Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Volkswagen blocks Home Assistant by requiring client assertion

github.com

Post reply on HN
Print view View original

151–160 of 203 posts

Re: Volkswagen blocks Home Assistant by requiring client assertion

#151

Post by ryandrake »

summm wrote: post #59
venzaspa wrote: post #24

Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.

They already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assis…

> Or just a headline "Tinkerer hacked his car to use with his home assistant" in the local press.

It's pretty sad that "User used their product in a novel way we didn't expect" is seen as a risk that must be mitigated.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#152

Post by AlotOfReading »

cisophrene wrote: post #133
b3lvedere wrote: post #124

Earlier quoted context omitted.

Proving that autopilot killed that poor old granny because of cosmic rays would be an interesting case study.

It actually happened with Toyota around 2010: they went into a settlement regarding an unintended acceleration issue because it was proven the code was terrible and a single bit-flip could cause the behaviour. https://en.wikipedia.org/wiki/2009%E2%80%932011_Toyota_vehic...

Bit of context to this, it was demonstrated that it was a hypothetical possibility, but the issue couldn't be demonstrated in lab conditions. Stuck floormats, pedals, and confused drivers remain the only actual explanations for the real events behind the lawsuits.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#153

Post by ryandrake »

pydry wrote: post #43
vincnetas wrote: post #3

This comment has really nice translation of corpo-speek to human language : https://github.com/robinostlund/homeassistant-volkswagencarn... Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?

Most executives make commercially disadvantageous decisions in exchange for more power. It's practically a law of business: executives prioritize their power first and their company's profit margins second . This is one reason why outsourcing coding was so popular despite not saving money and being so commercially disastrous - execs were in the driving seat with that relationship much more than they were with us. Des…

Yea, I don't really see the revenue potential here. They seem to be doing this purely to force developers to have a "formal relationship" with them, and to grief all other developers who don't.

Same mentality behind companies who insist users have an "account" to use their otherwise-unconnected products.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#154

Post by lII1lIlI11ll »

mschuster91 wrote: post #117
lII1lIlI11ll wrote: post #95

Earlier quoted context omitted.

> The US has always been willing to grant hefty amounts of taxpayer money to startups Care to elaborate? I was under impression that absolute majority of startups in US are fully funded by a (private) venture capital. There are (were?) some exceptions like tax reductions on "green" projects, but they were not restricted to startups/small companies in any way.

> I was under impression that absolute majority of startups in US are fully funded by a (private) venture capital. Tesla got a shitload of government funding, including a 465 million dollar loan [1]. SpaceX was effectively funded by NASA in its early days. In total, the Muskverse alone got 38 billion dollars [2]. Bezos' Blue Origin got at least 1.5 billion dollars [3]. Sure, by number most startups are fully privatel…

How does it compare to European states subsidizing ArianeGroup, in your opinion?

Re: Volkswagen blocks Home Assistant by requiring client assertion

#155

Post by pseudopolous »

vincnetas wrote: post #3

This comment has really nice translation of corpo-speek to human language : https://github.com/robinostlund/homeassistant-volkswagencarn... Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?

[dead]

Re: Volkswagen blocks Home Assistant by requiring client assertion

#156

Post by CamperBob2 »

loloquwowndueo wrote: post #114
ivolimmen wrote: post #111

Ok it's clear my next car will not be a Sköda (or Volkswagen)

Which brand are you thinking of, then?

Done buying new cars in general. It was always a sucker's game, and now a new car offers little besides various unwanted features and added restrictions, all in support of misguided regulations and other peoples' business models.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#157

Post by mschuster91 »

Roark66 wrote: post #149
mschuster91 wrote: post #121

Earlier quoted context omitted.

> German auto makers were wealthier than the US auto makers. Germany's GDP is now third in the world. There is capital. The problem is, that capital is stuck in the bank accounts of the uber rich. > But they wanted it to be spent on Russian gas pipelines, foreign aid, anti nuclear activism, and in the pockets of politically connected multinationals like T-systems to build another "government digitalization project" w…

>Nordstream was privately funded, half by Gazprom, half by a consortium of privately owned large utilities And do you also believe what Merkel said that "it's purely a commercial venture"? Who chairs those "privately owned large utilities"? What are the links between those people and "the establishment" that includes people like Merkel (earlier Shroeder - his work for Gazprom was also purely commercial venture of a p…

> And do you also believe what Merkel said that "it's purely a commercial venture"?

That's not the point here (and for what it's worth, Nord Stream should never have been started in the first place, and we should have cancelled it the day that "little green men" arrived in Ukraine).

My point was and is that Germany is traditionally very reluctant in handing out government funds and especially government-backed debt to private industry in general while the US has all but zero issues.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#158

Post by drtz »

chromehearts wrote: post #52

seems like google is playing a part in this ? https://github.com/robinostlund/homeassistant-volkswagencarn...

Yes this is Google helping vendors block access to their APIs by using hardware attestation.

I recently hit the same wall trying to directly my garage door opener's API (MyQ).

I'd be amazed if Google enabling this behavior doesn't violate some EU competition laws.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#159

Post by nunez »

I've been doing smart home stuff for a long time. This is one of the reasons why I got off of Home Assistant.

It's a very cool and functional project but it is entirely dependent on companies keeping their APIs open, or, more commonly, companies not patching teh magic that makes reverse-engineered APIs possible.

Unfortunately, developments over the years have NOT gone in their favor. Tesla, Ring, MyQ, Ecobee and probably others have closed their APIs over the years. They've usually cited "security concerns" as the motivating factor for the API closures, which has some legitimacy, but IMO it's usually driven by fear of losing subscription revenue.

(Tesla charges a lot for official OAuth apps, though, to be fair, earlier hacks relied on a leaked OAuth app that they never got around to patching. Ecobee locked HomeKit and some other stuff behind their Security+ Subscription, which is a joke considering how anemic their security platform is. MyQ definitely did it to protect their $45/year subscription; jokes on them since RATGDO is infinitely better. Ring still works for some reason, but HomeKit Secure Video support is extremely dicey in part due to the fear of them turning their API off as well.)

For someone like me who primarily used HA for HomeKit integration, depending on it is a ticking timebob. When we moved into our new house, I focused on finding stuff that was natively compatible with HomeKit without workarounds. Our smart home works much better now because of it.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#160

Post by NoSalt »

RobotToaster wrote: post #116
NiekvdMaas wrote: post #104

BYD DMCAd my whole repo to connect to their cars... https://github.com/github/dmca/blob/master/2026/05/2026-05-2... It's a shame these car makers are locking down their cars (which are brought for a premium!) and going on a crusade against open source.

You should email Louis Rossmann, he's been helping people in similar situations.

I cannot figure out of Louis is Batman or Don Quixote, charging at the "windmills" of MAMAA: (Meta, Apple, Microsoft, Amazon, Alphabet).
Post reply on HN