More awful IoT stuff • Hacker News Board

Re: More awful IoT stuff

#221

Post by api » Thu, Jun 23, 2016, 12:44 AM UTC

TeMPOraL wrote: post #219

api wrote: post #216

Earlier quoted context omitted.

Yes, if this is the cost. Loss of local connectivity is not a small degradation. It's like losing floating point math from your CPU or the ability of your car to go in reverse. If we're building endpoint networks to prohibit local traffic, we are forcing a terrible architecture with terrible long-term privacy and security implications. Because of this, we will have a future where the NSA (and vendors, and advertisers…

Also worth pointing out that the reason everything talks over HTTP now is because companies figured out that the only port on a typical user's computer that can be assumed to be free of bullshit pseudo-security rules is the port 80...

Sure. We've degraded the Internet from the Internet to the HTTP-to-AWS-gateway-net. Meanwhile security still sucks.

Re: More awful IoT stuff

#222

Post by Godel_unicode » Thu, Jun 23, 2016, 1:12 AM UTC

api wrote: post #216

Godel_unicode wrote: post #210

Earlier quoted context omitted.

So you're in favor of Grandparents getting cryptowall from someone else connected to their WEP-encrypted wifi because screw them for using Windows XP and a cheap router? Off-switches for things like this are cool, because people who need them will find them, and people who don't won't. This is remarkably similar to defeatable traction-control; people who care enough to figure out what that button does will push it an…

Yes, if this is the cost. Loss of local connectivity is not a small degradation. It's like losing floating point math from your CPU or the ability of your car to go in reverse. If we're building endpoint networks to prohibit local traffic, we are forcing a terrible architecture with terrible long-term privacy and security implications. Because of this, we will have a future where the NSA (and vendors, and advertisers…

It's closer to losing ECC; if you need it you can get it and if you don't need it you don't even need to know it exists. You're being rather alarmist, don't you think?

> Has anyone actually seen malware spread this way in the past 10 years in the wild

Yup, had several IR cases (trending up) where this was determined to be the initial vector. Related: stop making this argument. Nothing is seen in the wild until it is (go back a few years and realize this argument was made about cryptowall-style malware).

I think you should re-read the end of my first paragraph; isolation should have an off switch. Give people the option and let them choose. Sorry if that's bad for your business model.

Re: More awful IoT stuff

#223

Post by CaptSpify » Thu, Jun 23, 2016, 1:16 AM UTC

antoniuschan99 wrote: post #205

CaptSpify wrote: post #181

Earlier quoted context omitted.

Is it open source? that looks pretty rad. Are they available to purchase? Any plans for other devices?

What would you use this device for? I haven't released the code for it yet, but there are plenty of tutorials online. It's using NodeMCU and a DHT11. If there's more interest in hacking the device, I can provide some blogposts or tutorial videos. There are 5 available and 15-25 more are on the way. Please contact me if you're interested. I'm planning on selling it for around $35 and for the first few batches at $30 (…

A few things:

Monitor the temperature in my office (I run a few servers)

Check the temperature outside. I'm close enough to a major city that everything uses that location, but often it's different from where I'm actually at.

My garage. Sometimes I have paints/stains/beer/etc that shouldn't be above/below a certain temperature.

I'll look at it more then email you

Re: More awful IoT stuff

#224

Post by goodplay » Thu, Jun 23, 2016, 2:15 AM UTC

Godel_unicode wrote: post #222

api wrote: post #216

Earlier quoted context omitted.

Yes, if this is the cost. Loss of local connectivity is not a small degradation. It's like losing floating point math from your CPU or the ability of your car to go in reverse. If we're building endpoint networks to prohibit local traffic, we are forcing a terrible architecture with terrible long-term privacy and security implications. Because of this, we will have a future where the NSA (and vendors, and advertisers…

It's closer to losing ECC; if you need it you can get it and if you don't need it you don't even need to know it exists. You're being rather alarmist, don't you think? > Has anyone actually seen malware spread this way in the past 10 years in the wild Yup, had several IR cases (trending up) where this was determined to be the initial vector. Related: stop making this argument. Nothing is seen in the wild until it is…

I also believe that trading real networks for supposed security would be a very bad move.

Network node security should not be delegated to the network. Not only would this necessitate forgoing very useful features that networks enable, you won't improve node security. Devices that are vulnerable by merely sharing a network with other nodes tend to have other more sever security lapses.

I agree that a button is simple way to switch between modes, but it will also make point-to-point the default. People don't change defaults, and companies will eventually cease to implement network capability as a result.

I'm all for better network security, but not at the expense of discarding the network itself.

Re: More awful IoT stuff

#225

Post by FussyZeus » Thu, Jun 23, 2016, 2:42 AM UTC

tunap wrote: post #185

FussyZeus wrote: post #78

Earlier quoted context omitted.

I suppose but it still seems like a copout (not on you of course, on them) to play the brand lock-in game. You don't need a centralized server to personalize and operating those servers, even on something like AWS, costs money. Why not put that on the consumer instead? Many consumers I know would prefer the roll-your-own solution and it saves the manufacturer money.

Thanks for your manners, but it is probably a copout on my part. I have the wherewithal(-money) to build something like this in my own home but I believe most of these controls are over-engineered progress for progress' sake... for anything less than a few thousand square foot structures. All I really need is a programmable thermostat, a couple timer plugs & my 'routine'. As always, YMMV. As for the providers, I have…

But this is assuming that I expect something beyond the transaction. I don't. I expressly DON'T want a continuing relationship where Nest decides my perfectly functional thermostat no longer works or that Phillips decides their controller is only going to work with Phillips light bulbs.

I want them to sell me the product and then politely f*ck off so it keeps working. :)

Re: More awful IoT stuff

#226

Post by fred256 » Thu, Jun 23, 2016, 3:17 AM UTC

deelowe wrote: post #57

apozem wrote: post #12

> Eventually I plugged my phone into my laptop and ran adb logcat, and the Android debug logs told me that the app was trying to modify a network that it hadn't created. Apparently this isn't permitted as of Android 6, but the app was handling this denial by just trying again. I deleted the network from the system settings, restarted the app, and this time the app created the network record and could modify it. It st…

As a counter example, my brother who never uses a computer setup his chromecast in 5 minutes with zero help from me. I know b/c he called me and asked for help. I told him he wouldn't need it, but he didn't believe me. Things are getting better. There will always be more crap out there than good stuff. That's why walmart is so popular, but things will generally improve.

The Chromecast has the advantage that it can tell you what to do (and what's going on during the setup process) on the TV; an internet-connected lightbulb or door knob doesn't have that luxury.

[edit:spelling]

Re: More awful IoT stuff

#227

Post by garduque » Thu, Jun 23, 2016, 5:28 AM UTC

steve-howard wrote: post #135

garduque wrote: post #120

Earlier quoted context omitted.

I've installed tens (if not hundreds) of thousands of Zigbee devices over the last handful of years. Zigbee may be uncommon in residential, but it is not uncommon.

Compared with wifi, though? Trying to screw with your wifi equipment requires just about any laptop sold in the last ten years. Trying to screw with your Zigbee equipment would presumably require me to go find some kind of dongle. Of course, wifi has gotten more secure over time to the point that I'd be more concerned about giving the devices internet access than I would about intruders on the network.

Sure, in the world there are probably more wifi devices, and I'll agree that wifi adapters are as mainstream as it gets. But just because the hardware to mess with Zigbee stuff isn't consumer mainstream doesn't mean the devices don't exist and aren't "used that much," as the comment OP incorrectly claimed.

In just one highrise project I did in Las Vegas last year we installed something like 65,000 Zigbee devices, and that's not atypical for highrise hotel construction. Zigbee is everywhere in building automation.

Re: More awful IoT stuff

#228

Post by StillBored » Thu, Jun 23, 2016, 5:59 AM UTC

CaptSpify wrote: post #66

I just blogged about this yesterday. In short: > The line in the sand for me is: network vs cloud-based systems. I want things to be network connected, but I want it for my own network only. I want to be able to control my coffee pot, but only from home. If I choose to expose this over the internet, great! It's up to me to make sure it's secure. I don't want anyone making that decision for me. I also want it to be up…

I'm in the same boat... Spent a couple years looking for a wifi thermostat that didn't require a cloud service. Actually I purchased a couple and hacked on them, but never hooked any of them up to my AC unit. Granted I had some pretty specific requirements (long list having to do with multiple zones/etc).

Not to long ago I settled for a couple of the venstar T7900's. They aren't perfect by any means, but they are light years ahead of anything else I could find. In fact they have a whole bunch of options that harken back to some of the early programmable thermostats. For example, out of the box you can control the max cycles/hour, or the number of degrees of variance from the setpoints. Buried in the menus are a wealth of options, including a few for limiting features available to "unprivileged" users. Funny enough, they can be subscribed to the power companies remote kill features, but the user is still in control and can disable the feature, which is probably why they are excluded from my power companies list of "smart" thermostats that qualify for rebates.

So, the cloud service can do a lot of things that aren't available from the published API, but running a local deamon and polling runtimes, setpoints, etc is all very straightforward, as is forcing a thermostat on/off from a server on the local network.

Anyway, that is my .02 for a thermostat that isn't owned by $megacorp/etc and can be disabled at the wim of a company that decides paying for a bunch of cloud servers is no longer in their interest.

Re: More awful IoT stuff

#229

Post by iofj » Thu, Jun 23, 2016, 6:25 AM UTC

startling wrote: post #156

iofj wrote: post #96

Earlier quoted context omitted.

That reasoning works until the judge considers damages. Then let's say it's a small developer, not too much work, and no commercial interest in the code. Damages are limited, in western law, to, well, damages. You need to have suffered a financial loss, the other party needs to have violated the license/contract/law/... and you need to show the causal connection between the two. Let's say you contributed 500 lines of…

I believe you can still sue for an injunction (e.g. to compel them to distribute copies of code as per the GPL).

Injunction is a way to prevent more damage from occurring. So generally speaking, injunctions :

1) are only available either during a trial or as a last resort (if you can make a good case the defendant won't pay even if the judge compels them)

2) you'd still have to prove more damage will be done if injunction isn't there. Those have to be real damages, with real monetary amounts on them.

This is western law, it's practical. Anything you do that either doesn't bother anyone, or you prevent damage from occuring is legal, no matter how much it is against (civil) law.

The fact that something violates copyright, by itself, is not sufficient to get anything done in court at all.

Re: More awful IoT stuff

#230

Post by nattofriends » Thu, Jun 23, 2016, 6:42 AM UTC

FussyZeus wrote: post #45

ju-st wrote: post #38

Earlier quoted context omitted.

Which problems do you want to solve with these IoT devices? What should they do? In my opinion existing IoT devices generally replace simple, proven systems with complex and abstruse ones.

A good example would be the smart outlet ones, so I could for example setup one to automatically power cycle my cable modem and router, or even one that could handle the load of a space heater I keep in my office during the winter months and switch it on 15 minutes before I get home. I don't even need the ability to manage it over the WAN, I'd be fine with just something my linux boxes at home could handle with cron…

http://resetplug.com/ among others.