Live data from Hacker News

Haier hits Home Assistant plugin dev with takedown notice

bleepingcomputer.com

81–90 of 172 posts

Re: Haier hits Home Assistant plugin dev with takedown notice

#81
post #37

Earlier quoted context omitted.

You can also still use the Hue hub. It accepts local http requests for all functionality.

Aren't they removing that?

I haven't heard anything about that - but, if you have disallowed it from accessing the internet, it can't update to remove any features.

Re: Haier hits Home Assistant plugin dev with takedown notice

#82
post #71
post #3

I wish there would be an appliance manufacturer that would actually hire developers to create and maintain Home Assistant.

Ubiquiti did that[1], didn't work out so well[2]. 1. https://www.home-assistant.io/blog/2018/04/12/ubiquiti-and-h... 2. https://www.home-assistant.io/blog/2019/05/03/update-from-th...

According to your [2], it did work out well though?

Re: Haier hits Home Assistant plugin dev with takedown notice

#83
post #72
post #49

The takedown notice says that the "plug-ins are in violation of the terms of service". This is super odd. So what would happen if I never bought their product and hosted this repo - while not being a party to the terms of service?

Probably this: https://github.com/Andre0512/pyhOn/blob/main/pyhon/const.py

Sounds like the company could just invalidate that API key and break the integration themselves whenever they want.

Re: Haier hits Home Assistant plugin dev with takedown notice

#84
post #71

Earlier quoted context omitted.

Ubiquiti did that[1], didn't work out so well[2]. 1. https://www.home-assistant.io/blog/2018/04/12/ubiquiti-and-h... 2. https://www.home-assistant.io/blog/2019/05/03/update-from-th...

According to your [2], it did work out well though?

An employment ended by the employer in less than a year because the employer "changed their plan" (according to the former employee) doesn't look like a success to me.

Re: Haier hits Home Assistant plugin dev with takedown notice

#85
post #84

Earlier quoted context omitted.

According to your [2], it did work out well though?

An employment ended by the employer in less than a year because the employer "changed their plan" (according to the former employee) doesn't look like a success to me.

The article literally says:

    Last year Ubiquiti Networks hired me, Paulus Schoutsen, the founder of Home
    Assistant, to work full time on improving Home Assistant. This has really helped the
    project make big leaps towards getting to 1.0. During this time, Home Assistant added
    an authentication system, the concept of devices and areas, a UI for configuring
    integrations, and the new Lovelace UI, just to name a few things.
... along with:

    We left on friendly terms and I want to thank Ubiquiti for this tremendous
    opportunity, it has given the Home Assistant project a significant boost.
Sounds like it moved the project forward in good ways that wouldn't have happened otherwise.

Personally, I'd call that a win. :)

Re: Haier hits Home Assistant plugin dev with takedown notice

#86
post #37

Earlier quoted context omitted.

You can also still use the Hue hub. It accepts local http requests for all functionality.

Aren't they removing that?

No, they're just enforcing that everyone must have an account to use the Hue app. But big parts of the whole Hue ecosystem depend on local access, so it's out of the question that they'd remove it.

Re: Haier hits Home Assistant plugin dev with takedown notice

#87

Earlier quoted context omitted.

Don't ask me to explain the mindset of your average "tool runner" cybersecurity person. I've long advocated a local HTTP interface for our products, but usually a losing battle.

>local HTTP interface A lot of the worst IoT vulnerabilities in the past have been due to exactly that. 'Local' unfortunately isn't something decided at design time, it's decided when someone connects it to a network. Most people plugging these devices in don't have any clue how to simultaneously secure them and connect them to the internet, so they often end up directly on the internet with default credentials or wi…

> 'Local' unfortunately isn't something decided at design time, it's decided when someone connects it to a network.

It's obviously connected to the public internet when it talks to cloud servers, and that's somehow (claimed to be) secure.

Comparing a good cloud API with a poorly designed local API is a false dichotomy. Would you set up your cloud servers with default credentials of admin:admin?

Have a hidden physical switch that toggles local control, and require a physical button press to (re-)generate secure credentials. Have the user upload TLS certificates (non-optional), then hand over the credentials over a secure connection. There, the security of local API should now be up to par with the cloud connection.

Re: Haier hits Home Assistant plugin dev with takedown notice

#88
This is very good news.

I extensively use HA and buy (and build) various smart stuff so now I know I blacklist Haier. Good thing they released the request.

I will share this news with the HA networks I am active in.

Thank you Haier for being proactive and help me to (not) choose!

Re: Haier hits Home Assistant plugin dev with takedown notice

#89
post #72
post #49

The takedown notice says that the "plug-ins are in violation of the terms of service". This is super odd. So what would happen if I never bought their product and hosted this repo - while not being a party to the terms of service?

Probably this: https://github.com/Andre0512/pyhOn/blob/main/pyhon/const.py

Initially I had the same thought: I'm not using their services, how can I break TOS? But this explains it. If a device cannot be controlled locally and need their cloud connection to work, it's in a high risk of becoming e-waste at some point of time. That's why I would never pick such devices.

Re: Haier hits Home Assistant plugin dev with takedown notice

#90
post #77
post #23

Earlier quoted context omitted.

If you fork it, do a proper git clone and git push. Github can and has DMCAed direct forks in the past.

This doesn't appear to be a DMCA takedown request, so I doubt Github would care. This appears to be the company contacting the developer directly to ask that they withdraw the code.

because a company asking for a takedown would never file a takedown request afterwards?
Post reply on HN