Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Haier hits Home Assistant plugin dev with takedown notice

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 172 posts

Re: Haier hits Home Assistant plugin dev with takedown notice

#41

Post by jameshilliard »

I noticed a potential licensing issue Home Assistant may have when it comes to relying only on an external package source host like pypi and complying with a plugin takedown request.

If home-assistant receives a GPL source code request(for example due to many of the python libraries in the home-assistant docker images being GPL licensed) wouldn’t the source code to all library dependencies(including the source for historical dependencies like any plugin taken down after a release) need to be provided for 3 years(due to the combined home-assistant application effectively falling under GPL requirements) from the date of last distribution of the home-assistant docker image?

Re: Haier hits Home Assistant plugin dev with takedown notice

#42

Post by plagiarist »

pc86 wrote: post #32
agilob wrote: post #5

>"Specifically, the plug-ins are using our services in an unauthorized manner, which is causing significant economic harm to our Company." Except lots of people wouldn't buy your shit if not for the addon.

It should be a requirement that companies include a good-faith estimate of actual economic damages in a DMCA, or an excellent reason why they cannot come up with such an estimate, and if there is a lawsuit stemming from this later be on the hook for those estimates actually being in good faith and not just "let's assume everyone in the country would have bought our dehumidifer if not for this GitHub repo existing ...…

I don't think anyone should have to estimate damages for DMCA. Damages are not an issue, it's still your copyright.

Instead, this seems like a completely bullshit copyright claim. That's what the ideal fix should be.

There's zero incentive to not do DMCA takedown notices, what are the consequences of getting it wrong? It's a great tool to intimidate anyone doing something you don't like. Haier has a legal team, this developer has nobody.

Re: Haier hits Home Assistant plugin dev with takedown notice

#43

Post by kube-system »

supergeek133 wrote: post #27
stefan_ wrote: post #25

Earlier quoted context omitted.

Why would the cybersecurity freak out at that, that seems opposite. The company owning the data (and controls!) is much more of a risk.

Don't ask me to explain the mindset of your average "tool runner" cybersecurity person. I've long advocated a local HTTP interface for our products, but usually a losing battle.

>local HTTP interface

A lot of the worst IoT vulnerabilities in the past have been due to exactly that. 'Local' unfortunately isn't something decided at design time, it's decided when someone connects it to a network. Most people plugging these devices in don't have any clue how to simultaneously secure them and connect them to the internet, so they often end up directly on the internet with default credentials or with outdated vulnerable software and a port open. That's the biggest reason all of the major players now just close all inbound ports and reach outbound to a cloud service. It checks both boxes of usability and network security with even the most misguided user.

Yes, this arrangement sucks for people who know better. But we aren't the people in the user stories.

Re: Haier hits Home Assistant plugin dev with takedown notice

#45

Post by supergeek133 »

kube-system wrote: post #43
supergeek133 wrote: post #27

Earlier quoted context omitted.

Don't ask me to explain the mindset of your average "tool runner" cybersecurity person. I've long advocated a local HTTP interface for our products, but usually a losing battle.

>local HTTP interface A lot of the worst IoT vulnerabilities in the past have been due to exactly that. 'Local' unfortunately isn't something decided at design time, it's decided when someone connects it to a network. Most people plugging these devices in don't have any clue how to simultaneously secure them and connect them to the internet, so they often end up directly on the internet with default credentials or wi…

Even though I advocate for a local interface, I also completely agree with your statement.

But, the alternative is we either accept this completely upside down API traffic ratio with locally focused integrations (bad, costs lots of money) or allow a local interface.

Another potential workaround I advocated for was a "cloud down" message that could enable the local interface for those that ONLY go looking for how to do it.

Re: Haier hits Home Assistant plugin dev with takedown notice

#46

Post by supergeek133 »

nostrademons wrote: post #40
supergeek133 wrote: post #20

Earlier quoted context omitted.

Home Assistant users are small minority of many of these companies user bases (including ours), and these integrations being locally focused often poll HEAVILY causing an upside down ratio in API traffic compared to all other users. The solution is to allow local interfaces (matter, HTTP, etc) but most company cybersecurity teams just freak out at this. Oh, and the reason we don't have a full time team managing HA is…

Hah, the staff on Assistant working on home integrations measured in the hundreds (I used to work adjacent to those teams). Of course most of them were either laid off or reassigned to other projects, so it's pretty likely that Assistant will stop working soon, if it hasn't already.

It takes a lot more to deal with/manage these integrations than some on HN ever realize, especially when these stories come up.

Re: Haier hits Home Assistant plugin dev with takedown notice

#47

Post by hunter2_ »

agilob wrote: post #12
smolder wrote: post #10

This is like suing somebody for using chopsticks to eat a meal you sold them. Where is the financial damage? Do they sell their own automation products? Even if that's the case, and they're fork-sellers on the side in my analogy, there's absolutely no good to come from suppressing these plugins.

>Where is the financial damage? They offered API that they don't want people to use. Maintaining APIs and uptime costs, but they only wanted their API to be used by their apps that collect data about you.

> They offered API that they don't want people to use.

I wonder how this would play out if instead of serving responses for nonhuman consumption (i.e., an API), it was serving responses for human consumption (i.e, HTML documents). In that scenario, if a subset of requests were of a high-frequency nonhuman nature (i.e., polling and scraping), would a court find it equally abusive or materially different?

Re: Haier hits Home Assistant plugin dev with takedown notice

#48

Post by agilob »

hunter2_ wrote: post #47
agilob wrote: post #12

Earlier quoted context omitted.

>Where is the financial damage? They offered API that they don't want people to use. Maintaining APIs and uptime costs, but they only wanted their API to be used by their apps that collect data about you.

> They offered API that they don't want people to use. I wonder how this would play out if instead of serving responses for nonhuman consumption (i.e., an API), it was serving responses for human consumption (i.e, HTML documents). In that scenario, if a subset of requests were of a high-frequency nonhuman nature (i.e., polling and scraping), would a court find it equally abusive or materially different?

HTLM documents evolve much more frequently and there were dozens of HA addons that simply gave up updating their regexes extracting certain information from HTML and emails.
Post reply on HN