I am a simple man. When I see people buy devices with Zigbee, Z-Wave, or other fully local protocols, I nod. When I see people reward vendors that lock in with their money, I shake.
It's not always that simple. I have a bunch of devices in my home that have WiFi IoT: bedroom AC, dehumidifier, refrigerator, and washer/dryer. I bought all of them regardless because they work fine without WiFi and I've never connected them. I'd love it if I could connect them to Home Assistant without data leaving my network. Reverse engineering them is on my list of future projects.
In the meantime they continue to function as "dumb" devices just fine.
What I don’t like about Zigbee though is that it is on the Wifi band so every device with wifi antenna can snoop on it. Even assuming the protocol is secure, anyone can infer patterns and devices based on traffic shape. For example, a motion sensor that sends data whenever someone walks by. In the end, nothing beats physical wires in terms of privacy and reliability if I understand correctly.
How do you feel about Matter [1]? Asking as someone all in on Home Assistant, open local protocols, and ready to reverse engineer and spend whatever is needed for digital sovereignty, for both myself and the community.
In my experience, Matter is okay except that it’s built over IP and manufacturers seem to be unable to resist using that juicy IP connection to talk to the Internet.
Thread should not have allowed Internet connectivity by default.
(Not the OP, but want to spread awareness, sorry.) The Wikipedia page already lists the greatest disadvantage:
> (..) the ability to commission a finished product into a Matter network in the field mandates certification and membership fees, entailing both one-time, recurring, and per-product costs. This is enforced using a public key infrastructure (PKI) and so-called device attestation certificates.
Matter is designed to necessitate phoning into the internet for certification, which allows all manufacturers to just easily add-in phoning into the internet for telemetry. Furthermore, it does not define exactly which functionality must remain if a device is disconnected from the internet for a long time (assuming the user is trying to avoid sending out telemetry, not even bypassing certification).
I am a simple man. I don't buy smart devices, mostly. Offline only is completely acceptable.
The connected home was an idealistic dream that has been made perverse by the Zucks and Elons of the world. It is not accessible for normal people and it might never be - at least, not without the blood sacrifice of your privacy.
In the larger picture, it's because the tech industry started packaging every imaginable piece of hardware as a loss leader for subscription services. That's a big reason why it's really hard to get a high quality dumb TV.
Hopefully, hopefully this new trend can break the cycle of using software to turn things into subscription services that should never be subscription services. I'm terrified that manufactures will respond with hardware encryption and legal maneuvering, but perhaps by then there will be an even larger and thriving ecosystem of open hardware as the ease of setting it up and integrating it with AI accelerates its adoption.
I don't mind the app functionality of my air purifier. I get a push notification when air quality degrades, and I can see data and charts of air quality over time. I can change the settings remotely, which is nice because I have a small child and keep the "lock" function set for the actual controls.
It's easier to setup and maintain schedules, routines, or more complex functionality.
It's certainly not critical functionality, but it's nice. Same with my laundry machine and dryer sending a push notification when the cycle ends. Unnecessary, but nice.
> The fan downloads its root CA cert over plain HTTP. It was always MitM-able.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
Similarly, how easy things are for more people to do. I'm certainly not advocating for pulling in a root CA over HTTP, but before LLMs could make this knowledge trivial, how many people would even think to look at that angle. It's democratizing in an interesting way.
I took a Vornado TRANSOM, a Broadlink RM4, and a Shelly Smart Plug, a Qingping Air Quality Monitor Gen 2 + claude and HASS, and now I have a fan that turns itself on when the CO2 level gets too high.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
I love how it has become a trend now to take some device that required a cloud subscription, reverse engineer it, then connect it to your own server you control.
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
Enjoy it while you can. You can see the AI companies have already started the process of locking us out of this, with Opus 5.5.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
Just use abliterated/uncensored self-hosted models. This is why we need them and the hardware to run them. Yes, the API models which will further close the walled gardens will evolve faster than the open-weights ones, but I'm hopeful about the community as a hole rejecting this status quo.
An RTX4090 or a 128gb macbook can generate a pretty reasonable number of tok/sec. Those are not cheap, but within the realm of serious hobbyist. I really hope the AI bubble deflates a bit so consumers can get more powerful hardware at the low thousand $ range.
I have a light with a controller on the cord: brightness up/down, power. I can't use a smart plug with it because it always defaults to off. Any ideas?
Cut the controller off and use the smart plug to control brightness. You might need to open it up and replace the power supply.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
Coway are some of the best, and there are many dumb models without internet access at all
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts
Unironically a gift. On your own home network, the one most likely to MITM you is yourself. And eMudhra's fuckup allows for a nice attack on a few devices you'd otherwise have to disassemble to pwn.
In the meantime they continue to function as "dumb" devices just fine.
[1] https://en.wikipedia.org/wiki/Matter_(standard)
Thread should not have allowed Internet connectivity by default.
> (..) the ability to commission a finished product into a Matter network in the field mandates certification and membership fees, entailing both one-time, recurring, and per-product costs. This is enforced using a public key infrastructure (PKI) and so-called device attestation certificates.
Matter is designed to necessitate phoning into the internet for certification, which allows all manufacturers to just easily add-in phoning into the internet for telemetry. Furthermore, it does not define exactly which functionality must remain if a device is disconnected from the internet for a long time (assuming the user is trying to avoid sending out telemetry, not even bypassing certification).
The connected home was an idealistic dream that has been made perverse by the Zucks and Elons of the world. It is not accessible for normal people and it might never be - at least, not without the blood sacrifice of your privacy.
Hopefully, hopefully this new trend can break the cycle of using software to turn things into subscription services that should never be subscription services. I'm terrified that manufactures will respond with hardware encryption and legal maneuvering, but perhaps by then there will be an even larger and thriving ecosystem of open hardware as the ease of setting it up and integrating it with AI accelerates its adoption.
It's easier to setup and maintain schedules, routines, or more complex functionality.
It's certainly not critical functionality, but it's nice. Same with my laundry machine and dryer sending a push notification when the cycle ends. Unnecessary, but nice.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Need to try to get Sonoff bridge rigged up next but have been busy messing with Hatch alarm
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
I hear this a lot but I've never hit this.
For weeks now I've been working on a shared recompilation project of Switch 1 and 2 games, and Opus 5.5 has handled that with no issue.
Over 10 supported Switch 1 games, and 3 supported Switch 2 games, and never once has Opus 5.5 denied anything
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
The relay clicking is a feature so you can tell the brightness audibly :)
I am tired of having dust everywhere.
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts