Volumio security is an oxymoron.
But the fact that Volumio can no longer make SSL connections to a large fraction of the websites in the world (because its CA-certificate bundle hasn’t been updated since 2014) is a functionality problem, in addition to being a security problem.
Can you share some links that don’t work because of outdated CAs?
That way we’ll at least update CAs and verify, while we finalize buster works
thanks
Volumio, this should not be the only think you look at. If you want the product to survive you need to be up to date security wise as well.
One of you selling points is actually a product that can be used safely, else your customer base will disappear with the first cases of abuse.
There’s no real competition though. Nobody else provides a player that can play tidal etc, nor a plugin system. I don’t recomend volumio to anyone that’s not comfortable with managing old linux systems by hand, and possibly some insight into javascript as well. It is what it is, and I’m happy it exists.
As for what they should be focusing on I do believe it’s their choice to make. A rewrite of the software to be pluggable in a standard linux distrubution and use concurrency / promises properly would be my tip.
there is buster and al guys are working hard on it …buster…
@volumio @prof i have the same thing switch over to 3.10 beta …
the 2.xx will screw up your whole network …i called my isp they said it’s in your network everything by them
seems alright so i tested 3x 2.xx versions all the same effect in a few minutes you can’t use your browser any more all pages will time out…even skype will crash, dns errors port 443 issue at github even total los of my internet connection ect .but everytime i switch off volumio it came back in seconds…
and asking for site that don’t work is a stupid thing dump the whole 2.xx i won’t use it any more…
@dvo,
Could you check if it’s a problem with your network settings? First thing I would check for is address conflicts… Do you happen to have devices configured with static IP that happen to conflict with Volumio’s?
nope i had no conflict in my network …all dhcp… and i have it only on 2.xx the 3.xx work ok…
so the cert. is screwing my network i guess reset the whole network checking cables ect …
then i switched off volumio and all came back normal…
Outdated CA cert bundles should only affect Volumio itself and only when it tries to make requests through SSL. This should not affect other devices on the network (you mentioned total loss of Internet connection - I take this to mean other devices could not access the Internet when Volumio 2.x has joined the network?)
it does … believe me… all went oway…pc , laptop internet connection total on all
only skype on my mobile was still running ,skype desktop went oway …all searching and find none
dns errors most of the pages timed out… amazon youtube ect all gone…
and now on 3.10, 3.14, 3.15 no problems at all still going strong 
Stick with 3.x then. No point in going back
i will buster all the way 
tested 3 images of 2.xx to if it came back…
and it did… slowly you lose your total connection…on everything…
If I’m gonna reflash the SD card, instead of wasting my time with a beta release, I’ll reflash it to moOde 7.0.0, which is based on RaspiOS 10.7, Linux Kernel 5.4.77 and MPD 0.22.3.
As I said upthread, one of my three RPi players has already been converted to moOde. Eventually, I will get fed up and the other two will follow.
where on 3.15 now but have to rewire and test before release but i get you with lak of power
behind it all we having to catch up… to long on a old bike with wooden wheels and now they have
to run…the guys behind are doing a great job but a little to late…this should be a lesson learned…
we need a good manager who knows how to arrange it all …
don’t hesitate to join the team of volunteers, seems you know what problems we have and we would really like to hear your answers to the old wheels 
Important: make sure this keeps the basic Volumio software free of charge for everyone
@gkkpch
gkkpch, i’m already helping a lot testing buster and in the youtube2 testing in the back ground,
and trying to add my 2cents to it all…
How did you solve this problem?
I encountered the same problem 
wget https://plugins.volumio.workers.dev/pluginsv2/download/radio_paradise/1.0.3/volumio/buster/amd64
–2022-11-17 13:38:11-- https://plugins.volumio.workers.dev/pluginsv2/download/radio_paradise/1.0.3/volumio/buster/amd64
Resolving plugins.volumio.workers.dev (plugins.volumio.workers.dev)… 188.114.96.1, 188.114.97.1, 2a06:98c1:3121::1, …
Connecting to plugins.volumio.workers.dev (plugins.volumio.workers.dev)|188.114.96.1|:443… connected.
GnuTLS: Error in the pull function.
Unable to establish SSL connection.
@volumio Please help with this problem
