JitterJames,
Thank you for elaborating on your thought process behind the design of this UDP broadcast and for your question.
I can certainly see the consideration you put in with having the information being sent to VoxWav or user-created apps. Keeping VoxCommando as bloat-free as possible is safer, more stable, and easier on the developer. No argument there.
TL;DR - To answer your question, I prefer to err on the side of caution. Personally, I don't wish everything I say to VoxCommando be broadcast like that. Especially if I am performing dictation. At home, it isn't much of an issue for now since I can block it with my local firewall. But if I used VoxCommando at work for a productivity enhancer in IT administration, I would have concerns knowing what I know. Considering how some businesses hardcode firewall configuration with policies that prevent user tinkering, my mitigation step wouldn't be applicable. If you want to know more about my motivations or are really bored and want to kill a few more minutes reading this post, please proceed to the paragraphs below.
Before I go any further, I feel like I should put forth a disclaimer. I am a newbie to this forum, a complete stranger, and respectful of people and their efforts. Even though my intentions are benevolent in providing my feedback to any and all who desire it, I always try to tread carefully. The last thing I want is to insult or injure the recipient of said feedback. It is evident that a lot of work has gone into making VoxCommando, its documentation, and the continued support your company offers. I highly respect that and would never want to be perceived as someone who doesn't see the effort you put in or as someone whose expectations can never be fulfilled or as judgmental. Please take what I say as polite, constructive feedback.
The best way that I can answer your question is to present you with an experience I have gone through quite a few times. It will help you understand my thought process. When I was on-boarding a new software platform in a previous corporate position I held, the IT security team of said company was very good about scrutinizing the ins and outs of the software platform to ensure the due diligence was performed by the developer(s) and implementers so that security was not sacrificed for the sake of fancy features or convenience. Now, the IT security team did not go through the source code line by line looking for adherence to secure coding practices but they did examine the obvious behavior of the software platform from the perspective of application security, network security, data security, etc. Being security conscious by nature and leveraging experience from previous positions I have held in my IT career, I had my bases covered and made sure I remediated/mitigated any gaps/issues I could find before the IT security team had a reason to worry. This made the on-boarding of the software platform less painful for all parties involved. You would think what I did was nothing special but I can't tell you how many times I get surprised looks from people when they see me actually working towards my goals with security in mind.
I don't know how many of your customers utilize VoxCommando in a business environment or how important security is to them, so I don't want to speak out of turn here. But, if my past experiences (such as the one described above) have taught me anything is, like the old adage says, an ounce of prevention is worth a pound of cure. Security analysts (the good ones at least) are quite picky about how an application behaves. Today's "oh what harm will that little feature do?" or "it was easier to set it up this way," is tomorrow's hacker/social engineering attack vector. In the setting of a home environment, security may not be at the forefront of the user's mind, but in a corporate environment, it is a different story. With the popularity of home automation and Internet of Things technology, homes will start to become appealing targets to wrong-doers as well.
In the scenario of this specific function of VoxCommando where the user prioritizes security, one could solve it a couple of ways (shown in order of ease).
1. If user is not utilizing VoxWav or another 3rd party application that depends on this UDP broadcast, then the user can configure their local firewall to block the broadcast - I presume that is safe to do.
2. Your suggestion of adding the option to enable/disable that function.
3. The developer could implement secure transmission of the information to prevent eavesdropping.
My intention in this thread is not to challenge the design of VoxCommando. I just ask that you always keep security in mind when designing and implementing functions within VoxCommando.
Thank you for reading this lengthy post.
Sincerely,
MetaCode
