Is this project dead?

General discussion about RuneAudio. Do not post any support or feature requests here.

Is this project dead?

Postby SlF » 11 Apr 2017, 12:17

Hey,

I know that some people won't like this sort of post, but is runeaudio dead? No progress for years.
Maybe there is some new fork? Just wondering if there will be an update soon and if I can help.

Greetz
SlF
 
Posts: 30
Joined: 29 Sep 2015, 14:09
Location: Germany

Re: Is this project dead?

Postby °pdi° » 11 Apr 2017, 13:19

User avatar
°pdi°
 
Posts: 19
Joined: 11 Oct 2015, 15:59
Location: Germany

Re: Is this project dead?

Postby samberry » 12 Apr 2017, 09:07

samberry
 
Posts: 1
Joined: 12 Apr 2017, 09:04
Location: Australia

Re: Is this project dead?

Postby SlF » 18 Apr 2017, 22:17



Why didn't I see this?

It must be a bit hidden.

Great!!!
SlF
 
Posts: 30
Joined: 29 Sep 2015, 14:09
Location: Germany

Re: Is this project dead?

Postby WillCourney » 17 Jan 2018, 11:34

There are so many forks here. Why did you ask it? There a lot of interesting and useful info on others pages, just seek it better! Have a good day!
User avatar
WillCourney
 
Posts: 1
Joined: 17 Jan 2018, 10:34
Location: USA, Indiana, Indianapolis

Re: Is this project dead?

Postby janui » 17 Jan 2018, 14:28

Additionally:
User avatar
janui
 
Posts: 682
Joined: 20 Dec 2014, 12:55
Location: Ollanda

Re: Is this project dead?

Postby ACX » 21 Jan 2018, 12:34

Hello, please take a look at this post.
User avatar
ACX
RuneAudio co-founder
 
Posts: 1685
Joined: 29 Nov 2013, 02:25
Location: Udine, Italy

Re: Is this project dead?

Postby waves » 22 Jan 2018, 16:41

The versions of RuneAudio on the official downloads page have known unpatched vulnerabilities such as the KRACK wpa2 vulnerability. By default those downloads also come with SSH enabled and a default username/password printed on the public site. There are newer inofficial/beta versions and instructions for updates scattered throughout the forum, but the documentation page doesn't say anything about that.

Shouldn't a notice be put on the downloads/documentation pages that the versions there are end of life and not receiving security updates?

Edit: There is more. In recent weeks there has been news about exploits against localhost/LAN services through DNS rebinding methods by malicious sites through a LAN users browser.See for example this Ars Technica piece
https://arstechnica.com/information-tec ... -computer/

AFAICT RuneAudio could also be vulnerable to such attacks. What could happen? Well for a start an attacker (or their automatic scripts) could access the /dev page and change stuff. Since RuneAudio has no feature for password restricting access to only some LAN devices. But the gap in updates to RuneAudio also increases the risk that there are unpatched vulnerabilities in Arch, PHP, javascript etc that a DNS rebind attacker could exploit through as a second step.
waves
 
Posts: 125
Joined: 31 Dec 2014, 10:33

Re: Is this project dead?

Postby gearhead » 12 Feb 2018, 15:56

Ditto. I mean no disrespect either, but in the era of web cameras being hijacked for nefarious purposes, security should be a concern as well as audio capabilities and a well designed UI and system.

My hope is that the current development, which we have been anxiously awaiting for 4 years, unseen by any but a chosen few will address security as well as update concerns along with UI and system improvements.

As for Arch updates, it says somewhere in the Arch docs that piecemeal updating of the system is not supported or encouraged. I believe that the packages and their prerequisites as well as a pacman.conf line or 2 may help alleviate this problem. I'm willing to help if asked.

Gearhead
gearhead
 
Posts: 101
Joined: 25 Nov 2014, 06:04

Re: Is this project dead?

Postby waves » 22 Feb 2018, 11:13

Another DNS rebinding vulnerability against an application with a localhost webserver. This time the utorrent bittorrent client. https://arstechnica.com/information-tec ... downloads/ As I described above it looks like RuneAudio is vulnerable to the same basic method of access.
waves
 
Posts: 125
Joined: 31 Dec 2014, 10:33

support RuneAudio Donate with PayPal

Next

Return to General discussion

Who is online

Users browsing this forum: No registered users and 1 guest