2025-08-20 14:42 UTC
@nullagent@partyon.xyz so just out of curiosity, what's the reasoning behind posting vulnerabilities like this publicly and not doing a responsible/coordinated vulnerability disclosure? After the blog post they made, it was clear you had their attention already.
Just seems a bit hostile towards the users to release such things publicly before allowing for a patch to be made available.
Appreciate your work otherwise. The Meshtastic community has been begging for more eyes on it from security researchers to help harden things up.
Replies (1)
-
@nullagent@partyon.xyz 2025-08-20 21:22
This software, meshtastic, simply does not deliver really any of the security people expect. This is due to fundamental architectural flaws around MAC address as the root of trust. At some point users MUST know these issues exist and to what extent. Finally, the blog from MT indicated that they are NOT taking this architectural deficiency seriously and continue to be evasive. Ffs they attempted to "patch" it using copilot which just introduced more sec regressions.