19 ms·
Mozilla announces an open gateway for the internet of things
- ausjke 9y agoSo mozilla wants to part of the new "Web of Things". https://iot.mozilla.org/gateway/ https://iot.mozilla.org/gateway/ https://iot.mozilla.org/wot/ https://iot.mozilla.org/wot/
- deleted 9y ago[deleted]
- feistypharit 9y agoUnfortunately, it doesn't say how it'll be secured. With everything in your house, using normal https is still a problem.
- ohazi 9y ago> using normal https is still a problem Care to elaborate?
- fmntf 9y agoI'm not sure what the original commenter meant; however TLS is useful only when talking with your own server. What about other connections? NTP, DNS etc are all unencrypted (read: unsigned). Google "DNS client CVE" for instance. Or what about SSH? It may not be accessible from the Internet, but still exploitable from an infected host in the LAN. Someone has to keep all that software updated. In those conditions, I would never connect a RaspberryPI or similar to my door / gate / car / ...
- komali2 9y agoHow is SSH exploited from an infected host within the LAN?
- fmntf 9y agoIf you connected an IoT device in the same network of an infected PC, the infected PC can talk to the IoT device directly if you do not block traffic somehow (eg. a firewall). Are there open ports with buggy services? Probably not today, what about in ten years?
- deadbunny 9y agoI assume they mean you can only ssh from your local network, the IoT device gets pwnd, it's on the same network as the rest of your computers, someone can use the IoT device as an entry point into your network. Easily solved with separate networks or vlans etc...
- IncRnd 9y ago> however TLS is useful only when talking with your own server. Are you saying that for the most trusted servers TLS is needed, but less trusted servers can be spoken to with less security?
- fmntf 9y agoNo no no. I am stating that, while TLS is good, your device will use other unprotected connections too (both on LAN and WAN) unless something else is done. until bugs or weaknesses are found, see SSL v1/2/3 deprecation, heartbleed, etc
- tonyarkles 9y agoI have no idea if this is what the OP is referring to, but it's pretty much impossible to use HTTPS on your home network without managing your own Root CA and somehow managing to get certificates signed by that Root CA into your devices. You've got a fighting chance in a corporate network where you can deploy and manage the Root CA via Active Directory/Group Policy, but managing it at home with consumer-grade devices... not gonna be a good day.
- deadbunny 9y agoDomains are cheap and Lets Encrypt should be dishing out wildcards by the end of the month[1]. Maybe not the perfect solution for most users though. Personally I've been running my own domain + wildcard for a few years, it'll be nice to remove the cost of the wildcard from the setup. 1. https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...
- tonyarkles 9y agoThat will be awesome! I'm assuming they're still going to need to get refreshed on a regular basis, but this is a great step in the right direction!
- deadbunny 9y agohttps://www.w3.org/TR/wot-security/ https://www.w3.org/TR/wot-security/
- ghusbands 9y agoI imagine it will get cancelled, like Persona and Firefox OS did. The interesting, large side projects seem to go that way.
- msla 9y agoOr it will be used to deliver ads, like Firefox was.
- jacquesm 9y agoThunderbird.
- kbenson 9y agoI take it you mean that as a rebuttal, because Thunderbird is still being released? At first I thought you were just offering another example of something cancelled, and I was pretty sure (but not positive) Thunderbird was still around. It is.
- rectang 9y agoRust? If Persona counts, then so should Rust.
- book_mentioned 9y agoPersona was a core enabler of version v.next?
- fimdomeio 9y agoWhat I keep failing to see is how does IOT improves anyone's life. It can simplify peoples lives but does it improve? Mozilla could have an important role, which I think is more important than standards. Right now I only see this fad as let's sell some gadgets that will get us free data about millions of people so they can get inside the house at the sound of their favorite tune.
