Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla debuts implementation of WebThings Gateway open-source router firmware

venturebeat.com

Post reply on HN
Print view View original

111–120 of 173 posts

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#111

Post by sp332 »

tialaramex wrote: post #109
sp332 wrote: post #92

Earlier quoted context omitted.

If you can't tell what data is being sent or retrieved, how will you prosecute them?

I can't tell what my 2028 model Foo Corp. Smart TV is sending to the HBO servers or why, it's technically impossible thanks to cryptography. But a Federal Prosecutor can tell a judge these are the only Smart TVs that do that, and he thinks it's because they're violating the Tialaramex No Snooping Act of 2025, so he wants a warrant to see what HBO receives. The warrant doesn't magically decrypt the packets - but refus…

Don't you need probable cause to get a warrant? This might be different in Europe actually... but it seems a bit thin.

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#112

Post by ryacko »

tialaramex wrote: post #29

This the closest we have so far to an answer to the point raised in the IETF 105 Technical Plenary a few days ago. Encrypting everything means that IoT devices represent an unknown threat - your "smart" TV connects to Sourceforge and downloads... something every week. What for? Your "smart" thermostat calls the IP of the vendor, maybe to get firmware updates, but it also calls the Disney corporation - what for? You c…

NULL ciphersuites exist for TLS, but knowing what data is sent is meaningless.

You find out after you purchase the device, are you going to send it back? What if data collection policies change?

Besides, SSH begins with encryption, how do you audit an SSH connection?

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#113

Post by amaccuish »

derefr wrote: post #63
rohan1024 wrote: post #39

Earlier quoted context omitted.

> without a middleman Are you saying that I should be able to connect to my home directly over the Internet? How does it bypass NAT.

You configure your router to not use NAT for IPv6, and get your ISP to provide you more than a /128, is how. This is why industry is adopting it and consumer devices aren’t. (IPv6 space is big enough that there’s no reason that residential ISPs shouldn’t be assigning everyone larger prefix ranges by default, but that doesn’t mean they will. They probably think they can up-sell it. Thread is a great, simple protocol f…

The problem for me in the UK is that most ISPs are dynamically allocating prefixes using DHCP-PD. So I've not got static address I can put in my firewall for the equivalent of ipv4 port forwarding.

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#114

Post by wongarsu »

r3bl wrote: post #106
wongarsu wrote: post #96

Earlier quoted context omitted.

> I use NFC tags as a trigger. I simply hover my phone over a tag and an action happens in the background. That reads like what you really want is a regular physical button or switch. I think a lot of devices suffer because they try to fit the IoT label instead of just being a smart device without internet or even phone connectivity.

You'd think so, but NFCs are far easier to program and re-program. One of the NFC tags on my work desk triggers "focus mode". Lights change to bright white, a (non-local) radio station starts playing in the background, and the volume gets auto-adjusted to something bearable. That saves me like 20 clicks or so on two remotes. It's all about those small victories that save me a few minutes each day, all without a need…

There's nothing inherent about a button that prevents it from being programmable, and Phillips even has a battery-less remote that could as well be wall mounted.

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#115

Post by FeepingCreature »

sp332 wrote: post #111
tialaramex wrote: post #109

Earlier quoted context omitted.

I can't tell what my 2028 model Foo Corp. Smart TV is sending to the HBO servers or why, it's technically impossible thanks to cryptography. But a Federal Prosecutor can tell a judge these are the only Smart TVs that do that, and he thinks it's because they're violating the Tialaramex No Snooping Act of 2025, so he wants a warrant to see what HBO receives. The warrant doesn't magically decrypt the packets - but refus…

Don't you need probable cause to get a warrant? This might be different in Europe actually... but it seems a bit thin.

In Europe, with the GDPR, you can just ask the company what they have on you.

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#116

Post by kgiori »

rohan1024 wrote: post #39
sjwright wrote: post #5

The article seems to lack a TLDR so here's one. It is a "software distribution for smart home gateways which allows users to directly monitor and control their smart home over the web, without a middleman." Devices supported: - Raspberry Pi - Turris Omnia Protocols supported: - HomeKit - ZigBee - Thread - MQTT - Weave - AMQP Framework languages supported: - JS (Node.js) - Python - Rust - Java - C++ (for Arduino) Home…

> without a middleman Are you saying that I should be able to connect to my home directly over the Internet? How does it bypass NAT.

Mozilla hosts an https tunnel for subdomains that match YOUR-subdomain.mozilla-iot.org where users choose a unique subdomain and a cert for it is auto-installed (using LetsEncrypt) onto the RPi or Turris Omnia during first time setup. In the future once the WebThings Gateway has control over edge firewall rules, then the tunnel can go away in favor of a "hole" for 443 or a port forward rule for https access directly to the gw. Privacy risks are far reduced if we all run our own local smart home gateway in our homes.

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#117

Post by tialaramex »

sp332 wrote: post #111
tialaramex wrote: post #109

Earlier quoted context omitted.

