Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Haier hits Home Assistant plugin dev with takedown notice

bleepingcomputer.com

Post reply on HN
Print view View original

121–130 of 172 posts

Re: Haier hits Home Assistant plugin dev with takedown notice

#121

Post by beeboobaa »

supergeek133 wrote: post #111
asylteltine wrote: post #92

I’m really worried this will become common practice. We MUST fight against this otherwise they will take away open source from us. Making an integration to work with devices you own is NOT ILLEGAL. I’m happy to contribute to a qualified and trustworthy gofundme to protect devs. I myself have a few integrations I made and would refuse to take them down. Granted, I intentionally don’t use any “cloud” api garbage.

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company

Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund.

Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then!

Now also just design an official home assistant module and you've turned this drama into community goodwill.

Re: Haier hits Home Assistant plugin dev with takedown notice

#122

Post by penteract »

nostrademons wrote: post #38
sokoloff wrote: post #26

Earlier quoted context omitted.

At the risk of asking a dumb question, what does a git push do for you there? (Fully agree on the clone locally point.)

It's not marked as a fork in their systems. Instead, it's as if you'd written a bunch of code in a local repository and then pushed it to GitHub. It could still be identified as the same codebase by eg. comparing commit hashes or content hashes, but that's harder. If you really want to be sure, clone the repository, make a few local edits to files (eg. adding a comment to each file), copy the full source repository t…

> It's still technically possible to detect it as a dupe, but would require an extremely expensive shingling or filesystem diff on every repository in GitHub.

Wouldn't a GitHub search still find it pretty easily? As I understand it, they put significant effort into supporting search; but since that's being done anyway, it doesn't have a very high marginal cost.

Re: Haier hits Home Assistant plugin dev with takedown notice

#123

Post by beeboobaa »

DyslexicAtheist wrote: post #100
asylteltine wrote: post #92

I’m really worried this will become common practice. We MUST fight against this otherwise they will take away open source from us. Making an integration to work with devices you own is NOT ILLEGAL. I’m happy to contribute to a qualified and trustworthy gofundme to protect devs. I myself have a few integrations I made and would refuse to take them down. Granted, I intentionally don’t use any “cloud” api garbage.

not only will it be common practice but likely also the law. upcoming legislation in Europe mandates secure-boot for any IoT device sold by 2025 in EU. this and the cybersec resilience act will ensure only firmware shipped and signed by the vendor are able to boot :) ... so your comment is spot-on.

What legalization is that? That's atrocious and only serves to fuck the end user.

Re: Haier hits Home Assistant plugin dev with takedown notice

#124

Post by beeboobaa »

pavel_lishin wrote: post #120
beeboobaa wrote: post #117

Earlier quoted context omitted.

If some company sells stuff that requires a connection to their cloud then it is 100% fair game to reverse and utilize that cloud to get the product working the way you want. They have no right to be upset about that. They sold you a requirement to connect to that cloud. If they don't want anyone connecting to their cloud, then don't sell cloud connected junk.

> They have no right to be upset about that. Emotionally, ethically, morally, sure. Legally? We'll see how this shakes out, I guess. But yeah - this is one of the reasons why nothing in my home is smart. I fully can't bring myself to trust any company to not eventually fuck me, either intentionally, or by going out of business and bricking some C&C server, or by selling themselves to some assholes.

All my smarthome stuff is zigbee based, controlled by home assistant locally. It's nice. Agree on avoiding cloud garbage.

Re: Haier hits Home Assistant plugin dev with takedown notice

#125

Post by DyslexicAtheist »

beeboobaa wrote: post #123
DyslexicAtheist wrote: post #100

Earlier quoted context omitted.

not only will it be common practice but likely also the law. upcoming legislation in Europe mandates secure-boot for any IoT device sold by 2025 in EU. this and the cybersec resilience act will ensure only firmware shipped and signed by the vendor are able to boot :) ... so your comment is spot-on.

What legalization is that? That's atrocious and only serves to fuck the end user.

legislation?

Radio Equipment Directive which now has a huge cybersec impact. So if you want to sell hardware in EU it must be certified

here is a lot of what will be in there. https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02...

the final standard is not the above but based on the ideas in ETSI.

While the above applies mostly to the "thing" the cloud and edge that enable services for IoT will be covered by the hotly debated CRA:

https://news.ycombinator.com/item?id=38818734

https://news.ycombinator.com/item?id=38787005

Re: Haier hits Home Assistant plugin dev with takedown notice

#126

Post by quotemstr »

agilob wrote: post #48
hunter2_ wrote: post #47

Earlier quoted context omitted.

> They offered API that they don't want people to use. I wonder how this would play out if instead of serving responses for nonhuman consumption (i.e., an API), it was serving responses for human consumption (i.e, HTML documents). In that scenario, if a subset of requests were of a high-frequency nonhuman nature (i.e., polling and scraping), would a court find it equally abusive or materially different?

HTLM documents evolve much more frequently and there were dozens of HA addons that simply gave up updating their regexes extracting certain information from HTML and emails.

Ah, but now we have LLMs that can understand human interfaces without manual tweaking!

Re: Haier hits Home Assistant plugin dev with takedown notice

#127

Post by alexdns »

supergeek133 wrote: post #111
asylteltine wrote: post #92

I’m really worried this will become common practice. We MUST fight against this otherwise they will take away open source from us. Making an integration to work with devices you own is NOT ILLEGAL. I’m happy to contribute to a qualified and trustworthy gofundme to protect devs. I myself have a few integrations I made and would refuse to take them down. Granted, I intentionally don’t use any “cloud” api garbage.

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company

> Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it.

Yeah right.

Re: Haier hits Home Assistant plugin dev with takedown notice

#128

Post by lxe »

I was researching whether there's legal precedent making such uses legal, and ChatGPT pointed out that "Sony Corporation of America v. Universal City Studios, Inc.," where it was decided that developing a VCR where users can record Universal's content is legal.

https://en.wikipedia.org/wiki/Sony_Corp._of_America_v._Unive....

I think this applies here as well. Curious how this will play out.

Re: Haier hits Home Assistant plugin dev with takedown notice

#129

Post by supergeek133 »

asylteltine wrote: post #116
supergeek133 wrote: post #111

Earlier quoted context omitted.

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company

So? If you don’t want people using your APIs there are ways to block them. If it’s public, don’t complain.

That's exactly what Haier is doing, just via legal means than technical ones.

We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me.

In this case, it appears they've taken the same access/creds as the mobile app maybe?

Another one of our platforms we cert-pinned the API to prevent this as well.

Yes there are ways, the other part we don't know is if they went straight to the legal route or not.

Re: Haier hits Home Assistant plugin dev with takedown notice

#130

Post by supergeek133 »

alexdns wrote: post #127
supergeek133 wrote: post #111

Earlier quoted context omitted.

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company

> Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Yeah right.

I have data to back this up (at least for our products), do you?
Post reply on HN