- codezero 9y agoI don't have an answer for you, but many things didn't improve peoples' lives when they were created. Powered flight didn't become something meaningful when it was first achieved. The Internet wasn't built to improve peoples' lives either, but once in the hands of people, can be used to do that. Certainly some IoT device will improve peoples' lives, and some IoT device (or many) may make them worse. If you figure out how to make IoT improve peoples' lives, you may be able to make some money though :)
- shinratdr 9y agoI think "improve" is a very subjective and lofty standard to hold these things to. I think "simplify" is correct, and most people would see simplification as an improvement. There is definitely something magical about leaving your house and having your lights shut off and your door lock automatically, then coming home after a long day and having your door unlock and lights come back on. It's not such a drastic improvement or change, but it feels like attention to detail. IMO, reducing the number of things I have to think about on a daily basis to live my life is an improvement.
- culturestate 9y ago> It's not such a drastic improvement or change, but it feels like attention to detail I call this “life UX,” and you’re exactly right about the way these small, subtle changes add up to surprisingly significant improvements.
- Angostura 9y agoAlternatively, when I contemplate a world where I need to apply firmware upgrades to my light switches, worry about having to set firewall rules for my front door lock, and ponder what will happen if my letterbox vendor goes out of business and turns of their server - the sheer unadulterated, mechanical simplicity of taking a piece of shaped metal out of my pocket, flicking a light switch and then closing my front door by inserting said pice of metal into a small hole is just so very, very attractive. The lack of cognitive load is just magical
- walterbell 9y ago> It’s important to note that all of this runs on your own gateway in your house. Google or Amazon can’t see when you turn on the light using your voice. Is the RPi gateway capable of local speech recognition that can compete with Siri, Alexa, Google? That seems unlikely, unless it has a dedicated processor for that purpose.
- ocdtrekkie 9y agoI would guess not, but Mozilla will probably wrap this in with https://voice.mozilla.org/ https://voice.mozilla.org/ <- that project at some point. Personally, I'm not one for using Pis as computers, because I have always running computers at home anyways. I'm quite confident my computer can handle adequate voice recognition, though most companies today have avoided developing solutions that run locally.
- weberc2 9y agoIt's pretty nice that an RPi only consumes .35W though. :) EDIT: Fixed typo
- peterwwillis 9y agoHave any of Mozilla's projects outside of Firefox actually survived for any length of time? Thunderbird? Is Bugzilla still around? I can't think of anything else.
- fenwick67 9y agoMozilla's MDN is the only reliable place (outside of the w3c documents themselves) to get web documentation
- philipwhiuk 9y agoMDN is rapidly becoming Mozilla's core product to me.
- pcwalton 9y agoRust.
- IncRnd 9y agoThe first stable 1.0 release of Rust was in 2015, less than three years ago. I believe GP's point is that Mozillas projects come and Mozillas projects go, that FF may be the only one that is still around after some time. Rust doesn't yet meet those criteria.
- ginko 9y agoI'd like JS to be as far away from my embedded devices as possible.
- ausjke 9y agoGoogle leads me to https://webofthings.org/ https://webofthings.org/ , "web of things", seems related to Mozilla's Gateway mentioned here, i.e. use http/www/internet to connect all IoT devices. The web of things started in 2007, somehow it does not gain any traction, is this gateway using the same conception: https://iot.mozilla.org/wot/ https://iot.mozilla.org/wot/ Both are referring web-of-things and nodejs/json etc
- anfilt 9y agoIOT is pointless for a lot things. For some even a hazard. I laugh to myself when some business people think their IOT widget is the best thing ever. Then I tell them why it's freaking insane or stupid. They look at me like I am a luddite. Thankfully, that is minority of my interactions. Still there are enough of them that it's far from a non-existent issue. Just connecting something to the internet does not make it better or you just want to monetize with software activated features. A lot IOT devices provides no additional value. A lot of times it decreases the objects value. It makes vulnerable to hacking, and has more possible points of failure, and potential more overhead for the end user to maintain it. I am not saying all internet connected devices are a bad idea. I just see a lot business people basically taking the latest hype Koolaid and mixing it with existing things. Then they think it's the greatest idea since sliced bread, and that everything will be connected to the the internet. It's one thing to throw many things at the wall to see what sticks for some people that is one way of discovering what works. However, I hate how pervasive some of the IOT hype is getting. I was talking with someone the other day that literally thought that any device that could not connect to the internet was useless for today's society... Any ways I am sick of hearing about IOT. The fact Mozzila is even trying to get in on this madness is disheartening.
