openHAB 2.5.x Patch Releases

[kristofejro (Kris)]

Thanks @dopey.
It was probably CRLF issue.

[Bruce_Osborne]

@Kai

There’s just no way to retrofit it on 2.5.x.

Then why does the Security Policy strongly imply severe vulnerabilities will be fixed? You cannot secure house with front and back doorways but no doors!

[rlkoshak (Rich Koshak)]

@Bruce_Osborne

Then why does the Security Policy strongly imply severe vulnerabilities will be fixed?

It will be fixed, in OH 3.

[Bruce_Osborne]

@rlkoshak

It will be fixed, in OH 3.

Does that satisfy this part of the policy though?

As the currently officially available version is 2.5.x, security patches will be considered for it, depending on their severity

[rlkoshak (Rich Koshak)]

It was considered. “Considered” doesn’t mean “guaranteed”. It doesn’t mean “must be ported.” It doesn’t mean “has to happen.”

[J-N-K (Jan N. Klug)]

Will check that.

[ysc (Yannick Schaus)]

@Kai

Lack of AAA authentication is very severe. Unauthenticated users are free to add, delete, & manage Items, Things, & Rules both through the WebUI and the REST API. If these are not vulnerabilities, then neither is CVE-2020-5242.

I agree, so actually CVE-2020-5242 was probably an over-reaction here as clearly any access to the REST API exposes everything and must not be allowed to unauthorized people. We clearly state so in https://www.openhab.org/docs/installation/security.html#authentication-and-access-control .

The point I think is that the impact of malicious users controlling your things because they have unrestricted access to them can be seen as less severe as having crypto miners or botnet software installed on your machine without your knowledge because the exec add-ons offered easy arbitrary remote command execution as a feature. Hence CVE-2020-5242, and an unusual patch release with an unfortunate breaking change - because the disclosure couldn’t go out without a fix or contingency plan.

[namraccr]

@ysc

This remote code execution vulnerability (CVE-2020-5242 ) involving the exec addons is actually pretty nasty

No it isn’t.

[MDAR (Stuart Hanlon, UK importer of Velbus hardware)]

Isn’t it possible to secure access within Jetty?

http://whitehorseplanet.org/gate/topics/documentation/public/howto_jetty_basic_authentication.html

[wwebers (Wolfram)]

Yes, it is severe when when running OH as root, which some people do. However, it’s great to have a security policy in place.

However, I recommend to have an API-gateway together with an identity management in front of pretty much every API-build-backend. But that’s of course nothing for the ordinary home-user. That’s the reason why IT-security IMHO ends at the front door for most of us.

[namraccr]

@wwebers

Yes, it is severe when when running OH as root, which some people do.

This is akin to claiming it is a severe security issue when someone leaves a pile of cash on their front porch. It isn’t.

[dastrix80 (Kris K)]

If youre leaving cash on the front door, please let me know your address

[wwebers (Wolfram)]

If you say so, sir.

[Axel_Koeneke]

Maybe I’m thinking wrong, but Openhab is primarily a system for a smart house, isn’t it? How many people do you have in your house who have the intent and ability to manipulate your server? I think you should invest more time to make the system more user-friendly than manipulation-proof. Bring a surface that everyone can work with, such as the “Next generation design” project by David. This had so much potential and was destroyed by stupid arguments. Or also important things like the blue tooth binding, which was terribly neglected. Instead, the Tesla binding is celebrated. What are the priorities? If the collaboration and the focus on user-friendly operation do not change soon, then it is not surprising that more and more people choose the iobroker.

[hmerk (Hans-Jörg Merk)]

@Axel_Koeneke

What are the priorities?

This is a community driven project where development is done by volunteers, so there is nothing like priorities. Feel free to contribute to the bluetooth binding to get it ready for usage.
Regarding UI, there is a lot of work going on in preparation for openHAB 3.0, mostly driven by @ysc .

[Axel_Koeneke]

If I had the skills, of course I would like to help. Unfortunately, my programming knowledge is limited to Basic from the C64 and PLC systems such as Simatic S5 or S7. I don’t want to kick anyone on the slip, but I want to point out that many users are waiting for the whole thing to get easier. Or that important things like BT that worked for a long time continue to do so. I don’t want to say more about it.

[rpwong (Russ)]

@Axel_Koeneke

Or also important things like the blue tooth binding, which was terribly neglected. Instead, the Tesla binding is celebrated.

@Axel_Koeneke

Or that important things like BT that worked for a long time continue to do so.

I understand where you’re coming from, but “neglected” and “important” are subjective terms that are specific to your perspective. I get that the Bluetooth binding is important to you, but for others it would be far down the list. You could say that about almost any binding; lots of people use ZWave, and lots of people don’t.

The Bluetooth binding was dormant because a developer no longer had the time and energy to put toward it, and there was no one willing to pick it up until just recently. The bounty system exists specifically so that users who want to spur activity can offer incentives to developers, but I don’t know if anyone offered a reward for it. Also, I’m inclined to think that our developers aren’t motivated by money–they’re motivated by interest. Since a developer is interested in a Tesla binding, there’s work being done on a Tesla binding.

@Axel_Koeneke

I want to point out that many users are waiting for the whole thing to get easier.

I’m not waiting. Sure, there are aspects of openHAB that could be more user-friendly, but in the meantime I’ll work with what’s here. If something’s beyond me at this point in time, I’ll ask for help or put it aside to focus on what I can do.

For users who aren’t willing to adopt this mindset, there are much simpler alternatives like SmartThings available to them. But those users are going to find that the alternatives are far more limiting and have far less potential than openHAB. That’s generally the trade-off.

@Axel_Koeneke

Maybe I’m thinking wrong, but Openhab is primarily a system for a smart house, isn’t it?

For me, it’s about home automation (I personally dislike the current usage of “smart house”…my house will be smart when I don’t have to program every single thing I want to happen). For others, it’s a system that they can deploy at their church, in a storage building, or as an energy-monitoring solution (all scenarios that have been discussed recently). For some of those people, security matters more than making it easier to build rules. And I’d count myself among them.

I think it’s valuable to express your desire for more development time going toward user-friendliness, but I don’t think it’s fair to assume that you represent a majority of users or to be critical of a lack of development on the things you think are important.

Personally, I think the real issue is that we don’t have an army of technical writers and support staff to write/update our documentation, produce training materials, and translate developer-speak into words the rest of us can understand (in multiple languages). If I had more time to give, that’s where I’d put my efforts to improve OH.

[chris (Chris Jackson)]

@Kai

for openHAB 3 authentication&authorization is clearly on the roadmap

@Kai - can you provider a pointer to the roadmap please? The only thing I’m aware of is the OH3 issue board, but that is pretty limited given there are around 130 open issues in the core alone and it would be good to understand what is really planned for OH3.

[Bruce_Osborne]

@chris

it would be good to understand what is really planned for OH3.

I think this is a partial answer.

@hmerk

there is nothing like priorities.

That says to me there is likely no written plan. If there is one only in Kai’s mind that contradicts the statement this is a community project.

[rkrisi (Kristof Rado)]

That’s true, however there are some features (for example as mentioned - the new UI) which are already in the process to bring it with OH 3.
So basically, there are developments which are already in work, but we can’t see them, because they are not public.
Would be great if we could get a list of features (like the UI and authorization) which has a very good chance that it will come with OH 3.