This is not a Bluetooth issue. The chip manufacturer Airoha just felt it acceptable to ship a wireless debug interface that allows reading the SoC memory with no authentication whatsoever, enabled in retail customer builds. They are just not a serious company (which is why their security email didn't work, either).

Wireless 'JTAG'! The Dream :)

Now that's a premium product if I've ever seen one.

Pretty sure modern apple watch has wireless "Jtag", so yeah.

I mean, most companies have security last on their budget list.

It tells more about human nature than about a company.

This can only be fixed systemically by huge fines and/or imprisonment. Otherwise the temptation of taking the risk to neglect security is too strong.

> part of me has always known that bluetooth is just hacks on hacks… I allowed myself to be persuaded due to popularity. Scary.

Is it scary? Bluetooth is wildly convenient, and mostly works most of the time. There are definite software issues, and there are security issues, but for most of us, we're not going to run into them that often. (Well, ok - maybe not for most of the people on this site.)

I'm going to continue using my bluetooth headphones, because the odds of a nefarious hacker with a linux laptop attacking me directly are wildly low. In terms of security, my time & money would be better spent buying a steering0-wheel-lock-bar for my car, or a mechanical timer that will turn the lights on & off in my house randomly at night.

I don't know, it seems a little telling that you need this much technology just to beat a wire.

Not really when more and more phones lack audio jacks.

I find Bluetooth to be a the least reliable technology I use.

Sometimes plugging a cord is a minor inconvenience.

But sometimes it's a large inconvenience

Example: if I'm using my laptop for work but at a slightly longer distance (think, using external monitor/keyboard) then it gets annoying (cord has to hang from the connection, or it gets between you and the keyboard, etc)

I listen to podcasts while doing chores. When I used to use wired earbuds, they would regularly take a bath in the sink water as I moved around.

You can't read English like if it was a declarative logical language. It is obviously an hyperbole to say "everyone". It means "a lot of people". So why they didn't say "a lot of people"? Language uses hyperboles to make a point stronger.

Some people use hyperbole to make a point, and some people see this as a red flag, and causes them to lose trust.

It comes up enough that I am comfortable saying that it feels like “everyone” to the OpenBSD devs.

https://news.ycombinator.com/item?id=25950845

https://news.ycombinator.com/item?id=45798439

https://news.ycombinator.com/item?id=34667522

https://news.ycombinator.com/item?id=43144607

Honestly, can't we just ditch BT and send audio over WiFi?

One thing less to worry about.

"Just use wifi for headphones"

and

"One less thing to worry about"

These are not compatible statements. :)

WiFi is nowhere near as low energy as Bluetooth is.

If you think wireless headphones are insecure today, I very much doubt connecting them directly to the internet would improve the situation.

AFAIK Wifi Direct has quite wide hardware support -- https://en.wikipedia.org/wiki/Wi-Fi_Direct. But few people know about it?

WiFi does not necessarily mean it's connected to the internet.

and enjoy your precious 1 hour of listening time.

The whole tcp/ip, wifi stack is at least a magnitude more complex than bluetooth one, and the wifi radio generally consumes more power.

Qualcomm kind of does this with their XPAN extension, sends the audio over local network. I believe it's mostly a proprietary solution though, so I haven't seen any serious attempts to re-implement it yet.

That exists, using proprietary 2.4ghz dongles usually, but they’re much higher power draw.

And roughly zero security.