- qsun 9y agohttps://twitter.com/internetofshit https://twitter.com/internetofshit
- draz 9y agoI thought long and hard about IoT devices and their value. For the most part, I agree that most IoT devices could exist and provide the same value as a non-IoT counterpart. Do you really need a connection to the weather service to know the canopy in your backyard needs to be rolled because of a potential storm? A simple anemometer with a micro controller can tell it to shut off above a certain wind speed. Most IoT devices "excel" in allowing you to connect to the device via your smart phone. Which is convenient, but not groundbreaking. Where the value of IoT devices lies is in very few use-cases where the IoT device relies on data not found in its proximity. Something like Nest speaking to my electric company to find the lowest rate and optimizing A/C usage around it is quite compelling IMHO. I look forward to seeing more of that rather than the remote use case....
- mankash666 9y agoBut IoT IS based on industry standards. Rest/Json are NOT the preferred way, it's MQTT/AMQP. Interfacing with a company owned API like Siri/Google is always going to be dictated by the said company. I don't see anything here that Mozilla CAN influence
- _asummers 9y agoDon't forget about CoAP and LWM2M, too.
- ianburrell 9y agoMQTT is messaging protocol. Is there standardized messages for controlling devices? Also, there can be different protocols for talking to devices and for talking between computers, gateways, and services. Most home automation devices don't speak Internet protocols and need a gateway as bridge and implement more complicated controls. Devices need to worry about low power, bandwidth, and limited processing power. Might be good idea for security if devices aren't available on Internet routed protocols.
- fulafel 9y agoMost current IoT applications are HTTP(S) and JSON. I'm not sure why in the future there would be big change due to increasing resource scarcity, as hardware is getting cheaper and more powerful all the time.
- eggpy 9y agoCan't this already be accomplished via XMPP? The protocol already exists, you just need to register devices to services. I know people don't love xmpp, but it seems like this is already an open source gateway that can manage IOT. Why do we need to create a "new open standard"? [0] https://xmpp.org/uses/internet-of-things.html https://xmpp.org/uses/internet-of-things.html
- azinman2 9y agoIt’s a really complicated standard with all kinds of components, optional components, prorietary extensions, etc. Plus it has a lot of overhead in every packet. I don’t know how many vendors use this IoT flavor of XMPP but my guess would be not many. Implementing it on a micro controller would not be fun.
- throwawayfinal 9y agoPeople don't love XMPP for a lot of reasons. Some of those reasons apply to IoT. Some reasons, like having to maintain state, are IoT specific. Besides that, bandwidth and code complexity is a very real concern. MQTT, a lightweight message passing protocol, has become the de facto default.
- fmntf 9y agoSo true. We switched to MQTT (abandoning websockets and other protocols) to save (a lot of) network bandwidth.
- IgorPartola 9y agoIn engineer speak, what will this let me do?
- st3fan 9y agoThe gateway is a proof of concept for the "Web Thing API" https://iot.mozilla.org/wot/ https://iot.mozilla.org/wot/ that will let you chat with all the things in your home. It is an open alternative to the closed HomeKit and Android Home ecosystems.
- IgorPartola 9y agoOk so for a typical IoT device I have the software on the device that talks to some server/service on the Internet, and an app on my phone to control the device. This replaces the server/service? What about the app? Does that mean I can create my own devices and an Amazon Echo or Siri will eventually be able to talk to it?
- st3fan 9y agoPeople who dismiss this effort so quickly should actually spend a little time to discover what is actually happening here. It is really disheartening to see so many negative comments about Mozilla without any substantial deeper comments about this specific project. To me the big news here is not the gateway, it is the "Web Thing API" that you can read at https://iot.mozilla.org/wot/ https://iot.mozilla.org/wot/ This is a W3C draft about something that is badly missing currently: a common language that devices can speak. "This document describes a common data model and API for the Web of Things. The Web Thing Description provides a vocabulary for describing physical devices connected to the World Wide Web in a machine readable format with a default JSON encoding. The Web Thing REST API and Web Thing WebSocket API allow a web client to access the properties of devices, request the execution of actions and subscribe to events representing a change in state. " This is meaningful work that can impact you in a big way. Don't dismiss it too quickly.
- lomnakkus 9y agoSo, I just searched for "security" in that page you linked to and... not a single mention. As I see it the problem with IoT isn't features, it's the absolutely abysmal security record. I mean, it's abysmal in home ADSL routers, what are expecting of companies just churning out one-off IoT things? Maybe they should start out by mandating an update policy[1]? ... but then of course nobody would join, so what to do...? [1] I'm not talking about a concrete schedule, just a documented human-readable policy of what their usual schedule would be (if any), and how severity levels work (for them), etc. ------------------------------------- EDIT: HN won't let me post again "too soon", so here's my reply to "st3fan": > Ok, what does this actually mandate and how many actual devices adhere to this standard? What is the motivation for any particular device manufacturer to adhere to this "standard"? (etc. I'm sure you can come up with your own questions.) Also, shouldn't this other standard at least be mentioned in the IoT standard and match the key word "security"? This whole IoT thing is an omnishambles.
- st3fan 9y agoCheck this out https://www.w3.org/TR/wot-security/ https://www.w3.org/TR/wot-security/
- mcguire 9y agoThe actual announcement, linked in the article: https://blog.mozilla.org/blog/2018/02/06/announcing-project-things-open-framework-connecting-devices-web/ https://blog.mozilla.org/blog/2018/02/06/announcing-project-...
- wiremine 9y agoI'm a fulltime IoT software consultant, and I wish we'd see more of these initiatives. A few thoughts: 1. The problem isn't the transport layer, it's the application layer. The transport layer is mostly solved via MQTT, COAP, Thread, etc. Sure, we can improve there, but the real problem is the application layer. So I applaud Mozilla's attempt to bring something into this space. 2. Bootstrapping this will require a substantial number of hardware vendors to sign on, both at the edge and at the hub layers. IMHO this is why Google Weave [1] never took off in it's original incarnation. Bootstrapping this like they did with web stuff isn't enough, because this isn't the web. 3. Devices are only part of the problem: We need a software services layer, too. Think time services, IFTTT-like orchestrators, media services, etc. 4. JSON is a non-starter long-term: it sucks for small devices. They need a binary format that is easy to parse. 5. Request-Response isn't the right pattern for most use cases. 6. The Property/Action/Event concept is a solid start. 7. For the love of everything holy, add versioning! [1] http://internetofthingsagenda.techtarget.com/feature/Google-takes-on-IoT-with-Brillo-and-Weave http://internetofthingsagenda.techtarget.com/feature/Google-... Edit: Grammar.
- wiremine 9y agoJust a note on IoT: Yes, it's messy, yes it's early, but I really love working in the space full time. It spans every part of computer science and it's never dull. I get to work with Fortune 100s and startups, and it's really a fun place to play.
- statictype 9y agoCurious, How are Fortune 100s using iot? Our company does Device integration stuff but most of the big guys are using older automation systems (typically a bms) We have not seen any significant adoption of iot so far. Maybe our market is just different.
- wiremine 9y agoHere's a quick bread-first overview some of our recent projects: * Industrial IoT - If I had to guess, most of the projects are 95% analytics, 5% command and control (i.e., configure machines and/or centrally control them) - PLCs make this suck, but as that moves to SBCs we're seeing that improve. Energy management, too. Get a lot of questions about Industry 4.0, too. * Transportation - Mostly telematics (GPS, listening off the CAN Bus for events, etc.) * Healthcare - RTLS, some basic analytics. C&C is unlikely due to security and use cases. * Retail - Restock tracking, footfall traffic, etc. Ordering by voice. ("Alexa, I'd like to order 5 cases of carrots") * Consumer IoT - Voice, energy management (Europe has some great use cases here), some analytics. C&C is big in this this space. "Alexa, set my Jenn-Air oven to 350 degrees for 25 minutes" was a recent project. * Insurance - The 5 five all have innovation groups very intent on IoT, but I haven't see a really great use case yet. * Smart City - Energy management, parking. We weren't involved too much, but our city's snowmelt system is another example: https://runengine.com/vroom/58-smart-city-snowmelt-monitor https://runengine.com/vroom/58-smart-city-snowmelt-monitor (The guy with the beard is one of my SAs) https://www.hackster.io/kayakpete/snowmelt-system-monitor-be4a01 https://www.hackster.io/kayakpete/snowmelt-system-monitor-be... One last thought: I've noticed is that IoT really screws with the traditional "Enterprise Architecture" patterns. Startups are going to kill it once they figure that out, because traditional enterprise architects are lost in that space.
- agit 9y agoSeems like OGC SensorThings API, but there are sections that are related to events and actions. As far as I know, the creator of OGC SensorThings API going to publish a second standard about the events also. Check it out :https://github.com/opengeospatial/sensorthings https://github.com/opengeospatial/sensorthings
- OrangeTux 9y agoHere a tutorial from Mozilla about setting up the gateway. https://hacks.mozilla.org/2018/02/how-to-build-your-own-private-smart-home-with-a-raspberry-pi-and-mozillas-things-gateway/ https://hacks.mozilla.org/2018/02/how-to-build-your-own-priv...
- cdevs 9y agoRestful? I thought it was dead and graphql was the new silver bullet for everything? On a serious note though this is seriously needed and I actually like the start of this API I would mind curling a device and seeing how easy it is to write 2 lines of code to email me if it dies without really having to read documentation and this is the real intent of the idea behind rest, discoverable network apis self documenting because they use links and http standards so I don't have to go look up some companies specific error codes.
- tylermadson 9y agowhat does this mean?
- cryptos 9y agoI wonder why they don't use HTTP2 Server Push instead of Web Sockets. And I wonder why they don't want to use MQTT. Can you think of any good reasons?
- benfrancis 9y agoHTTP2 server push isn't really designed for the kind of two way communication needed in IoT use cases, it's mainly designed for web servers pushing CSS files down to a web browser before they're requested. MQTT isn't a web protocol and the goal here is to give things URLs on the web. But I'm aware of some Web of Things implementations using MQTT over WebSockets to benefit from the QoS features.
- mrtree 9y agoIoT protocol expert here. Ping me if you need a consultant!
- aeroaks 9y agoHow does this compare to Home Assistant project (https://github.com/home-assistant/home-assistant https://github.com/home-assistant/home-assistant)
- miteshsa 9y agoWow thats great, we have also build iot based smart home solution, Please check and give me your feedback. https://www.solutionanalysts.com/home-automation-solutions/ https://www.solutionanalysts.com/home-automation-solutions/
- unboxed_type 9y agoWhats the business model behind that kind of activity?
- DyslexicAtheist 9y agorather unrelated I have just seen this article on Smart-Home Privacy, by Gizmodo¹ which at the bottom reads: "This story was produced with support from the Mozilla Foundation as part of its mission to educate individuals about their security and privacy on the internet." Considering the timing of both the announcement & Gizmodo piece, suddenly the line "story was produced with support from the mozilla foundation" sounds just like another ad. I wish Gizmodo / Mozilla would be clear of what Mozilla contributed. Especially because Mozilla positions itself by accepting donations. ¹ https://gizmodo.com/the-house-that-spied-on-me-1822429852?rev=1518027891546 https://gizmodo.com/the-house-that-spied-on-me-1822429852?re...