Live data from Hacker News

Reverse-Engineering Google Nest Devices

experimental-platform.tumblr.com

71–80 of 85 posts

Re: Reverse-Engineering Google Nest Devices

#71
post #12
post #11

> […] creating a walled garden around the user’s own data is a shady move. All of my private data should be easibly accessible to me though open API without any gimmicks. In its press release Nest promised introducing a public API[,] however [it] seems limited in many ways compared to the internal API used by Nest mobile app - and to add insult to injury - many of its features require an active Nest subscription. Thi…

> When Google shuts down Nest, people are left with non-working thermostats, and have to spend money and rebuild their systems to continue on. No, they are left with a normal programmable thermostat with a nicer interface than most. > Even worse, if just the internet goes down – not that rare in areas in the US only served by one ISP which doesn’t have to fear competition – one is even left without heating. This is n…

> But this could happen with any device that is controlled by software.

Absolutely not. This kind of lazy, defeatist attitude towards failure is a huge problem in the software world.

There should have been checks that handled when the server (or anything else) became available with a contingency already in place to fail safely. Ideally, some of those checks should have been outside the area affected by software updates, such as in hardware.

As software moves into more and more areas that are traditionally thought of as hardware developers need to realize that in some areas bugs are not acceptable. Ever.

// sigh - do we need to get the terac-25 report out again?

Re: Reverse-Engineering Google Nest Devices

#72
post #56
post #27

Earlier quoted context omitted.

> a cloud-based recording service Well, there's the rub, right? I think what those of us who consider themselves self-hosting partisans would say is that we'd prefer a device that allows us to send its signals to a server we own and operate. The recording and image recognition would then occur on that server. In my ideal world, Dropcam (and later Nest) would have provided software I could install on my own server (lo…

It sounds like you want Zoneminder: https://zoneminder.com/

Depending on what you want to pay, what hardware/platform you want to use, and whether you're concerned about open source and other licensing, there are several options for NVR.

I've only got minimal experience with Zoneminder but I've used iSpy (https://www.ispyconnect.com/) fairly extensively running on desktop computers and, later, on an old laptop repurposed as a NVR.

Later on I started using the "Surveillance Station" package that came with my Synology NAS. That's closed source and the version I'm familiar with came with licenses for two cameras and the ability to pay to enable more. However, if someone is less interested in extensive setup or doesn't have a suitable computer free for that use, it's a decent option, as are similar packages on other NAS platforms.

I guess in terms of finding a market with adequate demand, the NAS solution would be a good one. There are already models that are geared and pitched toward use as network media servers. I'd be curious if one of the bigger NAS companies might come up with a model that's targeted as a NVR.

The cameras are cheap and plentiful enough but many current consumer-grade network cams are either sold as "cloud" only or involve lots of potential security issues. Several offer DDNS routing as a way to check your camera feeds from outside the LAN but don't adequately explain the risks in opening a port to a device that may have several exploits available. Others tout their easy setup and compatibility with mobile apps but neglect to stress that you need to access them via a desktop application or web interface on a non-mobile computer in order to see the security settings, change default passwords, or otherwise configure them properly.

The end result is thousands of network cameras easily accessible to anyone with the right Google or Shodan search terms. Restricting a device to "cloud" only may solve these issues for many people who would rather pay a monthly fee to let someone else handle their data but I think there's a place for something in between.

A basic NAS with some storage and software similar to what we've mentioned offers the ability to connect multiple network cameras, store and manage recordings locally, keep actual cameras inside the LAN with no outside access, and also serve as a location for home backups and file server duties.

I'm honestly surprised that a hardware-oriented company, whether a NAS company or something more like Apple, hasn't marketed a line of simple home NASes with IP cameras as additional options for purchase. By selling their own branded cameras they would get more add-on sales from people preferring to get everything of the same brand and more enterprising users could easily add their own IP cameras as long as they use one of the common protocols.

It's nothing you can't set up already but people seem to like turnkey systems and I'd imagine there's a segment between "just pay a monthly cloud subscription and forget about it" and "I'll just set up this old PC in the closet and configure some open source NVR software".

I guess the question is whether people would even bother since the initial cost is higher than some Dropcams or even a dedicated CCTV system like they sell in electronics stores.

Re: Reverse-Engineering Google Nest Devices

#73

Earlier quoted context omitted.

Right, it's the price point that changes a bit. You can make an argument that given enough money, you don't need to sacrifice privacy at all :)

The price point is fairly low if you are prepared to make a hobby of it: You can do the image capture with Raspbery Pis. (1) The storage is slightly more expensive though. 1) http://blog.snapdragon.cc/2012/07/16/using-raspberry-pi-for-...

The problem with the hobbyist approach (and this is coming from someone who owns multiple Raspberry Pis) is that you most hobbyist don't really have the resources to tackle every engineering aspect of building a reliable camera. We have people dedicated to fine tuning the WiFi drivers in the device, writing scalable and secure video storage/streaming services, figuring out the thermal profile of every component in the cameras, minimizing noise in the camera CMOS and the WiFi antennas, making embedded software that will reliably reboot itself after a catastrophic crash... etc, etc, etc.

Don't get me wrong, every one of those aspects is a lot of fun to tackle on your own, but ultimately would you trust your home to something you can throw together in a few weekends? After seeing the amount of work these guys put, I probably wouldn't.

Re: Reverse-Engineering Google Nest Devices

#74
post #67

Earlier quoted context omitted.

Don't mean to be dismissive, but you should be careful about that kind of setup. A lot of those companies haven't taken security seriously. This article is a stark reminder of that: http://arstechnica.com/security/2016/01/how-to-search-the-in...

I bet quite a few people would be less annoyed about Nest and others if someone made a good alternative. From what I've seen there is a) fully cloud-enabled stuff, b) cheap china crap with security holes and c) "enterprise" solutions with prices and hardware demands to match. No-one makes something with the features of b), proper security and the price+polish of a). There is quite a few "IoT" devices I want to like,…

I agree. The problem is that "boring" won't make money and "great" is too expensive. So "boring" has to be cheap (read: crappy) to work for the manufacturer.

Unrelated, but I had a similar issue when trying to find a "dumb" TV: most of the high-end screens come attached to crappy software that you know will stop receiving updates 2 years down the road, and the cheap ones were super low quality. I got lucky in the end, but it took a few weeks of research to find the right balance.

Re: Reverse-Engineering Google Nest Devices

#75
post #70

Earlier quoted context omitted.

Not really an option right now. The current generation of cameras out there are basically a Raspberry-Pi level computer with a better camera and a hardware h264 encoder. The moment you start doing something fancy, like running any non-trivial motion-detection algorithm, you are bound to run into performance or thermal (read: overheating) issues. Let's not even talk about machine learning. Just think how much money Ne…

Isn't HN supposed to be a forum popular with entrepreneurs? You sell the high-computation device as an optional extra. For full privacy, buy our turn-key home server! (optional video display available) If you're the DIY technical types who already runs a home server, may prefer our inexpensive software package that provides most of the features at much lower cost (some assembly required). (or something like that) The…

People overestimate the size of the hobbyist/geek market. Sure, in the Valley everyone and their dog can configure a NAS using a terminal from their latest generation iPad, but that's not the case outside of the Bay Area. I'd suggest you go to Sacramento and ask people on the street if they even know what a NAS or home server is (I once was dumb enough to start a startup there... you are one hour out of SF, but when it came to adversity to technology you might as well be in rural Alabama. This is the capital of California we are talking about!)

Providing these "geek-to-geek" options (term isn't mine) looks like a great business idea when all your friends would use it. But again, the financial incentive is not there if it takes equivalent (or even less) effort to design something that can be used by millions of people instead of hundreds of thousands.

Re: Reverse-Engineering Google Nest Devices

#76
post #66

Earlier quoted context omitted.

Not really an option right now. The current generation of cameras out there are basically a Raspberry-Pi level computer with a better camera and a hardware h264 encoder. The moment you start doing something fancy, like running any non-trivial motion-detection algorithm, you are bound to run into performance or thermal (read: overheating) issues. Let's not even talk about machine learning. Just think how much money Ne…

Can you share any reference on what the Nest servers actually do that a smartphone chipset isn't capable of? Various apps manage (from my limited knowledge about the field) quite impressive things.

Can't really discuss specifics, but training machine learning models that share data between all your cameras would be pretty difficult, for example. Also, the lifespan of the processor would be highly reduced if you were constantly hammering it (thermal implications, etc. etc.) Again, in a few years that might not be an issue anymore :)

Re: Reverse-Engineering Google Nest Devices

#77

Earlier quoted context omitted.

The price point is fairly low if you are prepared to make a hobby of it: You can do the image capture with Raspbery Pis. (1) The storage is slightly more expensive though. 1) http://blog.snapdragon.cc/2012/07/16/using-raspberry-pi-for-...

The problem with the hobbyist approach (and this is coming from someone who owns multiple Raspberry Pis) is that you most hobbyist don't really have the resources to tackle every engineering aspect of building a reliable camera. We have people dedicated to fine tuning the WiFi drivers in the device, writing scalable and secure video storage/streaming services, figuring out the thermal profile of every component in th…

...ultimately would you trust your home to something you can throw together in a few weekends?

With respect to the massive engineering effort, and acknowledging you probably didn't even realize you were doing so, I have to point out that this is an example of the extremely distasteful emotional manipulation too often used by security-related companies, and it needs to stop. Advertisements with lines of the form, "Would you trust your family's safety with anything less," or, "Nothing is too good for your children's safety," contribute to the general paranoia of society, not to mention the gross misallocation of capital based on manipulation instead of merit.

Re: Reverse-Engineering Google Nest Devices

#78

Earlier quoted context omitted.

Mea culpa: I used the term "image recognition" very haphazardly. What I meant to say was "the service provides a lot of features that are only possible through heavy analysis of the video." Have you considered the engineering effort that'd go in providing two different behaviors for the camera? Let's say we decide to support the simplest case: FTP to your local NAS. How do you format the video for it to be consumable…

Happy Dropcam/Nest owner here; y'all are doing a fine job. If people based their product's features on product/market fit research from Hacker News threads, nothing would ever sell.

Thanks! We are constantly working to make the experience better. Of course there are issues every now and then, and we are still working on fully integrating all of the Dropcam technology into the Nest family of products, but we'll get there.

Re: Reverse-Engineering Google Nest Devices

#79

Earlier quoted context omitted.

The problem with the hobbyist approach (and this is coming from someone who owns multiple Raspberry Pis) is that you most hobbyist don't really have the resources to tackle every engineering aspect of building a reliable camera. We have people dedicated to fine tuning the WiFi drivers in the device, writing scalable and secure video storage/streaming services, figuring out the thermal profile of every component in th…

...ultimately would you trust your home to something you can throw together in a few weekends? With respect to the massive engineering effort, and acknowledging you probably didn't even realize you were doing so, I have to point out that this is an example of the extremely distasteful emotional manipulation too often used by security-related companies, and it needs to stop. Advertisements with lines of the form, "Wou…

I'm the last person you'll hear using the "but think of the children!" tactic. American paranoia has been exploited for nefarious purposes long enough (I'm glad to say, I'd be surprised if you found any such message in the Nest Cam advertising campaign.)

Politics aside... it's your prerogative to buy or build any system you want. I was just clarifying why, in my personal opinion, if you really have a need for a security system, choosing a hobbyist project over a system built by a team of professionals is probably a bad idea (again, look for the article I linked before about how easy it is to "hack" into streaming baby monitors.)

Re: Reverse-Engineering Google Nest Devices

#80

Earlier quoted context omitted.

Don't mean to be dismissive, but you should be careful about that kind of setup. A lot of those companies haven't taken security seriously. This article is a stark reminder of that: http://arstechnica.com/security/2016/01/how-to-search-the-in...

That's true, and the risk of providing that DIY. The truth is that most of those come with the remote access features disabled, and when they are carelessly enabled by someone who doesn't know what they are doing this will happen. But like I said, many of those systems out of the box only broadcast to the DVR locally. EDIT: Since I see you're a Nest/Dropcam person, I'm a Honeywell guy. Haha. We can still be friends.…

Oh! Nice, I actually know a guy who works for Honeywell out of MN. He's in the Aerospace division though (just found out he's kind of a big deal... weird, I know him through my girlfriend's family and had never checked his LinkedIn page.)
Post reply on HN