Comment by mattferderer | Hacker News Reader

Comment by mattferderer | Hacker News Reader

Parent Full thread

A popular DIY setup: Hikvision cameras & Blue Iris software

Hikvision cameras have the benefit of not being wireless and using Power over Ethernet for people who don't mind running some cable. I think that has a lot of value over a bunch of cameras killing your wifi. Off the shelf cheap routers do poor with a ton of wifi cameras it seems.

Blue Iris can send you mobile alerts without a subscription. All videos are stored locally & it's very configurable.

You could upload alert photos/videos to a cloud provider for cheap off-site hosting if you choose. That way if the bad people destroy your PC you still have video unless they take out your internet. One could setup limited backup internet with a mobile company for this case &/or for when your internet goes out in general. This of course applies equally to Nest/Ring etc.

---

Honestly I'm surprised Ring/Nest/etc still charge for storing video footage. At this point I would have figured they would have found one of countless ways to monopolize off the video footage. Most average people seem to be fine with their data being sold if it provides them some value.

I' also wondering when the first services will start to pop up that provide a marketplace for video footage.

Hikvision is based in China and partially owned by the Chinese state. Not sure if that would be my first choice for surveillance gear.

Keep your cameras on an isolated VLAN with no Internet access. Backdoors are irrelevant if there's no way to get to them.

Or perhaps the separate lan with a Pi providing a bridge. https://www.youtube.com/watch?v=8mHXwmULOvk Set your firewall rules as you like.

Fair & common argument. One would be hard to find electronics without some China influence in their build process though.

Many would suggest to keep your cameras from accessing the internet or anything but your Blue Iris server. This sounds like a fairly common practice.

Agreed that most electronics have China influence. But there’s a pretty big difference between influence and actual state control.

I have no insider info but from reading the news it appears that what China is doing is several levels sketchier than Amazon/Ring when it comes to infringing on civil liberties.

Protecting your self is one thing; supporting that kind of regime with your money is another.

What are your options for local-network-only cameras built in, say EU or North America? I suppose you can go with commercial surveillance cameras but I'm not sure how practical that is for the average home user...

I was in China recently, and the number of surveillance cameras there is bewildering. I suppose when you buy this brand you benefit from cutting edge technology funded by the investment the state has made...

Fascinatingly, China has a mix of public - private infrastructure. E.g. wireless payments are provided by WeChat and AliPay (although in the West it's not much different, it's Visa/MasterCard), and I guess in the US, Amazon is the private side, and the cops are the public side.

It depends heavily on what your threats are and what you are trying to control/prevent. For myself and for most Americans (making a big assumption here I know), the Chinese State is not a serious threat to be concerned about. This due to the fact that they are across an ocean and have close to zero effective physical force projection capability in the US. A greater concern should be domestic criminals (I.E. burglars) or the domestic government because both of those potential threat actors have the capability of using information from a home security system to cause one harm in some way.

They are fundamentally tied into the US economy and are known to effectively share data and behaviour across industries. If you were plausibly competing with a Chinese company and working from home, the question on where the HikVision information goes is a curiousity.

How much does it matter where the hardware was made if it is using local storage? If you are worried about this sort of thing, there is no reason you need to provide routing for the devices outside of your local network (e.g. VLAN). Unlike any hardware relying on cloud services.

Yeah I have to agree with this. If you're savvy enough to setup your own close-looped surveillance system then you're savvy enough to check if the camera is pinging home to a China-based server. And if it is then just block all WAN connections from that IP.

It's a closed loop system.

Looks like they need more customers [1]

"Hikvision is fighting for its survival after the U.S. banned the company in October, accusing it of helping Beijing crack down on Muslim minorities in the far-western region of Xinjiang. "

[1] https://www.bloomberg.com/news/articles/2019-11-13/china-pro...

and they are doing race detecting AI:

https://ipvm.com/reports/hikvision-uyghur

Pretty sure that's the brand I noted in my local McDonalds too. I wondered why there was so much lag to the display, so I checked the brand to look into it later. Dumb of them to write it on the side if they are profiling.

GDPR request here we come...

This.

Unless you monitor the network it is very likely that it is pinging a Chinese server.

Many years ago we bought a treadmill with LCD screen and Android running on it with a browser and other stuff. Connected it to WiFi and were happy.

A couple of years later I got a Ubiquiti edgerouter, configured it and decided to check its deep packet filtering. It started showing me an odd Chinese domain being pinged periodically, like every 5 min. Don't remember the domain but it was some Chinese search engine/portal I had never heard of (not Baidu). It took me a while to figure out that it was the treadmill that was doing this. At which point I had to just disconnect it. I have no idea why it was doing what it was doing and what data it was sending and if I was running a backdoor in my home all this time.

Point I'm trying to make is, don't assume. Mistrust and Verify should be the modern day mantra for Internet connected, especially Chinese, devices.

Not true, though admittedly I had the same fear.

I have a Hikvision NVR and 4k camera setup. I keep them on a separate subnet and have blocked all access to other subnets and the internet via a Mikrotik router.

In the year or so I have had this setup there hasn't been a single packet from the NVR or cameras in an attempt to access the internet.

Is it possible to still get alerts, upload videos to the internet with this setup? Any pointers?

yes and no. its a little work but you could whitelist a domain the NVR can connect to or maybe an IP. Block anything else.

for example: if you want the NVR to upload to Dropbox, you would whitelist the list of domains that are needed for Dropbox to work. if the NVR tries to connect to 'heartbeat.hikvsn.cn' it would fail.

I don't have the above mentioned cameras, but I do have cameras that are completely blocked from the internet.

The way I do it is: When I leave my home my home assistant will enable the FTP upload on motion detection feature of the camera. If there's motion then the camera will upload the recording to a ftp server running locally (synology), this then gets synced to google drive.

Home assistant can also do push notifications if there's movement detected.

Put the cameras on their own VLAN with no internet access. My Hikvisions are scraped by Zoneminder. Home Assistant completes the setup, behind HA Proxy for a bit more protection.

My setup is perhaps a bit gilt edged but then I am a sysadmin and networks bod and PHB all in one odd package! Home IT needs to step up its game. If you get done over then the cost can be very high. I don't think it is sufficient to simply use your ISP provided router, plug in a few IoT thingies and download a few phone apps and stick your fingers in your ears and chant la-la-la.

I would hope that most of the inhabitants of this parish are capable of putting together a reasonably safe setup and also look after their less technical friends and family (it can be a thankless task but a I think it is a duty.)

Don't forget that your attic, garage or cellar may make good places to keep IT gear in but do consider heat, cold, dust and fire risks.

I had some issues with ZM so ended up going with Shinobi, they are pretty new to the FOSS security system space but so far I'm liking it a lot.

Ta for the heads up. I'm always on the look out for stuff sigh Freshmeat.

ZM isn't perfect but it has been around for a very long time. Would you mind sharing your reasons for dumping ZM and why Shinobi cured them?

I'm diving in here: https://shinobi.video/docs/

Are there some other cheap but reliable PoE cameras?

You can use blink XT2 cameras from Amazon to store free video clips

Ubiquity cameras should be ok. Fortinet as well without having to get expensive with Arecont.

Reply on news.ycombinator.com