Conversation
MQTT shipped in v3.4.0 with nowhere to connect: a broker had to be set in patternflow_secrets.h, which meant standing up a server before the feature did anything. Simone runs one for exactly this and confirmed the terms today, so it ships. The host and login move out of the gitignored secrets header and into net_config.h as published defaults. That is the honest place for them: they are in every release image either way, and hiding them in the ignored file would only keep them from the people reading the source. The reason this is sound rather than reckless is the scope, and it is his: "the MQTT broker data can be currently shared with other users as the broker is secured and allows just the patternflow topic to be read/written". The account reaches one topic. Publishing it costs its owner a topic, not a broker. That sentence is quoted in net_config.h so the next person to find a password in public source has the answer beside it. Nothing dials on its own. The role lives in NVS and starts at Off, so this arms the option rather than the radio. The credential scan still refuses a real leak — the control build, which does have secrets, comes back with the Wi-Fi SSID, Wi-Fi password and OSC host all LEAKED and both placeholders missing. The MQTT values now read `public` there instead of `LEAKED`, which is the classification working: it asks whether a value also appears in public source, and now they do. Patch rather than minor: the feature was already in v3.4.0 and this fills in a default. The number moves at all because bin/v3.4.0/ is published and a version-stamped path is never overwritten. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MQTT shipped in v3.4.0 with nowhere to connect: a broker had to be set in
patternflow_secrets.h, which meant standing up a server before the feature did anything. @SimonePDA runs one for exactly this and confirmed the terms today, so it ships.The host and login move out of the gitignored secrets header into
net_config.has published defaults. That is the honest place for them — they are in every release image either way, and hiding them in the ignored file would only keep them from the people reading the source.What makes this sound rather than reckless is the scope, and it is his:
The account reaches one topic. Publishing it costs its owner a topic, not a broker. That sentence is quoted in
net_config.hso the next person to find a password in public source has the answer sitting beside it.Nothing dials on its own — the role lives in NVS and starts at
ROLE_OFF, so this arms the option rather than the radio.The credential scan still refuses a real leak
PF_WIFI_SSID/PF_WIFI_PASSPF_OSC_REMOTE_HOSTPF_MQTT_*YOUR_WIFI_*placeholdersThe MQTT values read
publicin both now instead ofLEAKED— that is the classification working, not weakening: it asks whether a value also appears in public source, and now they do. Wi-Fi is still caught.Patch rather than minor: the feature was already in v3.4.0 and this fills in a default. The number moves at all because
bin/v3.4.0/is published and a version-stamped path is never overwritten.🤖 Generated with Claude Code