We discuss recent Home Assistant security news, and how we think the project could improve.

Plus a bunch of follow up, emails, and more!

Note: This episode was recorded before the recent second Home Assistant vulnerability

Sponsored By:

• Linode: Receive a $100 60-day credit towards your new account. Promo Code: linode.com/ssh
• CloudFree.shop: CloudFree Smart Plug – Runs Tasmota for $9. Use code SELFHOSTED and support the show. Promo Code: SELFHOSTED
• A Cloud Guru: Looking to make a high-paying career move into the cloud? Get going: acloudguru.com

Support Self-Hosted

Links:

• Security Bulletin 1- Home Assistant — It has come to our attention that certain custom integrations have security issues and could potentially leak sensitive information.
• Security Disclosure 2: vulnerabilities in custom integrations HACS, Font Awesome and others - Home Assistant — . The conclusion is that some custom integrations are still vulnerable to a directory traversal attack while not being authenticated with Home Assistant. It allows an attacker to access any file without having to log in. This access includes any credentials that you might have stored to allow Home Assistant to access other services.