I am a simple man. When I see people buy devices with Zigbee, Z-Wave, or other fully local protocols, I nod. When I see people reward vendors that lock in with their money, I shake.
It's not always that simple. I have a bunch of devices in my home that have WiFi IoT: bedroom AC, dehumidifier, refrigerator, and washer/dryer. I bought all of them regardless because they work fine without WiFi and I've never connected them. I'd love it if I could connect them to Home Assistant without data leaving my network. Reverse engineering them is on my list of future projects.
In the meantime they continue to function as "dumb" devices just fine.
What I don’t like about Zigbee though is that it is on the Wifi band so every device with wifi antenna can snoop on it. Even assuming the protocol is secure, anyone can infer patterns and devices based on traffic shape. For example, a motion sensor that sends data whenever someone walks by. In the end, nothing beats physical wires in terms of privacy and reliability if I understand correctly.
How do you feel about Matter [1]? Asking as someone all in on Home Assistant, open local protocols, and ready to reverse engineer and spend whatever is needed for digital sovereignty, for both myself and the community.
In my experience, Matter is okay except that it’s built over IP and manufacturers seem to be unable to resist using that juicy IP connection to talk to the Internet.
Thread should not have allowed Internet connectivity by default.
(Not the OP, but want to spread awareness, sorry.) The Wikipedia page already lists the greatest disadvantage:
> (..) the ability to commission a finished product into a Matter network in the field mandates certification and membership fees, entailing both one-time, recurring, and per-product costs. This is enforced using a public key infrastructure (PKI) and so-called device attestation certificates.
Matter is designed to necessitate phoning into the internet for certification, which allows all manufacturers to just easily add-in phoning into the internet for telemetry. Furthermore, it does not define exactly which functionality must remain if a device is disconnected from the internet for a long time (assuming the user is trying to avoid sending out telemetry, not even bypassing certification).
I am a simple man. I don't buy smart devices, mostly. Offline only is completely acceptable.
The connected home was an idealistic dream that has been made perverse by the Zucks and Elons of the world. It is not accessible for normal people and it might never be - at least, not without the blood sacrifice of your privacy.
Sometimes manufacturers bake in the expected revenue from snooping into the price of the device. That can lead to better hardware at cheaper prices, that then you can liberate and use offline.
I used to have a small counter-top dishwasher that relied on proprietary soap cartridges. The dishwasher itself was fairly good and effective, and after hacking the cartridges to allow them to be refilled the overall price was quite acceptable!
In the larger picture, it's because the tech industry started packaging every imaginable piece of hardware as a loss leader for subscription services. That's a big reason why it's really hard to get a high quality dumb TV.
Hopefully, hopefully this new trend can break the cycle of using software to turn things into subscription services that should never be subscription services. I'm terrified that manufactures will respond with hardware encryption and legal maneuvering, but perhaps by then there will be an even larger and thriving ecosystem of open hardware as the ease of setting it up and integrating it with AI accelerates its adoption.
I don't mind the app functionality of my air purifier. I get a push notification when air quality degrades, and I can see data and charts of air quality over time. I can change the settings remotely, which is nice because I have a small child and keep the "lock" function set for the actual controls.
It's easier to setup and maintain schedules, routines, or more complex functionality.
It's certainly not critical functionality, but it's nice. Same with my laundry machine and dryer sending a push notification when the cycle ends. Unnecessary, but nice.
> The fan downloads its root CA cert over plain HTTP. It was always MitM-able.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
Similarly, how easy things are for more people to do. I'm certainly not advocating for pulling in a root CA over HTTP, but before LLMs could make this knowledge trivial, how many people would even think to look at that angle. It's democratizing in an interesting way.
I took a Vornado TRANSOM, a Broadlink RM4, and a Shelly Smart Plug, a Qingping Air Quality Monitor Gen 2 + claude and HASS, and now I have a fan that turns itself on when the CO2 level gets too high.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
I have 2 Coway air purifiers, they have no cloud stuff. They work really well.
While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
>> Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
I just occasionally move them. I know it is working because the pre-filter needs cleaning often enough. Does it really need "monitoring"?
One of the nice things about air purifiers, unlike owning a boat or leaving a stove on, is that its never going to surprise you in a bad way. You don't need to really monitor anything, it will just purify some air. Do you really want to be bringing that under the umbrella of the stuff you monitor? Maybe this is an irreconcilable difference and we cannot see it the other person's way.
I love how it has become a trend now to take some device that required a cloud subscription, reverse engineer it, then connect it to your own server you control.
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
Enjoy it while you can. You can see the AI companies have already started the process of locking us out of this, with Opus 5.5.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
Just use abliterated/uncensored self-hosted models. This is why we need them and the hardware to run them. Yes, the API models which will further close the walled gardens will evolve faster than the open-weights ones, but I'm hopeful about the community as a hole rejecting this status quo.
