Most CCTV contractors are not network security experts.

Most network security experts would quit before ever entering a hot attic.

So Cletus the CCTV guy who just spent 8 hours crawling through drop ceilings with a mask on, does a super-clean install, and sets it up as well as he knows how. Which is "good enough" — it works and he's off to the next job. The customer's happy and he gets paid.

Now which one of you network security guys is going to give up his cushy WFH job to go make house calls for CCTV wages?

I worked for a small, local ISP in the mid 2000s. I don't think I made any stupid mistakes on my part, but I had plenty of coworkers who did. To be fair, people were often actively hostile to security concerns back then. It's not much better now, but at least not everything gets a public IP by default.

Personally, I'm not a security expert. I've worked in web for near 20 years, on some reasonably large network projects so I've picked up things here and there, but I still defer to our actual security experts when we roll things out

That said, I'm not 100% convinced I could set up a webcam streaming online without accidentally exposing it to the wider internet. Maybe 95% sure? But if even I couldn't guarantee it, what chance does your average joe who mostly only uses his computer for netflix have?

pfffa haha, i don't drink instant coffee and am not religious, therefore am intellectually god like compared to <insert group i'm objectifying today>

[dead]

Many consumer routers allow any connected device to configure port forwarding using UPnP. If you want, you can play around with this using a client such as miniupnpc's example client.

Is your ISP doing CGNAT? At least in the US that's not the norm. Most people have publicly routable IPv4 addresses (even if they rotate somewhat frequently) and most routers are configured to support UPnP out of the box.

This is an example of everything working as intended. The cameras are supposed to be accessable when you're not at home. Of course the cameras ought to ship with randomized default auth on a sticker attached to the unit the same way any half decent router does these days but they don't.

UPnP is not disabled by default on all routers, especially older ones. So devices may just try to port-forward certain control or media ports.

These are cameras sold specifically to be available over the open internet, I guess.

You'll be surprised by the number of people who thinks if you leave your internet door unlocked then your internet belongings are free to take. There is someone in this very thread arguing that having an internet enable camera in your home turns your home into a public place.

It is also funny, and depressing that many of the same people who think might makes right on the internet ends up lamenting how fucked up life is in their low trust societies, when their mindset is exactly what makes a high trust society — you know, the ones where people don't lock doors — impossible.

No.

This isn’t a passive “walked by the window” thing that you might have unwittingly viewed. To actively search for open cameras by crawling every IP then creating a tool to see them, then choosing to watch the footage is a very active, deliberate choice. No one is viewing this footage without making a multi-step choice to view it.

Everything is a bad analogy, because the internet has something like 6 billion of us on it these days.

We evolved for small tribes, e.g. Dunbar's number is ~150. Roughly 1/129 of the people on the internet are software developers, so in the days of everyone living in villages your in-group would include roughly one person who thinks like we think.

"Inadvertently live-streaming to the 1/129 of the world who consider searches like this to be trivial, with zero feedback unless you found your home accidentally went viral" is not like anything we otherwise experience.

If anything, projecting onto a nearby sidewalk as you describe is more like "I was bathing after my day's work scribing for the king and wouldn't you know it, that 𒈗𒍠𒄀𒋛 living by the temple decided to walk right in and say hi! Doesn't even think to knock, just opened my front door and walked right in.", while the closest thing you can find to accidental live webcams in old writing is gods spying on mortals for fun, making us the Anansi, the Loki, the Eshu. And for the furries, the Coyote.

No, it really isn't...

Not really? It’s just like not closing your blinds and being shocked that people on the street can see you.

Unless that camera uses UPnP and has no auth configured by default.