12 ms·

Products like this make me furious. Selling a product whose interface/API/whatever is deliberately obfuscated so that the manufacturer also has a monopoly on a

by ohazi 6y ago

Products like this make me furious. Selling a product whose interface/API/whatever is deliberately obfuscated so that the manufacturer also has a monopoly on a subscription service or an app for said product is blatantly anti-consumer, anti-competitive, anti-environment, and should be illegal. Fuck Peloton. Fuck Flywheel. Fuck all the proprietary IoT companies. And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. Nobody should ever feel like they have to throw out an otherwise functional refrigerator-sized appliance because of software obsolescence. I am absolutely willing to die on this hill. We need a GDPR-sized hammer to fix this.

DebtDeflation 6y ago
>GE app #12 that's going to be abandoned in two years anyway Not merely abandoned, but abandoned with gaping security flaws, no other way to update the device, and an always-on internet connection. We really have not thought this IOT stuff through.
- lstamour 6y ago
  Inevitably the long-term solution is going to be more layers of abstraction. Web application firewalls for every wifi device in your router, for example, or operating systems maintained by cloud vendors (for “edge devices”). If always transmitting connectivity isn’t required, maybe HomeKit-style app-based (offline or app-based updating) devices that use other devices as repeaters which can then be reverse engineered from their apps (largely illegally in many countries). I don’t think we’ll see open specs unless Apple or Google or government make a significant push, or a future large-scale chipset manufacturer uses open source as a way to both get customers and maintain long-term support for their chips. But we know how well GPL works with most hardware (poorly, unusably, etc.)
  - TeMPOraL 6y ago
    What worries me is not layers of abstraction, but layers of control. Who owns that WAF? Who owns the apps? And if it's not user that owns it in practical (control) sense, then I hate it already and personally won't buy it.
- dcow 6y ago
  Or, maybe the whole impetus behind the free software movement isn't wacko bullshit after all... We had a solution and everyone pissed on it because the misinformed and perhaps intellectually lazy lawyers and leaders and yes even engineers convinced everyone that the GPL was unfit for a capitalist society. “Was” is admittedly unfair because free software is not actually dead. It’s just popularly dead. If this type of crap actually outrages you, it’s not GDPR that we need (it makes no sense if you think about it, too), it’s smarter consumers and more courageous engineers/leaders. Go speak with your feet and use free software products. And help breath life into a culture that has been wounded by greed.
  - TeMPOraL 6y ago
    At the risk of repeating the "Stallman was right" meme, Stallman really was right about this stuff. The more I work in and with tech, the more I'm appreciating GNU/FSF philosophy. Some time ago I finally understood what's the point of GPL vs. just Open Source - the former is written with end users in mind, not developers. And unfortunately, these days not only developers aren't end users, they're very often working against end users.
    - smichel17 6y ago
      Yep. Permissive licenses (MIT et al) maximize freedom for developers. Copyleft licenses place sometimes-frustrating restrictions on developers in order to guarantee more freedom for end users. I like to compare it to laws against slavery. Yes, they impose restrictions on would-be owners, but society is freer as a result. or any abuse of power imbalances.
      - skinkestek 6y ago
        > Yes, they impose restrictions on would-be owners, but society is freer as a result. I'm still going to prefer MIT but this is probably the best rhetoric I've seen in favor of copyleft.
  - ohazi 6y ago
    We need a free hardware movement.
thereisnospork 6y ago
Its a pretty good hill to die on. Everything IOT should be forced to communicate over transparent and self-documenting protocols so a. anyone can write an app to control said device and b.[0] Alexa/Cortana/Siri can query to set up a voice control interface. [0] Maybe in the future when their capabilities get a bit better, but the gist is every device should respond to a 'hello' ping with a list of commands and NLP'able descriptions such that for an air conditioner 'alexa set temp 67 degrees F' just works.
- crooked-v 6y ago
  HomeKit is probably the closest thing at the moment as, while it's a proprietary protocol, it's already been mostly-reverse-engineered enough to have open-source HomeKit controllers for most devices, as well as open-source bridges from non-HomeKit devices to HomeKit protocols.
  - Mister_Snuggles 6y ago
    Home Assistant[0] is a great tool to act as this bridge. It can act as a HomeKit device, so anything it knows about can be exposed to Apple devices via the Home app. It also has integrations to talk to virtually anything, or you can build your own IoT devices with ESPHome[1]. [0] https://home-assistant.io/ https://home-assistant.io/ [1] https://esphome.io/ https://esphome.io/
