Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Home Assistant blocked from integrating with Garage Door opener API

home-assistant.io

Post reply on HN
Print view View original

201–210 of 655 posts

Re: Home Assistant blocked from integrating with Garage Door opener API

#201

Post by tuckerman »

twicetwice wrote: post #199
giancarlostoro wrote: post #182

Earlier quoted context omitted.

Why not... just allow HA receive callback events at that point when things change? I feel like this has an easy resolve that doesn't piss off your power user customers, and makes them encourage others to invest in your products, IE power users, and they'll come back because despite being a little extra engineering effort, they were glad you thought of them.

Good suggestion, but where and how does HA receive callbacks? I would guess that almost all HA instances are behind residential LANs and most aren't accessible on the public internet. You could use dynamic DNS and forward ports, but that's flaky, you might run into CGNAT, etc. And anyway, it's best if your HA instance isn't publicly addressable; mine is only accessible over my personal WireGuard VPN and I intend to k…

If you pay for the home assistant cloud subscription (built into HA, ~5 USD/mo) they can provision custom callback URLs for you so you don’t have to expose your HA instance. I have this setup for certain integrations such as Samsung Smart Things.

It’s not a perfect solution since it costs money but it’s a nice alternative to exposing your HA instance or some other front end proxy to the internet.

Re: Home Assistant blocked from integrating with Garage Door opener API

#202

Post by jonwest »

XorNot wrote: post #138
lvh wrote: post #15

Based on my local big box store and garage installer availability, Chamberlain has a de facto monopoly. They also pulled the rug out from under customers: that behavior had been in Home Assistant since 2017, and it's their own recent changes that caused the alleged "DDoS". They say it's to promote official products, but the company previously had a local hub that didn't require their cloud service and discontinued it…

Huh, nice. I went with a dry contact kit from Athom but status feedback is tempting (mine just uses a reed switch to detect state): https://www.athom.tech/blank-1/garage-door-opener-for-esphom...

I use the Athom one also, and putting a reed switch in the fully closed state, as well as in the fully open state allows me to reasonably determine where the door is. Might not be enough for your case, but for me it was enough to know that the door is “kinda open”, or “fully open”, or closed.

Re: Home Assistant blocked from integrating with Garage Door opener API

#203

Post by MadnessASAP »

colinmorelli wrote: post #79
cassianoleal wrote: post #35

Earlier quoted context omitted.

And of course, you can easily run a VPN/Tailscale/ZeroTier/whatever to achieve the same without the downsides.

I'm quite confident my parents and the many people like them in the world would not find running VPN/Tailscale/ZeroTier to be "easy." Nor would they have any idea how to troubleshoot when those services have issues. Nor would they want to play intermediary between Tailscale and myQ customer support to figure out which one is broken and fix it. Having options like this is great for powerusers, but the vast majority of…

My wife doesn't understand what I do on the computer all the time and she's pretty doubtful of my claim that server racks are normal household items. Nevertheless setting up the HA app on her phone with a Wireguard VPN was super simple and she's got a good handle on that.

That being said, setting up the HA and Wireguard server is definitely a more demanding experience. Although once setup it's pretty much a once and done sort of thing, and they're are integrated ready to go solutions available.

It would be nice to see something like "Geek Squad" offering that sort of service instead of just running AV software while trawling for nudes on customer laptops. No guesses on what's more profitable though.

Re: Home Assistant blocked from integrating with Garage Door opener API

#204

Post by ryukafalz »

oskapt wrote: post #128

Something that I don’t see people talking about here is that MyQ is the core/required integration component for Amazon Key in-garage delivery, a service used by millions of people to have their packages delivered to their garages instead of having them stolen off their porch. That’s why it needs Internet access. All the talk about how Chamberlain will go bankrupt because a comparatively small number of tech people st…

> Something that I don’t see people talking about here is that MyQ is the core/required integration component for Amazon Key in-garage delivery, a service used by millions of people to have their packages delivered to their garages instead of having them stolen off their porch.

Would be nice if this functionality could work with arbitrary openers via webhooks. You could even have a fancy auth flow that you trigger from your smart home dashboard so users don't have to know or care how it's implemented under the hood.

