Hacker News Reader

Comment by takeda | Hacker News Reader

Slightly offtopic, but it's getting harder and harder to get a surveillance equipment that's not connected to "the cloud" all I want is to be in full control of my own data.

I would install Ring if it was closed loop system. Same thing with other technologies to make a smart home. Why so many people (especially the ones that understand technology) seem to be ok with this? This attitude causes that there are less and less options for privacy conscious people.

View on HN

A popular DIY setup: Hikvision cameras & Blue Iris software

Hikvision cameras have the benefit of not being wireless and using Power over Ethernet for people who don't mind running some cable. I think that has a lot of value over a bunch of cameras killing your wifi. Off the shelf cheap routers do poor with a ton of wifi cameras it seems.

Blue Iris can send you mobile alerts without a subscription. All videos are stored locally & it's very configurable.

You could upload alert photos/videos to a cloud provider for cheap off-site hosting if you choose. That way if the bad people destroy your PC you still have video unless they take out your internet. One could setup limited backup internet with a mobile company for this case &/or for when your internet goes out in general. This of course applies equally to Nest/Ring etc.

---

Honestly I'm surprised Ring/Nest/etc still charge for storing video footage. At this point I would have figured they would have found one of countless ways to monopolize off the video footage. Most average people seem to be fine with their data being sold if it provides them some value.

I' also wondering when the first services will start to pop up that provide a marketplace for video footage.

Hikvision is based in China and partially owned by the Chinese state. Not sure if that would be my first choice for surveillance gear.

Keep your cameras on an isolated VLAN with no Internet access. Backdoors are irrelevant if there's no way to get to them.

Or perhaps the separate lan with a Pi providing a bridge. https://www.youtube.com/watch?v=8mHXwmULOvk Set your firewall rules as you like.

Fair & common argument. One would be hard to find electronics without some China influence in their build process though.

Many would suggest to keep your cameras from accessing the internet or anything but your Blue Iris server. This sounds like a fairly common practice.

Agreed that most electronics have China influence. But there’s a pretty big difference between influence and actual state control.

I have no insider info but from reading the news it appears that what China is doing is several levels sketchier than Amazon/Ring when it comes to infringing on civil liberties.

Protecting your self is one thing; supporting that kind of regime with your money is another.

What are your options for local-network-only cameras built in, say EU or North America? I suppose you can go with commercial surveillance cameras but I'm not sure how practical that is for the average home user...

I was in China recently, and the number of surveillance cameras there is bewildering. I suppose when you buy this brand you benefit from cutting edge technology funded by the investment the state has made...

Fascinatingly, China has a mix of public - private infrastructure. E.g. wireless payments are provided by WeChat and AliPay (although in the West it's not much different, it's Visa/MasterCard), and I guess in the US, Amazon is the private side, and the cops are the public side.

It depends heavily on what your threats are and what you are trying to control/prevent. For myself and for most Americans (making a big assumption here I know), the Chinese State is not a serious threat to be concerned about. This due to the fact that they are across an ocean and have close to zero effective physical force projection capability in the US. A greater concern should be domestic criminals (I.E. burglars) or the domestic government because both of those potential threat actors have the capability of using information from a home security system to cause one harm in some way.

They are fundamentally tied into the US economy and are known to effectively share data and behaviour across industries. If you were plausibly competing with a Chinese company and working from home, the question on where the HikVision information goes is a curiousity.

How much does it matter where the hardware was made if it is using local storage? If you are worried about this sort of thing, there is no reason you need to provide routing for the devices outside of your local network (e.g. VLAN). Unlike any hardware relying on cloud services.

Yeah I have to agree with this. If you're savvy enough to setup your own close-looped surveillance system then you're savvy enough to check if the camera is pinging home to a China-based server. And if it is then just block all WAN connections from that IP.

It's a closed loop system.

Looks like they need more customers [1]

"Hikvision is fighting for its survival after the U.S. banned the company in October, accusing it of helping Beijing crack down on Muslim minorities in the far-western region of Xinjiang. "

[1] https://www.bloomberg.com/news/articles/2019-11-13/china-pro...

and they are doing race detecting AI:

https://ipvm.com/reports/hikvision-uyghur

Pretty sure that's the brand I noted in my local McDonalds too. I wondered why there was so much lag to the display, so I checked the brand to look into it later. Dumb of them to write it on the side if they are profiling.

GDPR request here we come...

This.

Unless you monitor the network it is very likely that it is pinging a Chinese server.

Many years ago we bought a treadmill with LCD screen and Android running on it with a browser and other stuff. Connected it to WiFi and were happy.

A couple of years later I got a Ubiquiti edgerouter, configured it and decided to check its deep packet filtering. It started showing me an odd Chinese domain being pinged periodically, like every 5 min. Don't remember the domain but it was some Chinese search engine/portal I had never heard of (not Baidu). It took me a while to figure out that it was the treadmill that was doing this. At which point I had to just disconnect it. I have no idea why it was doing what it was doing and what data it was sending and if I was running a backdoor in my home all this time.

Point I'm trying to make is, don't assume. Mistrust and Verify should be the modern day mantra for Internet connected, especially Chinese, devices.

Not true, though admittedly I had the same fear.

I have a Hikvision NVR and 4k camera setup. I keep them on a separate subnet and have blocked all access to other subnets and the internet via a Mikrotik router.

In the year or so I have had this setup there hasn't been a single packet from the NVR or cameras in an attempt to access the internet.

Is it possible to still get alerts, upload videos to the internet with this setup? Any pointers?

yes and no. its a little work but you could whitelist a domain the NVR can connect to or maybe an IP. Block anything else.

for example: if you want the NVR to upload to Dropbox, you would whitelist the list of domains that are needed for Dropbox to work. if the NVR tries to connect to 'heartbeat.hikvsn.cn' it would fail.

I don't have the above mentioned cameras, but I do have cameras that are completely blocked from the internet.

The way I do it is: When I leave my home my home assistant will enable the FTP upload on motion detection feature of the camera. If there's motion then the camera will upload the recording to a ftp server running locally (synology), this then gets synced to google drive.

Home assistant can also do push notifications if there's movement detected.

Put the cameras on their own VLAN with no internet access. My Hikvisions are scraped by Zoneminder. Home Assistant completes the setup, behind HA Proxy for a bit more protection.

My setup is perhaps a bit gilt edged but then I am a sysadmin and networks bod and PHB all in one odd package! Home IT needs to step up its game. If you get done over then the cost can be very high. I don't think it is sufficient to simply use your ISP provided router, plug in a few IoT thingies and download a few phone apps and stick your fingers in your ears and chant la-la-la.

I would hope that most of the inhabitants of this parish are capable of putting together a reasonably safe setup and also look after their less technical friends and family (it can be a thankless task but a I think it is a duty.)

Don't forget that your attic, garage or cellar may make good places to keep IT gear in but do consider heat, cold, dust and fire risks.

I had some issues with ZM so ended up going with Shinobi, they are pretty new to the FOSS security system space but so far I'm liking it a lot.

Ta for the heads up. I'm always on the look out for stuff sigh Freshmeat.

ZM isn't perfect but it has been around for a very long time. Would you mind sharing your reasons for dumping ZM and why Shinobi cured them?

I'm diving in here: https://shinobi.video/docs/

Ubiquity cameras should be ok. Fortinet as well without having to get expensive with Arecont.

Are there some other cheap but reliable PoE cameras?

You can use blink XT2 cameras from Amazon to store free video clips

> Why so many people (especially the ones that understand technology) seem to be ok with this?

Because there are no viable alternative devices. It's now impossible to buy a non-smart TV because smart TVs were cheaper (due to surveillance-funded subsidies).

The next best thing would probably be open-source firmware installed on these consumer device, paired with a self-hosted home-assistant.io

At least with a smart TV it's often quite practical to just not connect it to the internet. If your camera won't function at all without a network, it's not that useful.

It's probably only a matter of time before household appliances, like cars, connect to cell networks to exfiltrate data about you.

Lol, like years ago.

https://www.scmagazine.com/home/security-news/iot/modern-aut...

Hence the drive for 5G

I recently looked into getting a simple camera for the balcony: mostly for creating a time lapse of the plants that are growing there.

The majority of the options out there were connected to some kind of "cloud" service. I was even more surprised when I saw that a lot of popular options mandated a cloud subscription with no local storage. There is no need whatsoever to have any of this on the cloud at all. Especially with multiple hundreds of gigabytes of SD storage being so cheap these days.

In the end I went with a cheap Chinese camera which has unofficial open source firmware available (Dafang). Works like a charm.

If you look into power over ethernet surveillance cameras there are lots of options that are standalone devices not associated with any specific cloud service. You then have to get some software that can receive the stream from the camera and do something with it (records, motion detection, etc.). It's not nearly as plug and play as going with something like Ring, but I also think that's expected when you are wanting something that gives the user more control.

Raspberry Pis + cheap USB webcams or the camera module would work. (The official Pi Zero case has an optional faceplate with a cutout for the camera, so it can all go in one box.) There are existing software packages that can start taking pictures and run scripts when motion is detected.

Software like motioneye (motion detection) doesn't work on Rpi as it needs a lot of CPU (my experience).

