Comment by dijit | Hacker News Reader

Comment by dijit | Hacker News Reader

Parent Full thread

And everyone got mad at OpenBSD for refusing to develop bluetooth.

It’s a messy standard and we shouldn’t be surprised that the race to the bottom has left some major gaps.. though Sony WH1000’s are premium tier hardware and they have no real excuses..

I always wondered how people could justify the growth of the bluetooth headphone market in such a way.. Everyone seems to use bluetooth headphones exclusively (in Sweden at least), I’m guilty of buying into it too (I own both Airpods Pro’s and the affected Sony WH1000-XM5) but part of me has always known that bluetooth is just hacks on hacks… I allowed myself to be persuaded due to popularity. Scary.

I was also trying to debug bluetooth “glitching audio” issues and tried to figure out signal strength as the first troubleshooting step: I discovered that people don’t even expose signal strength anymore… the introspection into what’s happening extends literally nowhere, including not showing signal strength… truly, the whole thing is cursed and I’m shocked it works for the masses the way it does.. can you imagine not displaying wifi signal strength?

This is not a Bluetooth issue. The chip manufacturer Airoha just felt it acceptable to ship a wireless debug interface that allows reading the SoC memory with no authentication whatsoever, enabled in retail customer builds. They are just not a serious company (which is why their security email didn't work, either).

Wireless 'JTAG'! The Dream :)

Now that's a premium product if I've ever seen one.

Pretty sure modern apple watch has wireless "Jtag", so yeah.

I mean, most companies have security last on their budget list.

It tells more about human nature than about a company.

This can only be fixed systemically by huge fines and/or imprisonment. Otherwise the temptation of taking the risk to neglect security is too strong.

> part of me has always known that bluetooth is just hacks on hacks… I allowed myself to be persuaded due to popularity. Scary.

Is it scary? Bluetooth is wildly convenient, and mostly works most of the time. There are definite software issues, and there are security issues, but for most of us, we're not going to run into them that often. (Well, ok - maybe not for most of the people on this site.)

I'm going to continue using my bluetooth headphones, because the odds of a nefarious hacker with a linux laptop attacking me directly are wildly low. In terms of security, my time & money would be better spent buying a steering0-wheel-lock-bar for my car, or a mechanical timer that will turn the lights on & off in my house randomly at night.

I don't know, it seems a little telling that you need this much technology just to beat a wire.

Not really when more and more phones lack audio jacks.

I find Bluetooth to be a the least reliable technology I use.

Sometimes plugging a cord is a minor inconvenience.

But sometimes it's a large inconvenience

Example: if I'm using my laptop for work but at a slightly longer distance (think, using external monitor/keyboard) then it gets annoying (cord has to hang from the connection, or it gets between you and the keyboard, etc)

I listen to podcasts while doing chores. When I used to use wired earbuds, they would regularly take a bath in the sink water as I moved around.

Some of us kept using OpenBSD (longer than they should’ve?) because of that and a few other related decisions.

So who is everyone, in your meaning?

You can't read English like if it was a declarative logical language. It is obviously an hyperbole to say "everyone". It means "a lot of people". So why they didn't say "a lot of people"? Language uses hyperboles to make a point stronger.

Some people use hyperbole to make a point, and some people see this as a red flag, and causes them to lose trust.

It comes up enough that I am comfortable saying that it feels like “everyone” to the OpenBSD devs.

https://news.ycombinator.com/item?id=25950845

https://news.ycombinator.com/item?id=45798439

https://news.ycombinator.com/item?id=34667522

https://news.ycombinator.com/item?id=43144607

Honestly, can't we just ditch BT and send audio over WiFi?

One thing less to worry about.

"Just use wifi for headphones"

and

"One less thing to worry about"

These are not compatible statements. :)

WiFi is nowhere near as low energy as Bluetooth is.

If you think wireless headphones are insecure today, I very much doubt connecting them directly to the internet would improve the situation.

AFAIK Wifi Direct has quite wide hardware support -- https://en.wikipedia.org/wiki/Wi-Fi_Direct. But few people know about it?

WiFi does not necessarily mean it's connected to the internet.

and enjoy your precious 1 hour of listening time.

The whole tcp/ip, wifi stack is at least a magnitude more complex than bluetooth one, and the wifi radio generally consumes more power.

Qualcomm kind of does this with their XPAN extension, sends the audio over local network. I believe it's mostly a proprietary solution though, so I haven't seen any serious attempts to re-implement it yet.

That exists, using proprietary 2.4ghz dongles usually, but they’re much higher power draw.

And roughly zero security.

> And everyone got mad at OpenBSD for refusing to develop bluetooth.

Alright, so when is OpenBSD patching out USB support? Such a giant exploit vector.

Reply on news.ycombinator.com