An RTX4090 or a 128gb macbook can generate a pretty reasonable number of tok/sec. Those are not cheap, but within the realm of serious hobbyist. I really hope the AI bubble deflates a bit so consumers can get more powerful hardware at the low thousand $ range.
OpenAI and Anthropic models seem to be the most affected by these barriers, from my own experience.
Mistral, QWEN, and other models (read non-American) tend to have little to no restrictions. There were some tasks where I was actively trying to sabotage my own local network and Mistral had no issue helping. Anthropic and OpenAI refused outright or had to be "convinced" but would often hit further barricades along the way.
> So this only works on products that was developed before ~now.
You're under the assumption that the companies producing these give a shit about security. It'll probably increase a bit but I doubt it will be by much. If they have shipped devices that leave the doors wide open for almost any intrusion, they won't invest engineering/AI time and money to make these better than before and certainly won't review the code that the model spit out beyond a quick check if the promised base functionality still works.
I have a light with a controller on the cord: brightness up/down, power. I can't use a smart plug with it because it always defaults to off. Any ideas?
Cut the controller off and use the smart plug to control brightness. You might need to open it up and replace the power supply.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
Coway are some of the best, and there are many dumb models without internet access at all
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts
Unironically a gift. On your own home network, the one most likely to MITM you is yourself. And eMudhra's fuckup allows for a nice attack on a few devices you'd otherwise have to disassemble to pwn.
By buying the device and then breaking the lock-in, one does more harm to the anti-consumer device manufacturer than had they done nothing at all.
In the meantime they continue to function as "dumb" devices just fine.
[1] https://en.wikipedia.org/wiki/Matter_(standard)
Thread should not have allowed Internet connectivity by default.
> (..) the ability to commission a finished product into a Matter network in the field mandates certification and membership fees, entailing both one-time, recurring, and per-product costs. This is enforced using a public key infrastructure (PKI) and so-called device attestation certificates.
Matter is designed to necessitate phoning into the internet for certification, which allows all manufacturers to just easily add-in phoning into the internet for telemetry. Furthermore, it does not define exactly which functionality must remain if a device is disconnected from the internet for a long time (assuming the user is trying to avoid sending out telemetry, not even bypassing certification).
The connected home was an idealistic dream that has been made perverse by the Zucks and Elons of the world. It is not accessible for normal people and it might never be - at least, not without the blood sacrifice of your privacy.
I used to have a small counter-top dishwasher that relied on proprietary soap cartridges. The dishwasher itself was fairly good and effective, and after hacking the cartridges to allow them to be refilled the overall price was quite acceptable!
Hopefully, hopefully this new trend can break the cycle of using software to turn things into subscription services that should never be subscription services. I'm terrified that manufactures will respond with hardware encryption and legal maneuvering, but perhaps by then there will be an even larger and thriving ecosystem of open hardware as the ease of setting it up and integrating it with AI accelerates its adoption.
It's easier to setup and maintain schedules, routines, or more complex functionality.
It's certainly not critical functionality, but it's nice. Same with my laundry machine and dryer sending a push notification when the cycle ends. Unnecessary, but nice.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Need to try to get Sonoff bridge rigged up next but have been busy messing with Hatch alarm
While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
One of the nice things about air purifiers, unlike owning a boat or leaving a stove on, is that its never going to surprise you in a bad way. You don't need to really monitor anything, it will just purify some air. Do you really want to be bringing that under the umbrella of the stuff you monitor? Maybe this is an irreconcilable difference and we cannot see it the other person's way.
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
I hear this a lot but I've never hit this.
For weeks now I've been working on a shared recompilation project of Switch 1 and 2 games, and Opus 5.5 has handled that with no issue.
Over 10 supported Switch 1 games, and 3 supported Switch 2 games, and never once has Opus 5.5 denied anything
Mistral, QWEN, and other models (read non-American) tend to have little to no restrictions. There were some tasks where I was actively trying to sabotage my own local network and Mistral had no issue helping. Anthropic and OpenAI refused outright or had to be "convinced" but would often hit further barricades along the way.
So this only works on products that was developed before ~now.
The solution is to not buy crap regardless if you can make it work or not.
You're under the assumption that the companies producing these give a shit about security. It'll probably increase a bit but I doubt it will be by much. If they have shipped devices that leave the doors wide open for almost any intrusion, they won't invest engineering/AI time and money to make these better than before and certainly won't review the code that the model spit out beyond a quick check if the promised base functionality still works.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
The relay clicking is a feature so you can tell the brightness audibly :)
I am tired of having dust everywhere.
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts