Hacker News Reader

Geovision has had a ton of security incidents. Perhaps they're easy to set up, but they definitely aren't secure.

You shouldn't expose any of these cameras, high end or low end, to the internet. You shouldn't even trust them on the same VLAN as the rest of you computers or phones. That mitigates security issues.

To echo: In small installs I don’t give the cameras a default gateway and put a NIC (physical or virtual) in-subnet with the cameras. Nothing else goes in the subnet.

In larger installs it’s a VRF dedicated to the camera subnets and a similar dedicated NIC arrangement on the server.

Nothing should talk to the cameras except the recording server they’re streaming to.

And you should consider that the ethernet endpoint of each camera may be accessible, perhaps with only limited physical breakage, and provide an entry point onto the network. Having each device on its own /30 is one way to do that, with routing restricted to talking to the server, or you might have a private VLAN feature on your switch. You can have multicast from the cameras go to other devices though.

Annoyingly, few TVs have multicast receivers, it's all Chromecast etc, so you need your own computers to decode and display.

Reply on news.ycombinator.com