Opening doors to everyone, using 3 products to do so and depend on other people's code & services in the process... I think I will pass on you guys for my payments.
How we hacked our office doorbell using Slack, MessageBird and Now
21–29 of 29 posts
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#22It seems the definition of 'hacked' is getting looser and looser these days. Sounds like you just consumed services from a SaaS, thats 'hacking' today.
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#23Considering you don't actually check who the person is, wouldn't it be easier to just leave the door unlocked during business hours? KISS and all that...
> don't actually check who the person is
they would just pipeline in the GCP TensoFlow based automatic friendly/hostile classification. We need cloud version of KISS...
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#24Did you hack it or just integrate to it?
please respect knobhacking. it is the oldest profession.
you hack people, i hack knobs — knobhacker
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#25The main advantage that this overengineered solution has over a doorstop is that no one will upvote an article on HN about a doorstop, and then your company loses out on the publicly.
Yeah, seems like an astroturfing attempt.
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#26[deleted]
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#27FTA:
> MessageBird sends a couple of extra parameters with each request, including a callID. When a new request comes in, we’ll make an API call to MessageBird, to verify whether this voice call actually happened and if it happened within the last 2 minutes. We also used the query parameters destination and source from the incoming webhook call and matched these against the data from MessageBird. This would make sure that only “real” doorbell calls would trigger Slack notifications.
This approach seems to be reinventing the wheel of validating MessageBird webhook calls. From their docs (https://developers.messagebird.com/docs/voice-calling#handle...):
> Each callback HTTP request is signed with a signature, a base64 encoded HMAC found in the X-MessageBird-Signature HTTP header. To ensure the callback is coming from the MessageBird platform, we strongly advise to validate its signature by calculating the HMAC of the callback and base64 encoding it. Using HMAC-SHA256, the HTTP body is the message and the token of the related webhook resource is the secret. Only handle the webhook if the computed value matches the signature in the HTTP header.
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#28So wait a sec, do you open the door to anyone without checking who is it?
If that’s true, then on top of that, they’ve now broadcasted that fact to the world. And they’re a payment services company.
You guys are right about that. But first to be clear. This is NOT our HQ, but an office not working on our core- platform. People sitting in this office can look out of the window to see who's standing at the door before opening the door.
Also, please note, this was just a fun small project for us. Making an image with a camera and posting to Slack would be better. We had much fun making this without putting a lot effort in it, that was for now the point.
We are aware of all the security issues and are not using this in production at our main office.
Re: How we hacked our office doorbell using Slack, MessageBird and Now
#29[deleted]