I agree. It’s flaky at best. Not one to rely on which is kind of a necessity for a security product.

passthrough recording uses hardware acceleration on pee

Works fine on my rpi zero w cams, I have a bunch of them in use, they've proven very reliable:

   PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND                                     

   437 cam       20   0  120072  23352  15156 S 12.8  6.2  41:56.21 motion
  3417 regusr    20   0    8128   3272   2748 R  1.6  0.9   0:00.55 top                                         
    37 root       1 -19       0      0      0 S  0.6  0.0   1:39.16 vchiq-slot/0                                
   191 cam       20   0   59000  20040   9852 S  0.6  5.3   2:04.44 meyectl                                     
  2334 tun       20   0    9180   4948   4404 S  0.3  1.3   0:00.97 ssh                                         
  3398 regusr    20   0   11512   3780   3036 S  0.3  1.0   0:00.11 sshd                                        
  3404 root      20   0       0      0      0 I  0.3  0.0   0:00.09 kworker/u2:1                                
  3418 root      20   0       0      0      0 I  0.3  0.0   0:00.04 kworker/0:2

Same here - I run a Pi Zero W with motioncam and it works absolutely fine, and has been for a couple years at this point.

I set one up with R pi before.

Use the ubuntu "motion" package and record pic/video when motion is detected.

Use some python script to auto upload new files to google drive. I can use any google drive sw in ios/android to view pictures in some folder. The folder can be shared with family members can be view remotely. Kinda fun project.

Works ok - But it used a lot space. Have to actively manage share folder.

I am looking for similar setup for quite a few of old android phones laying around. Plan to write one myself when I have time....

If anyone know a good solution with old android phone HW + G Drive, please share.

While it is still kinda connected to the cloud, I finally installed a security camera thanks to Apple HomeKit Secure Video. All of the processing is done on my HomePod or Apple TV and stored in my iCloud encrypted. If marketing is to be believed, Apple themselves cannot un-encrypt it.

Its not perfect, but I feel mostly safe having this camera now.

What about Axis Cameras? (https://www.axis.com/en-us/products/network-cameras) expensive but run some POE cable and you can own everything.

I got 3 Axis cameras, they are great. Luckily they were gifted to me as it would have run me several thousand dollars to purchase myself.

Do you need it to contact your phone and show the video in real time? I think that's the big value prospect here for many users and why they need the cloud - it intermediates between the phone app and the home system.

If not, there are some guides on YouTube (unfortunately I can't search right now on this corporate network) that involve buying old laptop cameras on ebay and stringing them up with putty to an old laptop in a closet. I'm pretty sure the man in the video I'm thinking of was from the UK since the prices were in pounds, but there would be others. It all looked fairly simple but I can't recall how sophisticated the software was re: motion detection, offsite contact, etc.

There really isn't any other option but to persuade enough people to be privacy conscious that we end up with public policy that enforces it.

Otherwise, it's gonna be like GMail -- sure, you can run your own mail server, but 80+% of humanity will decide that they can't or have better things to do, and Google will end up with all the email between you and them anyway.

You can make your own smart home camera, but 80+% of the world will install Ring or something similar, and that means you will be on their camera footage and therefore your comings and goings will be part of Amazon/SurveillanceCo (absent consistent deployment of effective countermeasures).

I've been considering a Ubiquiti UniFi Protect set up since it seems to have minimal requirements for cloud connectivity.

This is what I use. Eight cameras with an on-premise NVR (Cloudkey Gen2 Plus). Works great.

Yeah, I've used the same with no issues - I don't think it has very good options for offsite backups [0] though if that link is any indication. "use rsync" is a great suggestion for this site, but not quite as great for the average users.

0: https://help.ubnt.com/hc/en-us/articles/235404507-UniFi-Vide...

I'm weird. I like the data staying local, but the UI being something continually updated and improved on. You navigate to a website to enjoy a real-time updated UI, that pulls data from the local network. The local hardware just primitively collects footage and that small responsibility is something I can trust in a form of 'separation of concerns'. It would be neat to extend this further where the company behind the product distributes the codebase for this webapp that you can run locally if you choose.

IMHO the market is too small and is very price-conscious, so they'll just do it themselves if you try any margin. And you'll need the margin because the consumer who wants this is willing to put up with some error rate on things they build but not on things they buy. So they might say "Oh yeah, when the full power goes out, I have to reset it, but that almost never happens" or "Yeah, I have to type in my Google API key every two weeks but that's okay since it's only $k".

Essentially, the same people who care about this are also likely to say "you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem" to Dropbox.

If you do succeed building and selling this I'll be very impressed.

Lots of people are trying the local storage thing, though: (not customizable store-to-my-S3 stuff, but I think that's a vanishingly small market)

* https://www.indiegogo.com/projects/vacos-cam-smartest-ai-wir...

* https://www.indiegogo.com/projects/wuuk-the-world-s-most-adv...

* https://www.indiegogo.com/projects/imilab-ec2-your-life-free...

