i disable it.

     being a CLI only thing that sends API hits to HIBP is shady

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Saturday, 17-Oct-2026 07:36:42 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • ../kajer/.

     @kajer @Viss yes, that would be a far more reasonable solution

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Saturday, 17-Oct-2026 07:37:52 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • ../kajer/.

     @Viss @kajer yeah, the way it's implemented does not respect the users

   • Embed this notice
     Viss (viss@mastodon.social)'s status on Saturday, 17-Oct-2026 07:37:53 JST Viss

     in reply to

     • ../kajer/.
     • Ryan Castellucci (they/them) :nonbinary_flag:

     @kajer @ryanc

     i think the chief issues here are simply:
     - this shit was 100% invisible for 5 years
     - it only surfaced its existance when it threw a notice
     - it was installed everywhere without consent or opt in
     - there is no place in the ui where you can config it, you have to use command line

   • Embed this notice
     Fritz Adalis (fritzadalis@infosec.exchange)'s status on Saturday, 17-Oct-2026 09:16:53 JST Fritz Adalis

     in reply to

     • ../kajer/.
     • Ryan Castellucci (they/them) :nonbinary_flag:
     • grey

     @ryanc @Viss @kajer @grey
     Dunno if 'respect the users' has been a ha goal for a while.