Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

github.com

Post reply on HN
Print view View original

91–100 of 146 posts

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#91

Post by tracker1 »

EvanAnderson wrote: post #83
forgotusername6 wrote: post #73

Earlier quoted context omitted.

Does it not use TLS? Wouldn't the Nest have to trust a CA willing to issue certificates without proving ownership?

They're also injecting a CA bundle so, presumably, they're in including their own root of trust so they can sign their own certificate. I'm on mobile and can't easily look at what they're including. Edit: Guess I've got openssl in my termux environment. They're injecting a fake Nest root CA key. Makes sense. I'm shocked it was this easy to subvert the root of trust on these devices. I would expect a newer device woul…

I'm glad they didn't go that far... I wouldn't want that to get into a home device as long as it requires physical access to bypass/update the security in place. I'm really not a fan of excessively locked down hardware.

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#92

Post by gruez »

torginus wrote: post #56
Aurornis wrote: post #20

Earlier quoted context omitted.

> I am not hopeful they will be able to write custom firmware for the thermostats. If you read the GitHub Readme (typically a better way to judge a project than stalking someone on LinkedIn) you can see that they didn’t write a custom firmware. They modified the Nest firmware to contact different back end servers. The firmware is the same (they claim) except for modifications to change which server is contacted. They…

Sounds fishy, if the device allows this sort of fakery, that means the traffic is vulnerable to some sort of MITM attack by DNS poisoning/packet rerouting, which is somewhat disconcerting.

>that means the traffic is vulnerable to some sort of MITM attack by DNS poisoning/packet rerouting

Because it uses https? OP gets around this by manually injecting his certificate, but if you have physical access to a device it's generally considered to be game over in most threat models.

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#93

Post by baby_souffle »

matthewfcarlson wrote: post #79

Are they good options for cloud-freeish thermostats? I have two units (one for upstairs and one for downstairs). We have two nests but they’re so frustrating. I’ve lobotomized the “smart behavior” as much as a I can. I want a thermostat that connects to the home assistant I already have

> Are they good options for cloud-freeish thermostats?

There are connected thermostats that do not feature a WiFi radio. I don't like zwave (I would really prefer WiFi with a HTTP or MQTT interface) but there is no thermostat that a) has a modern/working WiFi radio and b) a documented API.

Venstar is the only company that makes WiFi with an API but they seem to use the cheapest possible WiFi radios and I could never get mine to stay connected to my network for more than an hour or two. They also had a _really unusual_ firmware architecture: it was linux with a stripped down web browser; the UI was a SPA and it used some lua or js (don't recall, sorry) to communicate to the hardware driving GPIOs. They did expect firmware updates to be signed and that's where I stopped looking and moved on to a zwave thermostat.

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#94

Post by gruez »

EvanAnderson wrote: post #83
forgotusername6 wrote: post #73

Earlier quoted context omitted.

Does it not use TLS? Wouldn't the Nest have to trust a CA willing to issue certificates without proving ownership?

They're also injecting a CA bundle so, presumably, they're in including their own root of trust so they can sign their own certificate. I'm on mobile and can't easily look at what they're including. Edit: Guess I've got openssl in my termux environment. They're injecting a fake Nest root CA key. Makes sense. I'm shocked it was this easy to subvert the root of trust on these devices. I would expect a newer device woul…

>I would expect a newer device would have the trust root pinned in hardware (TPM, etc) and firmware updates would be have been authenticated.

All those things cost money in hardware or development time, so companies basically never bother. You're probably also letting all the stories about DRM on phones or whatever color your experience on IOT as a whole. TPM basically makes no sense to implement on anything that's not a PC. Not even phones use it.

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#95

Post by xeromal »

honkostani wrote: post #82
xeromal wrote: post #80

Earlier quoted context omitted.

> PS: Sorry for being so negative... perhaps the release should have been delayed until all of this is opened up. This is one of the major problems with doing anything good online. People like this.

Hey, this is just normal behavior in the dark forest of proprietary software- if good things happen, they are out to get you, some angler out to get you.

Don't let perfection be the enemy of good

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#97

Post by tomhow »

torginus wrote: post #48

[flagged]

Please don't fulminate on HN. You can make these points without the rage; the guidelines require that if we're going to participate here. They also ask us to avoid generic tangents. This post is about an open-source firmware to run on devices, not people's motivation to buy the devices in the first place.

https://news.ycombinator.com/newsguidelines.html

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#98

Post by quickthrowman »

mikkupikku wrote: post #50
StephenHerlihyy wrote: post #38

Living in a cold room with an evil presence is better than roasting in hell with an angry wife.

This is why I hate digital thermostats. With the old classic round Honeywell thermostats you could turn the dial a fraction of a degree when nobody was looking and "boil the frog" to get a reasonable temperature. With digital thermostats, you can only change the temperature in discrete steps which will be immediately noticed. > Why does it say 74?? I had it set to 75!!1!

>Why does it say 74?? I had it set to 75!!1!

This is where you start explaining what hysteresis is and wait for their eyes to glaze over before changing the subject ;)

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#99

Post by subscribed »

gruez wrote: post #94
EvanAnderson wrote: post #83

Earlier quoted context omitted.

They're also injecting a CA bundle so, presumably, they're in including their own root of trust so they can sign their own certificate. I'm on mobile and can't easily look at what they're including. Edit: Guess I've got openssl in my termux environment. They're injecting a fake Nest root CA key. Makes sense. I'm shocked it was this easy to subvert the root of trust on these devices. I would expect a newer device woul…

>I would expect a newer device would have the trust root pinned in hardware (TPM, etc) and firmware updates would be have been authenticated. All those things cost money in hardware or development time, so companies basically never bother. You're probably also letting all the stories about DRM on phones or whatever color your experience on IOT as a whole. TPM basically makes no sense to implement on anything that's n…

Secure phones use it. IPhones (Secure Enclave), Pixels (Titan M2).... Yeah, that's not much....

Re: NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware

#100

Post by dgacmu »

ternus wrote: post #54

What's the go-to recommendation for smart thermostats with local control (no cloud) + Home Assistant these days? Claude suggests Ecobee + Homekit. Z-Wave seems to be another popular option. What are people using?

I've switched 3 of my 4 nests to a z-wave thermostat and I'm really happy[1] with it so far. The Honeywell T6 pro. I got them used for about $56 each and they were in near-perfect condition.

[1] With one exception, which is really niche to me: The T6 has what looks like a PID-style control algorithm hiding in it, and instead of specifying a deadband between on/off, you can only specify a max number of cycles per hour. I already have a home-brewed PID algorithm controlling the temperature target of my boiler, so I actually _want_ a stupider thermostat that will stay on/off a little longer. But this is purely because I'm weird. The T6 is really good at keeping the temperature on target, and the homeassistant integration was fast and easy and has been totally solid. I recommend - I'm just waiting for the last one to arrive and I will have completely replaced my Nests (gen2 + gen3).

I'll also add that the local UI on the T6 is much better than the one on the nest. And the installation process was really simple -- Honeywell clearly learned from Nest on this one, and then beat them with the UI. I'm really happy with the upgrade, even though I'm totally annoyed with Google for wrecking my perfectly functional thermostat.

Post reply on HN