Project ideas from Hacker News discussions.

Hackers Got Inside a Flock Camera

📝 Discussion Summary (Click to expand)

1. Inadequate security & outdated software
- “The kernel is ancient! Linux version 3.18.71-perf-gaf770dc” – fullstop
- “The oldest supported kernel is 5.10 and that loses support in December. That's wild they are using a 3.X kernel” – datakan
- “3.18.71-perf-gaf770dc is a Qualcomm Android vendor kernel from roughly late 2017. The 3.18 branch went fully EOL in 2019…” – incee
- “Security through obsolescence!” – samudrijan
- “There are levels to defending against physical attacks, and Flock half-assed theirs by leaving the encryption key right on the file system…” – overfeed
- “Even the cheapest, oldest least powerful SoC from 15 years ago can manage AES‑CBC via crypto accelerator at 50 MiB/s. There's no excuse.” – megous

2. Privacy & mass‑surveillance concerns
- “We constantly hear that the magic of tech funding lies in the people… setting up a tyrannical surveillance matrix all around you … to protect the children, of course.” – tyrabound
- “Flock is a scourge on democracy.” – cucumber3732842
- “Flock cameras capture the make, model, color, and body style of vehicles. They capture bumper stickers and other decals…” – antonvs
- “Getting persistent access to Flock's internal network is a high‑priority item for every US adversary…” – overfeed
- “Axon is Flock but worse… will be the next big fight as police departments are pulling a fast one…” – jordanb

3. Criticism of Y Combinator’s funding & ethics vetting
- “Interesting that they are a YC Company. Does yC do any ethics vetting of saying 'No, let's stop fascism before it spreads?'” – darksim905
- “YC does no meaningful vetting at all. You can steal another YC entrant’s product and still get funded.” – bigfatkitten
- “Flock is a scourge on democracy. Flock is YC. But looks like they did YC nearly ten years ago… I don’t see any evidence that YC is still actively supporting them.” – ohyoutravel
- “It’s not like this stuff wasn’t known to be a problem 10 years ago… It was WAY after that.” – MBCook
- “They won’t have that sort of moment of self reflection until someone does something like use Flock infrastructure to stalk and assassinate the CEO of another YC company…” – Teever

4. Light‑hearted / watchdog‑timer commentary
- “While highly unprofessional, the 'Who's a good boy?!' status message makes me like them a tiny bit more.” – coopaTroopa
- “For those unaware, embedded devices usually have a 'watchdog' timer that needs to be periodically reset… This log message probably indicates when they're resetting the watchdog timer.” – wl
- “I work in a different embedded space but our keepalive heartbeat messages have a payload of <3” – cucumber3732842
- “Man, ours is just '\0'.” – fullspot (referring to the keepalive signal)
- “But will it run Doom?” – stackghost
- “Someone should sell branded black trashbags with a spraypainted penis on them. We'll call it Cock Safety…” – kotaKat


🚀 Project Ideas

FlockWatch: Open‑Source ALPR Security Scanner

Summary

  • Scans local Wi‑Fi and Ethernet for Flock‑branded ALPR devices, reports kernel version, exposed partitions, and whether encryption keys are readable.
  • Gives citizens and auditors a quick way to spot insecure surveillance hardware before it is abused.

Details

Key Value
Target Audience Privacy advocates, municipal auditors, security researchers
Core Feature Network discovery + firmware/partition inspection + key exposure detection
Tech Stack Python (scapy, netifields), OpenWrt SDK for firmware parsing, optional CLI/GUI (Electron)
Difficulty Medium
Monetization Hobby

Notes

  • HN users complained about “ancient kernel 3.18” and keys left on the filesystem – FlockWatch would surface exactly those findings (see fullstop: “The kernel is ancient!”).
  • Provides concrete data for discussions about police‑department procurement and can trigger FOIA requests for device inventories.

SafePlate: Privacy‑First Edge ALPR Processor

Summary

  • A drop‑in SBC‑based module that performs license‑plate recognition locally, blurs faces, encrypts only plate/timestamp data, and securely deletes raw images.
  • Built with TPM, secure boot, and encrypted storage to prevent the “Who’s a good boy?!”‑style logging and data leakage.

Details

Key Value
Target Audience Police departments, traffic‑management contractors, city planners
Core Feature On‑device ANPR with privacy‑preserving output (plate only) and tamper‑resistant hardware
Tech Stack Raspberry Pi Compute Module 4 + TPM 2.0, TensorFlow Lite for plate detection, Linux 5.10+, LUKS + systemd‑cryptsetup, Rust for daemon
Difficulty High
Monetization Revenue‑ready: $150 per unit + $20/yr firmware‑support subscription

Notes

  • Commenters urged “encrypt the media partition” and noted that current devices “store keys on the filesystem” (overfeed, fulllstop). SafePlate addresses this directly.
  • Enables a technical counter‑point in debates about surveillance vs. privacy, giving agencies a verifiable, auditable alternative.

ALPRTransparency Portal

Summary

  • A web service where residents can submit automated FOIA requests to local law‑enforcement agencies for ALPR logs, track responses, and visualize aggregation of retained data.
  • Includes a template request generator and a public dashboard showing compliance rates and data‑retention violations.

Details

Key Value
Target Audience Citizens, civil‑rights NGOs, journalists
Core Feature FOIA request automation + response tracking + public transparency dashboard
Tech Stack React frontend, Node.js/Express backend, PostgreSQL, AWS SES for email, DocAPI for FOIA submission
Difficulty Low
Monetization Hobby (grant‑funded) or Revenue‑ready: $5k/yr for premium API access for newsrooms

Notes

  • Many HN threads called for oversight: “The real danger … is the aggregate data” (FrustratedMonky). This portal gives communities a way to audit that aggregate data.
  • Generates discussion on data‑retention policies and can be cited in policy‑change campaigns.

FlockGuard: Managed Secure ALPR‑as‑a‑Service

Summary

  • Provides municipalities with hardened ALPR cameras (encrypted storage, regular signed firmware updates, remote attestation) plus a cloud‑based management console with role‑based access controls and immutable audit logs.
  • Shifts liability from cash‑strapped towns to a vetted security‑focused vendor.

Details

Key Value
Target Audience City governments, county sheriffs, public‑works departments
Core Feature Secure ALPR hardware + centralized management with compliance reporting
Tech Stack Custom hardware (RK3588 SoC + TPM + encrypted eMMC), Yocto Linux, Docker‑based edge services, Kubernetes‑managed backend, Grafana/Prometheus for auditing
Difficulty High
Monetization Revenue‑ready: $8 per camera per month (includes hardware lease, firmware updates, SLA)

Notes

  • HN commenters lamented that “Flock is a scourge on democracy” and that cities buy insecure gear because “they don’t have the expertise” (toomuchtodo). FlockGuard offers a turnkey, trustworthy alternative.
  • Provides a concrete business model that addresses the pain point of “no meaningful vetting” of surveillance vendors (bigfatkitten).

Read Later