An IoT dashboard • Hacker News Board

Re: An IoT dashboard

#21

Post by nl » Thu, Feb 19, 2015, 10:34 AM UTC

q3k wrote: post #13

A prime example of why dashboards are useless. Information that nobody needs (toilet flushes? ctrl, excuse me, apple-z's?) shown in a shiny way.

Information that nobody needs

Wow.

Toilet flushes: a significant change in the frequency of toilet flushes may indicate the spread of communicable diseases such as gastroenteritis, or community health problems like food poisoning.

Apple-z: Clearly someone is having a lot of problems with whatever software they are using. There is a UX optimisation opportunity there.

Re: An IoT dashboard

#22

Post by StavrosK » Thu, Feb 19, 2015, 10:37 AM UTC

I love things like these, but I'm worried about the security implications (even though they're hosted on my own server). I've been thinking about encrypting the values (I only do TLS now), but you can probably get a lot of information from traffic analysis alone.

A bigger question is how to send the control signals (e.g. lights/AC on/off) in a secure manner, so I've devised a protocol that uses ECC keys to sign each request. The keys are exchanged during an initial pairing process, and then the client (the thing that controls the lights) knows to trust the controller (the mobile phone or PC). If you don't have the private key, which is only ever generated and stored on the device, you can't control anything, so it's even safe in the clear.

Re: An IoT dashboard

#23

Post by Gmo » Thu, Feb 19, 2015, 10:55 AM UTC

EvilDavid75 wrote: post #6

pjmlp wrote: post #5

> Sorry, we were too lazy to optimize this site for your current browser. Please download Chrome for the best viewing experience. Sorry I am too lazy to care about browser specific web sites.

Fair enough :) Do you mind sharing what's your browser? Trust me, it's been hard enough to work on Firefox, Chrome, Safari, iOS and Android for a first try!

I had the same message on my Windows Phone 8.

It actually doesn't show too bad. So I would anyway rewrite this message.

- First, why absolutely say Chrome ? Especially if it actually works in Firefox.

- Second, well, even if I wanted, I can't download Chrome on Windows Phone, so I would say that you should detect when it's a smartphone and show a different message then.

- Third, I can understand that it's a lot of work to support all of those platforms, so I don't necessarily expect that you fix the issues with Windows Phone, but that really irritates me when people always advise to download Chrome. This is not IE 6 times anymore, we should all learn from it :)

Re: An IoT dashboard

#24

Post by Gmo » Thu, Feb 19, 2015, 10:57 AM UTC

EvilDavid75 wrote: post #6

pjmlp wrote: post #5

> Sorry, we were too lazy to optimize this site for your current browser. Please download Chrome for the best viewing experience. Sorry I am too lazy to care about browser specific web sites.

Fair enough :) Do you mind sharing what's your browser? Trust me, it's been hard enough to work on Firefox, Chrome, Safari, iOS and Android for a first try!

Ha and to not be totally negative, because I like it a lot, is the code open source somewhere ?

Re: An IoT dashboard

#25

Post by EvilDavid75 » Thu, Feb 19, 2015, 11:09 AM UTC

Gmo wrote: post #23

EvilDavid75 wrote: post #6

Earlier quoted context omitted.

Fair enough :) Do you mind sharing what's your browser? Trust me, it's been hard enough to work on Firefox, Chrome, Safari, iOS and Android for a first try!

I had the same message on my Windows Phone 8. It actually doesn't show too bad. So I would anyway rewrite this message. - First, why absolutely say Chrome ? Especially if it actually works in Firefox. - Second, well, even if I wanted, I can't download Chrome on Windows Phone, so I would say that you should detect when it's a smartphone and show a different message then. - Third, I can understand that it's a lot of wo…

You're right. We'll change the message as soon as I come back to my desk. To be honest, the fact is that for the specific widgets and animations we're using, Chrome gets the best performance (at least on my MacBook Air). Firefox also has troubles with the dotted attribute for border css that we use for the lux widget. But Safari works ok, just as any WebKit browser! And for the record I use safari as my primary browser :)

Re: An IoT dashboard

#26

Post by EvilDavid75 » Thu, Feb 19, 2015, 11:10 AM UTC

Gmo wrote: post #24

EvilDavid75 wrote: post #6

Earlier quoted context omitted.

