104
Security audits of Home Assistant
(www.home-assistant.io)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 23 Oct 2023
104 points (100.0% liked)
homeassistant
11921 readers
39 users here now
Home Assistant is open source home automation that puts local control and privacy first. Powered by a worldwide community of tinkerers and DIY enthusiasts. Perfect to run on a Raspberry Pi or a local server. Available for free at home-assistant.io
founded 1 year ago
MODERATORS
This is really awesome — open source allows for auditing. Not great that there are vulnerabilities, but these vulnerabilities also exist (and possibly more) in closed source software that doesn’t get audited to be fixed, just exploited. Hopefully these get patched soon!
There are always vulnerabilities. Any vulnerabilities we find are cause to celebrate because they get fixed.
Article says all were patched in 2023-09 release!
Ah thank you, I should’ve read more closely :)
I agree that Home Assistant's audit is a good thing. While I love that Home Assistant is open source, I'm not sure how that impacts the audit. Proprietary, closed source software can be audited with few differences from an open source software's audit. The biggest difference is that you, myself, or anyone could audit open source software, but it would not be easy for that to happen with closed source software.
Sure, but closed source audits aren’t often made public. So we don’t know when, or how, closed source software is audited. Beyond just our ability to self audit open source, we often get better reporting on the contracted audits performed on open source software.
It's easier to find something like XSS or auth bypass when you can read the code