I can't tell what my 2028 model Foo Corp. Smart TV is sending to the HBO servers or why, it's technically impossible thanks to cryptography. But a Federal Prosecutor can tell a judge these are the only Smart TVs that do that, and he thinks it's because they're violating the Tialaramex No Snooping Act of 2025, so he wants a warrant to see what HBO receives. The warrant doesn't magically decrypt the packets - but refus…

Don't you need probable cause to get a warrant? This might be different in Europe actually... but it seems a bit thin.

Sure, so it depends on circumstances in the broader society. The judge needs to be convinced that on balance it's more likely the case that the prosecutor is right than not. That's all probable cause is.

In today's IoT world where basically everybody does all this potentially shady stuff sending encrypted data to who knows where, and with no legislation on the books saying they mustn't, you would not get anywhere trying to obtain a warrant.

But if things like WebThings Gateway were to make that unusual, so that as I said there aren't other Smart TVs sending mysterious stuff directly to HBO - that changes the balance of probabilities, and it also changes the incentive to regulate / legislate behaviours that are now less common and still undesirable so that what they're doing isn't just immoral it's illegal too.

Circumstances change. In 1975 the idea that you shouldn't smoke cigarettes inside a train, deep under the ground, in a crowded city, was a bit weird. By 1983 it was illegal in London. In 1985 somebody who'd cut a few corners and was lighting a cigarette on the escalator out of the Underground caused a fire in which a lot of people died (a lot of other things went wrong, but none of them would have mattered if not for the cigarette). Today when we're trying to explain that fire to children it doesn't make a lot of sense to them. They don't remember it ever being legal to smoke cigarettes inside a building - it smells bad and looks obviously dangerous - why would somebody be doing it not just inside a building but so deep underground?

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#118

Post by msla »

xiaomai wrote: post #6
sirtoffski wrote: post #4

It's kind of sketchy to upload your floor plan...or is it just me?? https://iot.mozilla.org/docs/gateway-user-guide.html

It's uploaded to your device (router / raspberry pi / etc.), it doesn't go to mozilla or other 3rd parties.

> it doesn't go to mozilla or other 3rd parties.

Until Mozilla decides to promote Mr. Robot again.

Or just stick ads someplace... again.

https://www.theverge.com/2018/5/7/17326184/firefox-ads-spons...

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#119

Post by justicezyx »

m12k wrote: post #16

What's HN's thoughts on IoT? To me it looks like yet another buzzword from the "wouldn't it be neat?" crowd (the same people who previously gave us a lot of hype about Semantic Web and P2P social networks) but as before none of the applications are actually worth the hassle, this prevents critical mass from ever being reached, and in reality it's mostly just a way for appliance companies who are already overcharging…

To me, the IoT is better than AI, in that it enables broad control mediated by humans (with necessary tooling and programming educations). Whereas AI, on the contrary, deprives humans from the ability to control things.

My uninformed observations on the issue of IoT tech development:

* IoT, in order to be useful, needs to form a common infrastructure first. It's obviously useful for TVs to be able to talk to nearby smartphone directly, to offer rich control. However, if the protocol vary between TV, Micro Oven, Fridge, Washer & Dryer, etc. And each brands of these devices also vary. Apparently no one is going to appreciate the results.

Worse yet, if they are interfaced through smartphones, the sparse physical form factor offered through phones are going to confuse users all the time, even if they manage to build a common infrastructure and enabled a uniform experience. At the beginning, the experience would definitely be worse than the dedicated and well optimized interfaces offered by the individual devices nowadays (not saying they are satisfactory either).

* On the other hand, the manufacturers, in general, is not tech savvy. Nor they are ready to relinquish their hold on their own market segment.

And that worry is justified. Once the common infrastructure is built, they'll be at mercy to the ones who own the tech. As obviously, they are not going to be able to gain that capability themselves.

IMHO, this is also why IoT is often with 5G. As the 5G community is historically closer to the manufacturers, than the Internet community. And 5G is itself a fairly mature tech, and has even broader application than IoT, so presumably, they can ride the wave and make sure they are not commoditized in the process.

Re: Mozilla debuts implementation of WebThings Gateway open-source router firmware

#120

Post by godelski »

tialaramex wrote: post #29

This the closest we have so far to an answer to the point raised in the IETF 105 Technical Plenary a few days ago. Encrypting everything means that IoT devices represent an unknown threat - your "smart" TV connects to Sourceforge and downloads... something every week. What for? Your "smart" thermostat calls the IP of the vendor, maybe to get firmware updates, but it also calls the Disney corporation - what for? You c…

I'm no security expert, and maybe one can explain this to me, but why can't we just inspect the data before it is encrypted? Like isn't it gathered in some way, encrypted, then sent? And on the receiving end it has to decrypt, so we look at that (naively what files change). Unless this is all stored as encrypted I don't see why you can't do this. I mean this should prevent mitm attacks but also let those controlling devices inspect packets. Right? Or am I missing something (if so I'm legitimately interested. Lots of this stuff just seems like black box to me, and I'm sure others)
Post reply on HN