50 ms·
More awful IoT stuff
- bedhead 10y ago@internetofshit is a great follow and pretty quickly illustrates just how absurd the IoT rush has become. Solutions in search of problems.
- mcphage 10y ago> Solutions in search of problems. Solutions in search of money before the market wises up to how crap these products are.
- imtringued 10y agoa bit off topic. Why can't somebody sell a reasonably priced Thunderbolt 3 eGPU enclosure. Oh right intel's certification process takes several months... All in the name of quality assurance yet most thunderbolt 3 products feel subpar considering their price.
- Panoramix 10y agoI have the same view, but there are all these companies investing billions into it, so there's something I don't see? It's like this is being rammed down everyone's throats. IoT is heralded as "the next big thing" and nobody want to miss out on it. Which means everybody is investing and developing it, which means it will probably become a reality. A self-fulfilling prophecy of sorts, which is kind of sad because IMO it's not a particularly compelling vision. There are thousands of things we could improve rather than placing chips with sensors everywhere.
- Thrymr 10y agoChips with sensors everywhere is inevitable; both are cheap and getting cheaper. The real question in my mind is whether the devices will be using proprietary protocols to communicate with centralized corporate cloud servers, or some kind of open, interoperable mesh network. Right now I don't like the way the trend is going.
- coldpie 10y agoDoes anyone still need convincing? Don't buy anything that connects to the Internet that isn't built and maintained by a major software company. Even then, be careful. Duh.
- brianwawok 10y agoNot sure if software company helps. Nest has some issues.
- Klathmon 10y ago>It's running Linux and includes Busybox and dnsmasq, so plenty of GPLed code. I emailed the manufacturer asking for a copy and got told that they wouldn't give it to me, which is unsurprising but still disappointing. Has the GPL really lost it's power that much? I mean not responding to inquiries is one thing, but outright saying no?
- mikegerwitz 10y ago> Has the GPL really lost it's power that much? It's up to the copyright holder to enforce it.
- BostonEnginerd 10y agoI don't believe that's the case. As an owner of a device with GPL code on it, you are entitled to the source as well.
- icebraining 10y agoYou are entitled by the license, but only the copyright holder can sue for the violation.
- JoeAltmaier 10y agoSo, the GPL never had much power?
- Klathmon 10y agoIf that's really how it works then does that mean that open source projects with no clear copyright owner can't enforce their license?
- JoeAltmaier 10y agoDoesn't the actual text of the license list the owner?
- Feneric 10y agoIoT devices can be fine, but there are lots of companies involved in it that don't know what they're doing and would be better off staying out of the market. I always advice friends / family to look for upgrading capabilities, ability to do useful work when not connected to the Internet proper, user control (do you own this device or effectively borrow it per licensing etc.?), and other similar things before purchasing any IoT device. Some IoT devices are great, but some are abysmal.
- Klathmon 10y agoAnd it sounds like this one was like 80% of the way there. I mean they used encryption (badly, but they still used it), had a way to update the software on the device (even if only over http), and uses passwords (although doesn't enforce them).
- pjc50 10y agoSo everything it does, it does badly? To me, that's not 80% of the way there, that's more like -80%.
- Klathmon 10y agoCome on, the last thing he reviewed sent everything in plaintext, had no root password, called out to multiple chinese servers, ran ssh via a hardcoded password that was something like a simple word, and didn't have any way of actually updating the code on the device. Oh, and it barely even functioned as a lightbulb... This is lightyears better than that, and yeah they fucked up a bunch of stuff, but it at least shows they tried. Even shitty AES is going to increase security over plaintext...
- snoman 10y agoAgreed. It may not be technically good, but it's as good as the door locks that hundreds of millions of people rely on to protect their homes every day. Most home doors/deadbolts are easily pickable with a few weeks' practice. It keeps honest people honest.
- jussaskin 10y agoIoT is all about unsecured devices generally?
- marktangotango 10y agoThat's been my understanding as well. The cpu's used typically aren't powerful enough to do anything other than simple encryption in a reasonable amount of time. Ssl is generally out of the question. Someone please educate me if that's incorrect.
- exelius 10y agoMaybe if you're talking about an Arduino (which is more of a micro controller than a full-on CPU). Anything resembling a real CPU definitely has the horsepower for SSL.
- leni536 10y agoI'm not a cryptographer, in my hobby project I used a port of nacl to AVR to do encryption. Such an IoT device doesn't need to process a large amount of data for encryption, it can be done on a 8bit uC.
- mavhc 10y agoSounds more like the companies aren't bothered enough to pay for someone who knows what they're doing in a reasonable amount of time.
- jussaskin 10y agoSome of these IoT devices are solar powered or rely on ambient electromagnetic energy and don't have enough juice to perform crypto.
- icebraining 10y agoI don't think so, but even if they were, you can buy a crypto co-processor for less than $1/unit.
- apozem 10y ago> Eventually I plugged my phone into my laptop and ran adb logcat, and the Android debug logs told me that the app was trying to modify a network that it hadn't created. Apparently this isn't permitted as of Android 6, but the app was handling this denial by just trying again. I deleted the network from the system settings, restarted the app, and this time the app created the network record and could modify it. It still didn't work, but that's because it let me give it a 5GHz network and it only has a 2.4GHz radio, so one reset later and I finally had it online. Madness. And people wonder why there's so much skepticism about IoT being adopted by non-techies.
- deelowe 10y agoAs a counter example, my brother who never uses a computer setup his chromecast in 5 minutes with zero help from me. I know b/c he called me and asked for help. I told him he wouldn't need it, but he didn't believe me. Things are getting better. There will always be more crap out there than good stuff. That's why walmart is so popular, but things will generally improve.
- deleted 10y ago[deleted]
- omni 10y agoI don't consider Chromecast as being part of IoT. Chromecast is mostly used as an internet media device, whereas I usually interpret IoT as slapping Internet capabilities on traditional appliances (light bulbs, fridges, whatever). Curious what other people think.
- seizethecheese 10y agoChromecast is slapping Internet capabilities on a traditional appliance (TV).
- omni 10y agoOnly in as much as it lets you access content streams on the Internet. It doesn't let you control your TV via the cloud or anything. In terms of functionality I think it's pretty comparable to any other content stream you can hook up to your TV, going back to Ataris and VCRs.
- diggan 10y agoSo there is a great amount of lists, blogposts and information about awful/bad IoT things, but if someone like me want to have a list about IoT things that are actually secure and well-working, where would I find that?
- Klathmon 10y agoI'd love a list like that as well, but sadly I don't think one exists and I don't think there's any money in doing it. Nobody wants to hear about good IoT devices, they want to make fun of bad ones and feel superior, that's what sells clicks. Maybe i'm just being cynical...
- ethbro 10y agoI don't think there's enough profit margin in most IoT devices to allocate to something like this. F.ex. when's the last time you saw a commercial for a door knob?
- Klathmon 10y agoI've seen multiple commercials for thermostats, smart refrigerators, a smart doorbell, and a bunch of IoT lights and light switches.
- TeMPOraL 10y agoI've been to a conference literally sponsored by a door knob manufacturer. But they don't target "end users", they target the people you hire to design and renovate your house. Similarly, the home automation solution targeted at those people usually aren't shit cloud-based products.
- wepple 10y agoI think you nailed it: hackers don't want to write blog posts saying "damn, this thing was pretty well made". Perhaps an open-source effort to document & track what work has been done, even if it's just pulling firmware images and taking a look around. Maybe some kind of gamification to motivate researchers to pull things apart and report what they see.
- FussyZeus 10y agoThere's so much potential in the market for proper, well made IoT devices that would bring around the hardcore skeptics like myself. I mean really well made products, properly encrypted with well made API endpoints that come with good apps for the uninitiated -AND- the ability to be scripted and automated by the techies. (You can do both, there's no reason why you can't and I don't understand why everyone refuses to). Oh, and not having them phone home to who-knows-where-istan around Australia, or at the very least, having the ability to TURN THAT OFF. Seriously why have NO companies come forward with products like this. I'd buy a house worth if someone did.
- ju-st 10y agoWhich problems do you want to solve with these IoT devices? What should they do? In my opinion existing IoT devices generally replace simple, proven systems with complex and abstruse ones.
- FussyZeus 10y agoA good example would be the smart outlet ones, so I could for example setup one to automatically power cycle my cable modem and router, or even one that could handle the load of a space heater I keep in my office during the winter months and switch it on 15 minutes before I get home. I don't even need the ability to manage it over the WAN, I'd be fine with just something my linux boxes at home could handle with cron jobs.
- kps 10y ago> I could for example setup one to automatically > power cycle my cable modem and router It's turtles all the way down.
- dreamcompiler 10y agoOr you could -- in theory -- just buy a router that doesn't leak memory. Finding one -- aye there's the rub.
- 10y ago
- manyxcxi 10y agoFunny timing... I just bought an LG LFXS30776S refrigerator and the first thing I noticed was that all of a sudden I had a new WiFi broadcast. Turns out that according to tech support there's no way to shut this off.
- JoeAltmaier 10y agoSure there is! Find the antenna and rip it out or short it out.
- ethbro 10y agoTransceiver, meet grounded aluminum foil?
- almostarockstar 10y agoSounds like there is a strong need for a standard OS build for IoT devices. I'm not expert in the area, but I would imagine a standard API could be implemented to handle the vast majority of use cases. Connecting to an app securely, turning things on and off, basic scheduling.
- anilgulecha 10y agoI think openwrt on the main unit (a good router) + nodemcu based sensor units would work well. Openwrt is powerful enough to take care of logging, connecting to the internet etc, and the sensor units can form a pseudo mesh using their wifi capabilities.
- throwaway7767 10y agoIdeally the base should be from a project that handles base system upgrades, so that consumers don't have to trust that the vendor is building security updates in a timely manner. Last I checked, OpenWRT did not do security updates, and it's up to the user to recompile everything if they want newer versions.
- bloaf 10y agoImagine if everything ran a Plan9-like OS. https://en.wikipedia.org/wiki/Inferno_(operating_system) https://en.wikipedia.org/wiki/Inferno_(operating_system) That gets you: 1. Communications between devices are encrypted by the OS. 2. Access to the devices are handled with simple file-permissions. 3. Feature-providing utilities can be run either locally (i.e. on the device's CPU) or remotely (on some hub-CPU.)
- ajpgrealish 10y agoCanonical have been doing work on this with Ubuntu Core http://www.ubuntu.com/internet-of-things http://www.ubuntu.com/internet-of-things
- DrNuke 10y agoJust offload your entire IoT project to a big firm / provider instead of cherrypicking devices?
- steven2012 10y agoThe stuff from wirelesstags.net are generally very good. I have a bunch of sensors and their Reed sensors for detecting opening and closing of doors are very good. I hook it up with ifttt and turn on my Hue lights when I open and close my doors. Clearly not ground breaking stuff but useful. The Hue lights are great but expensive. The Hue switch made things a lot more useful as well. I'm waiting for them to come out with a compatible light switch so I can control my recessed lights the same way as my light bulbs. What they need to work on is a better outdoor camera with motion detection that doesn't get triggered by shadows or wind moving a tree branch. I've tried almost every solution and none is acceptable.
- deleted 10y ago[deleted]
- georgehotelling 10y agoThe wirelesstags.net stuff looks good, but it also is tied to their cloud services. I couldn't find a local API to talk to their bridge device. The nice thing about Hue is that their bridge can run completely disconnected from the internet and still respond to RESTful API requests, which means that when Phillips end-of-lifes Hue my bridge will keep working with Home Assistant.
- steven2012 10y agoYes that was a concern of mine as well. They stated that if they do go out of business they would open source everything so that we could build our own solution. That's basically what convinced me to go all in with their product.
- CaptSpify 10y agoI just blogged about this yesterday. In short: > The line in the sand for me is: network vs cloud-based systems. I want things to be network connected, but I want it for my own network only. I want to be able to control my coffee pot, but only from home. If I choose to expose this over the internet, great! It's up to me to make sure it's secure. I don't want anyone making that decision for me. I also want it to be upgradeable, and hackable. I'm willing to pay a lot of money for standalone quality devices, but nobody is supplying!
- ksk 10y ago> I'm willing to pay a lot of money for standalone quality devices, but nobody is supplying! You could pay an amateur electronics hacker to make you such devices.
- CaptSpify 10y agoWell, I've been building my own with rpi's and whatnot. But I'd love to save time and just buy an off-the-shelf product that's been thoroughly tested, etc.
- blacksmith_tb 10y agoAgreed, I am following the same route. In many cases, I want my gadgets net-enabled primarily for timekeeping, since a lot of automation for me is really scheduling (and having to manually trigger things remotely is an edge case).
- bgentry 10y agoThe network model you describe sounds just like Apple's HomeKit.
- CaptSpify 10y agoIs that compatible with non-apple devices? I generally dislike apple philosophically, so I avoid their products.
- jsondata 10y agoI also mentioned this in a recent blog post: https://www.jsondata.io/blog/2016/iot-needs-a-cloud/ https://www.jsondata.io/blog/2016/iot-needs-a-cloud/ > Right now, the cloud - especially for IoT - isn't a healthy ecosystem. Your shiny new smart thermostat might as well be dialing into AOL on a dedicated landline. And unlike public services, these proprietary service providers lack long-term guarantees of service availability. > What we need is a push for openness and interoperability in the cloud, and that will only happen if consumers demand it. The service providers are incentivized to do just the opposite.
- daveguy 10y ago>What we need is a push for openness and interoperability in the cloud Personally I think that is the opposite of what we need. Most IoT devices should be local-network-only. So if by cloud you mean a personal cloud (local network or VPN), then yes, I agree. Otherwise keep the interwebs away from my thermostat.
- jsondata 10y agoThat's a fair point, and I agree. However, the reality is that a major selling point for these things is along the lines of "control it from anywhere", and whether people actually need remote access or not, it seems that a lot of consumers still see it as a major upside. Maybe what we really need are more consumer-friendly, self-hosted (and secure) home VPN options. That way you can just run your services on the local network, and still have remote access without opening your devices to the world (or to other companies' servers). Until the average grandma can do that, the "personal cloud" idea will probably be overshadowed by manufacturers' desire to provide proprietary remote access options, because those go hand-in-hand with things like subscription pricing models, data mining, etc.
- theseatoms 10y agoThis sounds like the intended use case for urbit.
- tdkl 10y ago
- peterwwillis 10y agoHas anyone ever bought a consumer network appliance that didn't have shitty security?
- source99 10y agoHas a security engineer ever reviewed anything that had good security?
- peterwwillis 10y agoYes, but mainly commercial stuff. It costs 3-10x what the consumer appliances cost but it's usually actually secure and stable. Aruba, Ruckus, Cisco, Meru, etc.
- ufmace 10y agoHold on - it sounds like this thing is running Android. Has reference to connecting with ADB, apks, and Android versions. But it's also running a SSH server and OpenWRT? What's going on there, is it running 2 different OSes for some reason, or did they somehow merge Android and OpenWRT?
- janjongboom 10y agoThe app is running Android, the device is OpenWRT as far as I understand.
- komali2 10y agoWasn't he referring to the phone app that integrates with the plug? I wasn't sure either.
- dimino 10y agoSorry, but what does he mean by "infringing on my copyright"? Is he the author of one of the libraries it uses?
- nkg 10y agoI enjoy reading this kind of article about lousy security, because I say to myself "Wow, that was lousy!" and laugh. BUT I still don't know how I could avoid this. I genuinely ask: could anyone share with me the "2016 Guide of the best pratices for securing an API/ a web app"?
- jimktrains2 10y agoTLS + Client Certs + EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
- pandemicsyn 10y agoYou forgot to mention +[Vault|CFSSL|XYZ] for cert management.
- jimktrains2 10y agoI can find what CFSSL[1] and Vault[2] are, but not XYZ in this context. Also, all of this can be done with plain openssl, there is no need for additional tools. [1] https://blog.cloudflare.com/introducing-cfssl/ https://blog.cloudflare.com/introducing-cfssl/ [2] https://www.vaultproject.io/intro/ https://www.vaultproject.io/intro/
- mschuster91 10y agoI'd like regulation agencies to mandate, as a condition of market entry, for each and every electronic product: 1) Full firmware source code and required toolchains/sign keys/... be submitted to the national libraries, to be kept for secure archival until the device is officially unsupported by the manufacturer. 2) For networked products, the full source code must be either published, or licensed institutes must perform a security check. 3) There must be provisions in place to ensure timely reactions in case of security issues. If the manufacturer does not respond to security issues, national libraries have the right to release the source code. 4) Required tools, service manuals, datasheets etc. must be submitted to the national libraries. This should basically kill off GPL-abusing companies, as well as ensure serviceability, even for discarded products.
- Finnucane 10y agoInterestingly, Underwriters Laboratory is starting to get into this game: http://www.ul.com/cybersecurity/ http://www.ul.com/cybersecurity/ How good or useful this will be I don't know. But clearly they see this as an area where people will be looking for some expert help; not everyone has the skill of a Linux kernel hacker to check these things for themselves.
- stcredzero 10y agoThe short version: they introduced terrible vulnerabilities on your network, they violated the GPL and they were also just bad at being... Overall: the hardware seems fine, the software is shoddy and the security is terrible This article begins and ends with two great tl;dr for IoT. There is value in this. Just look at the prevailing cluelessness, and be much better than that to stand out from the pack. In fact, how about applying that formula to the next nascent big thing that comes along?
- adyus 10y agoPerhaps because the large mass of consumers only care about the first point (how the hardware looks in their home)? Point two comes in play only if the user experience is horrible, otherwise it's acceptable. Regular consumers rarely think about point three.
- stcredzero 10y agoI wasn't suggesting consumers think about these issues. I was suggesting that founders think about them!
- TeMPOraL 10y agoThere's that Upton Sinclair quote about understanding and salary... The point being, the business model of IoT is literally lending you a device that due to purposefully shitty engineering is not useful if you're not paying the rent. I wish there'd be a founder that cares about making stuff that's primarily delivering value to the customer, but in IoT space, I'm yet to hear about one.
- SEJeff 10y agoShameless plug to a 100% OSS IoT / home automation system I contribute to that agrees. Everything IoT should be fully open source and not rely on cloud connections: https://home-assistant.io/blog/2016/04/05/your-hub-should-be-local-and-open/ https://home-assistant.io/blog/2016/04/05/your-hub-should-be...
- Serow225 10y agoAlright so this is mostly OT, but I figured people who are into IoT might be able to help; does anyone know of a setup that would easily let me control a remote AC outlet by plugging a sensor into an existing hard-switched AC outlet? I'd rather not deal with installing a hub and programming scenes etc. Thanks!
- alexmingoia 10y agoThe principal reason devices need to be connected is so that business can hold your devices ransom and charge you money to use them. Turn on lights with a phone? No need for Internet. Open doors with a fingerprint? No need for Internet. An auto-adjusting energy-saving thermostat? No need for Internet. A fridge that knows the milk is low? No need for Internet. Charge people money to use their toaster? You need the Internet for that.
- saulr 10y agoCompletely agree except the light argument -- having my lights cloud connected allows me to control them remotely. The main use for this is for time or sunrise/sunset scheduling. However you could quite easily architecture this without cloud connectivity, it seems easiest to keep the bulb dumb and keep the 'smarts' elsewhere (whether that's on a phone locally or a server in the cloud).
- TeMPOraL 10y agoScheduling isn't stock market, you don't need a live feed for that. All such a bulb needs is an accurate date and time source - the rest, including (if you also add one-time geographical area input) the sunrise/sunset times can be determined with a little bit of trivial math on the uC that said "smart" bulb already has. All that IoT stuff doesn't need Internet access. Hell, most of it doesn't need much of a network at all, but just having them default to intranet would deliver all the value without the problems (and the rent-seeking).
- bschwindHN 10y agoI would say the principal reason they need to be connected is because consumers expect it. But yes, some unscrupulous businesses will take advantage of that. People need to vote with their money and not buy from companies that do this.
- TeMPOraL 10y agoConsumers don't expect it, but they are being told they should. That's marketing at work, literally trying to create the market for this shit-engineering non-solutions.
- m12k 10y agoI feel that the people who are now talking about IoT are the same people who were totally into 'semantic web' back in the day. And it's pretty much the same kind of story: "Wouldn't it be neat if all these systems could interoperate?" and again the answer is "Yes, but not neat enough justify the cost and hassle of actually making it happen".
- jbpetersen 10y agoI think we're due for a proper realization of the semantic web in the next couple years. Things seem about at the point where the cost and hassle can be overcome without a significant financial motivation to do so. Maybe in another decade or so IoT will make sense other than as something fun to experiment with.
- Chris2048 10y agoI'm enthusiastically waiting for this: https://espressif.com/en/products/hardware/esp32/overview https://espressif.com/en/products/hardware/esp32/overview oh baby!
- Wi11Jeffries 10y agoThere is definitely a lot of IoT stuff coming out that isn't great. However MFT companies like Aspera, Innorix, and Attachmate must be loving it~