Re: Home Assistant blocked from integrating with Garage Door opener API

#205

Post by lvh »

tzs wrote: post #185
lvh wrote: post #15

Based on my local big box store and garage installer availability, Chamberlain has a de facto monopoly. They also pulled the rug out from under customers: that behavior had been in Home Assistant since 2017, and it's their own recent changes that caused the alleged "DDoS". They say it's to promote official products, but the company previously had a local hub that didn't require their cloud service and discontinued it…

> It's unclear if the CTO just doesn't understand that "DDoS" generally implies malice, or if they're intentionally using that language to blame users for using their product. I've definitely seen "DDoS" used when there was no malice, such as when a developer accidentally releases a client that generates way more traffic than it was supposed to. Probably because we don't seem to have a good term for "event that at th…

That's fair. Maybe my security background is shining through here. I guess we used to have "slashdotting" but that doesn't generalize well :)

I did do some napkin math to quantify how much that bad traffic may have been: HA estimates between 6857-25576 intallations of the MyQ integration. Let's say 16k clients. HA makes it really easy to detect and "add" the integration (which counts as an installation even if it's not configured), so, that's definitely not all clients hitting the API. Let's say it's 50%, so 8k actually using it. Most users just notice myQ is broken. Let's say some fraction retry, which would look the same as an extra user from a volume perspective. Call it an even 10k users (including repeat users).

The most recent change is after they broke everything past the OAuth dance. Let's say the OAuth request is 1kB. The retry code retries up to 5 times with exponential backoff. Let's say 5 requests over 10 min.

(5 requests / 10 minutes) * 1 request/user * 10k users = 5k requests/minute, or 83 per second, amounting to 83kB/s inbound.

There's no reason to assume those requests would synchronize, but I'm sure there's something (let's say every single myQ user updated at the same time).

If what they're saying is true, sounds like actually malicious botnet wielders can ransom the living daylights out of them. Given 1Tbs DDoS attacks they'd only need a tiny fraction of the full bore ion cannon! ;-)

[1]: https://github.com/arraylabs/pymyq/blob/master/pymyq/request...

Re: Home Assistant blocked from integrating with Garage Door opener API

#206

Post by jacquesm »

giancarlostoro wrote: post #182
a254613e wrote: post #90

Earlier quoted context omitted.

The main reason why HA accounted for so many requests is probably because it was a polling integration, requesting data every 30 seconds from the server, while the official app either had push events when something changes, or it updated state when the app gets opened.

Why not... just allow HA receive callback events at that point when things change? I feel like this has an easy resolve that doesn't piss off your power user customers, and makes them encourage others to invest in your products, IE power users, and they'll come back because despite being a little extra engineering effort, they were glad you thought of them.

Why not simply allow HA to integrate on site rather than to have to go through some crappy service that likely will not last the lifetime of the doors in the first place?

Re: Home Assistant blocked from integrating with Garage Door opener API

#208

Post by duxup »

BenjiWiebe wrote: post #184
duxup wrote: post #172

Earlier quoted context omitted.

I have the MyQ app (iOS). I don't mind it at all. App works, fairly fast, the stupid extra stuff is just a chunk of the screen I can ignore / don't have to do / interact with. I don't approve of the API situation but the app itself doesn't feel particularly bad.

The iOS app sounds like it's better than the Android one.

What is the Android app like?

Re: Home Assistant blocked from integrating with Garage Door opener API

#209

Post by jacquesm »

lvh wrote: post #15

Based on my local big box store and garage installer availability, Chamberlain has a de facto monopoly. They also pulled the rug out from under customers: that behavior had been in Home Assistant since 2017, and it's their own recent changes that caused the alleged "DDoS". They say it's to promote official products, but the company previously had a local hub that didn't require their cloud service and discontinued it…

I'm happy to not have one of their devices but if they did this after I had installed it based on the fact that it works with HA then I'd definitely sue them for breach of contract or whatever else I can think of or to get a full refund.

What a shit move to pull on your existing customers.

Re: Home Assistant blocked from integrating with Garage Door opener API

#210

Post by jacquesm »

pseg134 wrote: post #155
lvh wrote: post #15

Based on my local big box store and garage installer availability, Chamberlain has a de facto monopoly. They also pulled the rug out from under customers: that behavior had been in Home Assistant since 2017, and it's their own recent changes that caused the alleged "DDoS". They say it's to promote official products, but the company previously had a local hub that didn't require their cloud service and discontinued it…

Can someone post the endpoint it is trying to reach for “research” purposes?

Tsk tsk.
Post reply on HN