I bought some awful light bulbs so you don't have to

It's just yet another nail in the firewall's coffin. I cringe now when I read security people still talking about them as a first or really any meaningful line of defense.

I believe that at this point in time any network traversal should be considered an ultrahazardous activity. As most networks are beyond the control of the users and have little to no change control, it makes little sense to apply risk mitigation controls to them. When you consider the fact that users demand their information be available at all times, it makes much more sense, from a risk mitigation perspective, to focus on the elements you do have a semblance of control over -- the endpoints where the sensitive data is stored and processed and the protocols by which they communicate. There are well known and trusted means of securing data in transit. There is no excuse for relying on policy for mitigation where your policy can have no effect.

I agree that defense in depth is a good idea, but one key factor to consider is cost. Having a basic firewall makes sense, if for no reason other than “documenting” your public services in one place, but many places are either lulled into a sense of complacency or spend inordinate amounts of time managing tons of rules trying to segregate internal hosts, update for every new network app, etc.

It's that latter group which really needs to hear the truth that they should invest in endpoint security instead unless they have a high security threat and enough resources to do both.

You don't need a firewall on individual machines either; just don't run network-facing services in the first place.

At most, as a belt-and-braces security measure, you might want a system-wide prohibition preventing programs from listening on non-localhost (with exceptions for intentional servers, which should almost never happen on a client system). But that prohibition should primarily exist to catch programs misconfigured to listen on non-localhost, rather than leaving those programs running and just using a firewall to block them.

Good idea. A lot of high end routers have an option for a "guest network" these days. Or just invest in a cheapo access point just for IoT devices.

If your systems have a local firewall, services are jailed, OS is patched, etc. then direct access to it is not dangerous.

Somewhere we decided to accept crap system and device security as normal because oh we'll just firewall it. That was never a good idea but the more cloud connected things we deploy it becomes completely untenable.

Large corporate networks are already hostile territory due to BYOD. The only way to maintain the firewall as anything other than security theater is to lock everything down so much that nobody can get anything done.

The whole approach is braindead. We don't see how stupid it is because it's grandfathered in.

Haven't read TFA yet, but I think you're expecting too much from your firewall here. These bulbs are hosts, and they're inside the perimeter. They have been hacked, so they send malicious traffic to other inside hosts. What the hell is a firewall going to do about that?

I wasn't proposing illegal activity. I was in an obscure way, pointing out how badly insecure devices are actually a double threat. They are a threat in their own right, but they are also a threat in that you can't assume they haven't been tampered with.

I didn't down vote your comment or anything; but I think the general idea is to add to the conversation. Short quips generally turn gray... the rest of the thread under mine is mostly discussions of security options/concerns in regards to firewalls and networks.

This is correct, if you want to use these for mood lighting you probably also want RGB+saturation as the effect will be much nice. For a cheap bulb that can be controlled programatically these are great though.

Do you have any details of the outgoing network access, as I couldn't find anything?

You can also remove the wifi part, and communicate with the bridge via serial:

https://servernetworktech.com/2014/09/limitlessled-wifi-brid...

It's a heck of a lot easier to swap out a bulb than a switch.

There are modules like this: http://aeotec.com/z-wave-in-wall-switches/170-micro-smart-ap... that work with hubs like wink or smarthings, but home electrical wiring isn't consistent, so the installation isn't like the 1-2-3 easy setup you get from something like Hue.

Others have chimed in on the ease of bulb installation VS ease of switch installation. One other point is that the most you can get from a remote switch-only installation is variance in brightness, no RGB control.

Ah, cool. I think they added the rules API later, otherwise I could well have done that. That's in some ways better; last year when my router died, my lights stuck on.

For what it's worth, I avoided tying the lights to actual daylight hours. In winter I tend to get a bit gloomy, and so part of my goal was to make my brain think that it was never really winter. It seemed to help this winter, although it's hard to say for sure.

How are you liking your setup?