This reminds me of Ecobee killing their developer portal. Very sad. I hope one day we can flash a custom firmware to those.
NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
81–90 of 146 posts
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#82Right now it's just a blob that you flash to your device to make it talk to a proprietary service. It is not yet " giving me complete control over my device data and settings ." I can't change where it comnects to etc. In fact - I don't even see a privacy policy on nolongerevil.com! Hey, I can login at nolongerevil.com using my Microsoft-owned github login! And there's yet another company involved: clerk.com - yay? "…
> PS: Sorry for being so negative... perhaps the release should have been delayed until all of this is opened up. This is one of the major problems with doing anything good online. People like this.
Hey, this is just normal behavior in the dark forest of proprietary software- if good things happen, they are out to get you, some angler out to get you.
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#83Earlier quoted context omitted.
> ...looks like they reverse-engineered the nest thermostat and wrote a firmware... Not to diminish what this project has done, but they modified existing firmware to make it communicate with a different server. They've also implemented a server for the thermostat API. It's pretty neat but, at this point, it's just a hacked firmware that talks to a different proprietary server. Edit: It's not even a modification to t…
Does it not use TLS? Wouldn't the Nest have to trust a CA willing to issue certificates without proving ownership?
They're also injecting a CA bundle so, presumably, they're in including their own root of trust so they can sign their own certificate. I'm on mobile and can't easily look at what they're including.
Edit: Guess I've got openssl in my termux environment. They're injecting a fake Nest root CA key. Makes sense.
I'm shocked it was this easy to subvert the root of trust on these devices. I would expect a newer device would have the trust root pinned in hardware (TPM, etc) and firmware updates would be have been authenticated.
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#84Let's buy a second hand Nest Gen1/2 before people know about this!
Buy a bunch of them and engage in cloud thermostat firmware arbitrage! You could make a big profit! (Or you could put in significant time and effort but lose money.)
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#85Living in a cold room with an evil presence is better than roasting in hell with an angry wife.
This is why I hate digital thermostats. With the old classic round Honeywell thermostats you could turn the dial a fraction of a degree when nobody was looking and "boil the frog" to get a reasonable temperature. With digital thermostats, you can only change the temperature in discrete steps which will be immediately noticed. > Why does it say 74?? I had it set to 75!!1!
The flip side is that, if you do hammer out an agreement on what the thermostat should be set to, with an analog thermostat, you can have arguments about whether it is actually set to that.
"We agreed it would be set to 74!"
"It IS set to 74!"
"No, it's set to like 74.2 or 74.3 or something! The little pointer is not pointing directly at 74, and you know it!"
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#86Earlier quoted context omitted.
> I am not hopeful they will be able to write custom firmware for the thermostats. If you read the GitHub Readme (typically a better way to judge a project than stalking someone on LinkedIn) you can see that they didn’t write a custom firmware. They modified the Nest firmware to contact different back end servers. The firmware is the same (they claim) except for modifications to change which server is contacted. They…
Sounds fishy, if the device allows this sort of fakery, that means the traffic is vulnerable to some sort of MITM attack by DNS poisoning/packet rerouting, which is somewhat disconcerting.
> if the device allows this sort of fakery, that means the traffic is vulnerable to some sort of MITM attack
No. This is a thermostat at your home. It forwards its DNS requests to your router. Feel free to establish whatever security protocols you need there. Or, even better, host your own server.
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#87Are they good options for cloud-freeish thermostats? I have two units (one for upstairs and one for downstairs). We have two nests but they’re so frustrating. I’ve lobotomized the “smart behavior” as much as a I can. I want a thermostat that connects to the home assistant I already have
ecobee is still cloud connected, but they work nicely with homekit. AFAICT, that enables local control. I can confirm that they work nicely with homeassistant via the homekit integration.
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#88Right now it's just a blob that you flash to your device to make it talk to a proprietary service. It is not yet " giving me complete control over my device data and settings ." I can't change where it comnects to etc. In fact - I don't even see a privacy policy on nolongerevil.com! Hey, I can login at nolongerevil.com using my Microsoft-owned github login! And there's yet another company involved: clerk.com - yay? "…
I don't get the hate, it looks like they reverse-engineered the nest thermostat and wrote a firmware for it? That's super cool and the fact that an open source project doesn't have a privacy policy yet doesn't really matter at this point
It doesn’t just not have a privacy policy yet, but it’s not actually open source either. Honestly they probably fully intend on doing it, but it is important to point out that it is not yet open source.
> Open Source Commitment
>We are committed to transparency and the right-to-repair movement. The firmware images and backend API server code will be open sourced soon, allowing the community to audit, improve, and self-host their own infrastructure
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#89Seems a good step towards a whole replacement firmware.
No real reason to keep running google's code on these things.
Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
#90Are they good options for cloud-freeish thermostats? I have two units (one for upstairs and one for downstairs). We have two nests but they’re so frustrating. I’ve lobotomized the “smart behavior” as much as a I can. I want a thermostat that connects to the home assistant I already have
ecobee is still cloud connected, but they work nicely with homekit. AFAICT, that enables local control. I can confirm that they work nicely with homeassistant via the homekit integration.
Don't even mention Ecobee. They've done the exact same thing as Google Nest by bricking their older hardware.