Fair enough :) Do you mind sharing what's your browser? Trust me, it's been hard enough to work on Firefox, Chrome, Safari, iOS and Android for a first try!

Ha and to not be totally negative, because I like it a lot, is the code open source somewhere ?

Yep. https://github.com/SidLeeParis/sidLeeAgenceConnectee

Re: An IoT dashboard

#27

Post by EvilDavid75 » Thu, Feb 19, 2015, 11:48 AM UTC

StavrosK wrote: post #22

I love things like these, but I'm worried about the security implications (even though they're hosted on my own server). I've been thinking about encrypting the values (I only do TLS now), but you can probably get a lot of information from traffic analysis alone. A bigger question is how to send the control signals (e.g. lights/AC on/off) in a secure manner, so I've devised a protocol that uses ECC keys to sign each…

Hi StavrosK, you're right to be worried. We had someone playing with the API this week and sending wrong events. Security wasn't a primary concern for us, we started this as an internal joke (first version didn't even have a token system). Just to be clear, the light switch doesn't trigger a real light, but the way we handle sending sending the events from the browser is pretty dirty :)

Re: An IoT dashboard

#28

Post by simcop2387 » Thu, Feb 19, 2015, 11:51 AM UTC

StavrosK wrote: post #22

I love things like these, but I'm worried about the security implications (even though they're hosted on my own server). I've been thinking about encrypting the values (I only do TLS now), but you can probably get a lot of information from traffic analysis alone. A bigger question is how to send the control signals (e.g. lights/AC on/off) in a secure manner, so I've devised a protocol that uses ECC keys to sign each…

Given your description I think this is the kind of thing that Client Side Certs are intended for. At least from the PC to server. on the server to IoT device side there are things like Z-Wave that do something like you describe (though proprietary and not well known how secure it is, to me at least). The big issue with signing alone though is that it can leave you vulnerable to replay attacks if you don't have some method to validate that it's a new request and not an old one. Typical methods i think are time based, e.g. command is only valid for 1 minute but this requires synced clocks on all devices. Or using an always incrementing number for each command and remembering which one was last sent which is easier on the device side but only allows a single master controller unless you get fancy on the master side.

Re: An IoT dashboard

#29

Post by TeMPOraL » Thu, Feb 19, 2015, 11:56 AM UTC

q3k wrote: post #13

A prime example of why dashboards are useless. Information that nobody needs (toilet flushes? ctrl, excuse me, apple-z's?) shown in a shiny way.

I agree. Now, it looks cute, I must say, but I think it's mostly useless. The industry now seems to be in the phase of cargo-culting measurements - all going "we have to put EVERYTHING on graphs!" without stopping for a moment and asking "what am I planning to do with this data?".

Graphs, tables and other ways of representing data should be there to help you make decisions, not to just look cool. So yeah, go ahead and collect toilet flushing data; maybe you'll find something interesting there. But the way it's presented now, most of that data is useless. The number of toilet flushes since today morning doesn't really tell you anything without context. Even "x% above/below average of last week", or better, a sparkline of previous week's worth of data would give you some baseline that could let you interpret that flush count in a useful way.

Basically, my gripe with people in IoT and Quantified Self is that they totally cargo-cult graphs and dashboards.

Re: An IoT dashboard

#30

Post by StavrosK » Thu, Feb 19, 2015, 11:58 AM UTC

simcop2387 wrote: post #28

StavrosK wrote: post #22

I love things like these, but I'm worried about the security implications (even though they're hosted on my own server). I've been thinking about encrypting the values (I only do TLS now), but you can probably get a lot of information from traffic analysis alone. A bigger question is how to send the control signals (e.g. lights/AC on/off) in a secure manner, so I've devised a protocol that uses ECC keys to sign each…

Given your description I think this is the kind of thing that Client Side Certs are intended for. At least from the PC to server. on the server to IoT device side there are things like Z-Wave that do something like you describe (though proprietary and not well known how secure it is, to me at least). The big issue with signing alone though is that it can leave you vulnerable to replay attacks if you don't have some m…

The problem with client-side certs is that things go through a queue, yeah. CSC are only secure to the server, not to the other device. You're right about the replay attacks, that's why I include a timestamp. Since commands usually take less than a second, it works well enough, but sequence numbers work too, yep.