Just release the src code

[rtfmkiesel]

Stop toying around with open-source development. In the interest of security and usability, release the code now and not when the repo has N stars. This behavior is embarrassing for FOSS development.

My points:

• Security: Given your track record on the regular NanoKVM, document ALL features of your devices. For example, I would like to have documentation on the events/commands
  • READ_MY_HID_DATA
  • GET_PARA_CFG
  • SET_PARA_CFG
  • GET_USB_STRING
  • SET_USB_STRING
• Usability: I have a non-english keyboard and need to be able to adjust the keyboard commands, as special keys currently do not work for me. Reversing your app.asar should not be necessary.

[WarmWelcome]

I came here to look for the assurance that this isn't some rubber ducky disguised as a sysadmin tool, and found a github page with no src. How can we expect to trust a hardware device like this from a company with questionable security practices and reputation? That's easy. Give us the tools we need to see if we should. The irony of this being listed on github without actually being open is palpable.

I have been looking for a reasonable crash cart adapter for over 3 years now, and was hoping that this may be the day that I can finally get my hands on one. Oh well, maybe some other day. If it becomes fully open, then that day may be close.

[Zepan]

Hi, the NanoKVM-USB is an offline USB peripheral device, which inherently poses no security risks.
This repository is primarily used for collecting user feedback and bug reports, as evidenced by the issues raised by other users.

We are more than willing to release the code earlier, if users approach us with genuine technical inquiries and constructive discussions.
However, if individuals fueled by bias and conspiracy theories demand that we open-source the code under the guise of "security concerns," we will not entertain such requests.
Their goal is not truly about "security" or "open-source" principles, but rather the thrill of online bully.

When it comes to networked IP KVMs, they may have some grounds to raise questions, but to extend such skepticism to an offline USB KVM is unreasonable. What’s next? Endless baseless accusations? We will not be swayed by such tactics.

[WarmWelcome]

Hi, the NanoKVM-USB is an offline USB peripheral device, which inherently poses no security risks.

Offline USB devices can absolutely pose security risks. Here are just a few that easily demonstrate that fact:
https://docs.hak5.org/hak5-usb-rubber-ducky
https://usbkill.com/
https://www.hackmod.de/en/p/inputstick-usb

This repository is primarily used for collecting user feedback and bug reports, as evidenced by the issues raised by other users.

Please modify the readme to state this as being the case. How is everyone is supposed to assume that this is for issues and feedback only by the fact that a select few people have posted issues?

We are more than willing to release the code earlier, if users approach us with genuine technical inquiries and constructive discussions.
However, if individuals fueled by bias and conspiracy theories demand that we open-source the code under the guise of "security concerns," we will not entertain such requests.
Their goal is not truly about "security" or "open-source" principles, but rather the thrill of online bully.

...So what you're saying is that you're going to delay the release of the code because people are asking for the release of that code? That makes no sense, sorry. Could you explain in better terms what you mean to do here by delaying the release of the code that would prove that this project is indeed secure?

Our requests for posting the source code for security reasons isn't based on "bias and conspiracy theories" but on legitimate concerns, given that you and another collaborator have acknowledged several potential security issues and flaws (your statement), as well as outright ignoring security issues (collaborator statement).

If you won't share the code openly, at least have the decency not to dismiss our legitimate concerns with accusations of bullying and conspiracy. Stating that those who ask for the source code are conspiracy theorists is not only misguided, but also incredibly dismissive of valid concerns. And to state that these requests for open source are bullying throws out constructive conversation and trust. Shutting people down with this language and these labels is not appropriate. When legitimate concerns about security are dismissed as mere conspiracy theories or bullying, trust evaporates. Trust isn't built by name calling and labeling people with concerns as bullies, but by addressing those concerns.

[rtfmkiesel]

I'm not one for pointless discussion about conspiracy theories. I would just like the source code to a device I own, if the manufacturer intends to share the code anyway. This (usually) includes documentation about its features.

• As I said in the original comment, I need to adjust the keymap. This is the main reason I want to take a look at the source code for the serial connection. (Both on the microcontroller and the web interface)
• Also, I already added a USB jiggler button to my web interface, which is a neat feature I think others should benefit from too.

Personally, @WarmWelcome, I think it is a bit far-fetched calling this a rubber-ducky like device without any hard evidence. In that case, you would have to call every keyboard manufactured in insert bad country here a backdoored device, too. The only way to trigger this would be by either a random interval, or via a specific serial command issued through USB. Since the web interface part is completely usable offline and actually does not make any outside connection. (see the image below), it's hard to believe the manufacturer has a way of remotely talking to those devices.