* https://www.indiegogo.com/projects/camect-world-s-smartest-m...

* https://www.indiegogo.com/projects/capsulecam-home-security-...

* https://www.indiegogo.com/projects/simcam-an-unparalleled-ai...

I also encountered this rather big hole in the market. I was looking for a home security system that worked on a local private network with no outside comms, but that apparently doesn't exist. I ended up going with Abode without cameras or their monitoring service (self-monitored), but I'm still not 100% happy with that, since they still store all of your data in the cloud and have permission to disarm your home and so are then an attack vector I'd like to avoid.

I've thought about this a lot and have quite a notebook full of ideas/notes on this: I think there's room in the market for a privacy-focused open-source home security system utilizing micro-controllers (Raspberry Pi, Arduino, Adafruit, etc.) and secure cryptographic protocols. You could make revenue assembling pre-built security sensors built from the micro-controller ecosystem, perhaps with good modern aesthetics, but the more security conscious of us could buy and build everything ourselves based on the spec for each sensor.

What are you looking for in a security system? We run both system-in-a-box sets of closed circuit cameras as well as fully controlled webcams. Are you looking for some UI or auto-alarming aspect? (e.g. face detection? threat detection?)

How would you keep the footage secure? There is zero point in cameras if the HD's can just be carried off, a decent safe will cost > $1000 and be ugly as all hell.

Wherever you want. That's the great thing about owning your own data.

Just because the data flows to somewhere you control doesn’t mean it has to be local.

I mean we’re firmly in hobbiest/semi-pro territory here but shipping the data encrypted to your own cloud instance or box colo’d in a local data center would be fine.

I use an older Sharx camera (I hope the newer ones still have the same features).

It supports all the usual cloud and remote access junk, but fortunately none of it is necessary for operation.

It does motion detection internally and only records when something happens in the frame. Most importantly, it support ftp uploading these event recordings to a configurable server.

I put it on a physically separate network which has nearly nothing else and certainly no internet connectivity in any direction (I see the camera attempting to contact google DNS every now and then). I would never trust any of these cameras, regardless of manufacturer, with internet access no matter how limited.

The only other thing on that network is a box which exposes only ftp, so the camera uploads activity to it.

Optionally, from a physically separate network you can then pull the videos to some other host which has internet access and upload them elsewhere for remote safekeeping.

But yes, it is sad that one needs to know how to set this up just to preserve basic privacy.

> Why so many people (especially the ones that understand technology) seem to be ok with this?

Ignorance and convenience. Most people I know who own one and are aware of the privacy issues choose to ignore them because they're easy to install and just work. Then there are people who don't know or don't care (ignorant).

It baffles me there's no (popular?) end-to-end cloud based encrypted camera system yet. If you want images/video clips in push notifications I suppose that couldn't be encrypted, but otherwise it seems like the best of both worlds.

Apple's HomeKit Camera claims to provide just that.

Cloud services are so much more profitable that a single purchase item cannot compete.

The indiegogo funded camect is pitched as a private 'cloud optional' recorder. The beta unit I have is cloud connected but the final release has the option to be fully local. It has a lot of neat features like identifying people/ups trucks/cars/etc.

It only has a webbased client, but I kind of like it and the beta version has been way better than any of the cheap dvr trash that big box stores sell.

https://www.indiegogo.com/projects/camect-world-s-smartest-m...

It was always hard to have a fully on premise surveillance system. It’s expensive and complicated to install. That hasn’t changed. What changed is that now it’s easy and cheap to have cloud surveillance systems

I've been thinking it would be great to start a company that would create devices that customers owned, you know: make and sell things.

I think the problem is if someone makes open hardware and software that people like and doesn't "lock them into your ecosystem / cloud", then another company can clone and sell the same thing with no R&D overhead to recoup. It's even easier and cheaper for a company completely based in china to do it. So it is risky for companies to do that.

I would love to hear of counter-arguments and counter-examples.

I like the idea of open hardware/software with end-to-end encrypted cloud services that are compelling enough to be a competitive advantage.

Home Assistant Cloud is one example of this: https://www.nabucasa.com/

https://www.adafruit.com/product/3414 + https://github.com/ccrisan/motioneye

I have some RLC-420 cameras that work pretty good and I block their access to the internet ... and they copy the files using ftp to my local server ... on the other hand, I just got a Chromecast and I'm looking for a way to block them from accessing any Google servers.

UniFi gear remains optionally self-hosted. It does have the option of cloud login, but you can opt to not use that, using a self-hosted NVR and SDN controller.

Almost all high-end gear (Axis, etc.) is also easily self-hostable but obviously expensive since it's high-end.

https://www.amazon.com/sticker-eye No monthly subscription fee. On chip AI and so on. Not sure how good they are.

Reply on news.ycombinator.com