homeassistant

15917 readers

21 users here now

Home Assistant is open source home automation that puts local control and privacy first.
Powered by a worldwide community of tinkerers and DIY enthusiasts.

Home Assistant can be self-installed on ProxMox, Raspberry Pi, or even purchased pre-installed: Home Assistant: Installation

Discussion of Home-Assistant adjacent topics is absolutely fine, within reason.
If you're not sure, DM @GreatAlbatross@feddit.uk

founded 2 years ago

MODERATORS

GreatAlbatross@feddit.uk

greatalbatross@lemmy.world

108

Security audits of Home Assistant (www.home-assistant.io)

submitted 2 years ago by Undearius@lemmy.ca to c/homeassistant@lemmy.world

7 comments fedilink hide all child comments

All reported issues have been addressed as part of Home Assistant 2023.9, released on September 6, 2023

Cure53 found issues in Home Assistant, 3 of which were marked as “critical” severity
The GitHub Security Lab also audited Home Assistant and found six non-critical issues. Two of the issues overlapped with Cure53.
No authentication bypasses have been found

you are viewing a single comment's thread
view the rest of the comments

[–] AliasAKA@lemmy.world 31 points 2 years ago* (last edited 2 years ago) (6 children)

This is really awesome — open source allows for auditing. Not great that there are vulnerabilities, but these vulnerabilities also exist (and possibly more) in closed source software that doesn’t get audited to be fixed, just exploited. Hopefully these get patched soon!

[–] rhymepurple@lemmy.ml 4 points 2 years ago (2 children)

I agree that Home Assistant's audit is a good thing. While I love that Home Assistant is open source, I'm not sure how that impacts the audit. Proprietary, closed source software can be audited with few differences from an open source software's audit. The biggest difference is that you, myself, or anyone could audit open source software, but it would not be easy for that to happen with closed source software.

[–] peter@feddit.uk 1 points 2 years ago

It's easier to find something like XSS or auth bypass when you can read the code

load more comments (1 replies)

load more comments (4 replies)