    - lostlogin 6y ago
      So much this - ESPHome is incredible. The next amazing bit is how good a system you can cook up with some low cost ESP8266 or ESP32 chips and a few sensors. I’ve been looking for ages for a decent thermometer that connects to Home Assistant. All were expensive and required all sorts of contortions to get into HA. A week or two ago I bought some US$6 chips and a few US$3 sensors and they had me there in short order. I have no electronics background and very little coding experience.
      - Mister_Snuggles 6y ago
bigmattystyles 6y ago
Just like the wink hub. They recently switched from free always to we now need 60 bucks a year from you. Talk about bait and switch.
lostlogin 6y ago
> app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. It was a revelation putting a Pihole on the network and making a firewall rule that forced any non-Pihole port 53 traffic back to the Pihole. Samsung and Google make a lot of connections to home.
- twicetwice 6y ago
  HTTPS is great for users, but I'm annoyed that it will let companies get around this sort of thing. I want to control the traffic on my network.
  - TeMPOraL 6y ago
    That's why the combination of DoH and certificate pinning worries me - individually they're sound security technologies, but together, they're a nice package to disenfranchise end users with respect to networked devices they own.
    - kuschku 6y ago
      One of the top reasons for DoH with cert pinning was to prevent DNS ad blocking with pihole on e.g. chromecasts
sokoloff 6y ago
Is it really that different than the razors-and-blades, inkjet printers, games consoles, or electric toothbrush business model? Or even the new cars and service model [wherein more money is made in the service bays than on the showroom floor].
- TeMPOraL 6y ago
  I wasn't around on this planet when razors-and-blades model was first invented, but it wouldn't surprise me if people raised objections back then. To me, the general model of selling/giving away a device that serves only to lock the customers into buying overpriced consumables is ethically questionable. I find it exploitative, dishonest, wasteful and anti-competitive. Such business model requires the corrupting the law to create completely artificial constraints, to make it illegal for competitors to offer said consumables, in order to prevent competitive pressure from pushing the price of consumables down to where it should be[0]. I can't give a detailed and coherent argument for why I feel that way, not just yet - part of the reason I comment in IoT/DRM/another-product-turned-into-bullshit-service threads is to try and discover that argument through discussion. But it really feels wrong, compared to a hypothetical reality where both the devices and their consumables were properly priced closer to the marginal cost of production, which can happen only if people can freely build on top of platforms. -- [0] - And if I'm listing negative adjectives, I might add parasitic - in the sense that if you imagine business models as organisms, this one took over host society's legal system to ensure it could to outcompete more straightforward (honest) ones.
  - devcpp 6y ago
    I don't think you need to expand so much on the reason why you're opposed to this business model, it's all understood and well-documented. The usual argument against this sentiment is that it's difficult to establish clear legislation on it. See the very similar debates on planned obsolescence and right to repair. > Such business model requires the corrupting the law to create completely artificial constraints So what? As long as no such laws exist that's fine, and a corrupt country will get bigger problems anyway. The problem is that it's not true since constructors can increasingly rely on complexity: reverse-engineering is getting more and more complex (see recent iPhones).
dfox 6y ago
One issue with open interfaces for these kinds of applications is BT-LE itself. It is nominally designed as open standard for transferring exactly this kind of data, but it cannot do anything else than SNMP-like get/put/trap on some attribute, so everybody ends up designing their own proprietary L4 TCP-like protocol on top of attribute writes and reads to accomplish anything interesting.
- floatboth 6y ago
  Most "smart" devices don't need anything beyond attributes, heck, some of them (thermometers and the like) could just fit all the data into a beacon advertisement! Manufacturers often do really silly things like encoding all the data into one custom attribute: https://github.com/open-homeautomation/miflora/blob/31e59bdb20dc7262ea5ee2964eeed8753806f420/miflora/miflora_poller.py#L201-L224 https://github.com/open-homeautomation/miflora/blob/31e59bdb... All of this easily could've been done with standardized attributes but fuck interoperability lol. > it cannot do anything else than SNMP-like get/put/trap on some attribute It can do whatever you want. Nobody is forcing you to use ATT, you can speak anything over L2CAP.
squarefoot 6y ago
> Fuck Peloton. Fuck Flywheel. Fuck all the proprietary IoT companies. And not just in the IoT field. Pretty much every company that could use their closed software/firmware/designs plus lawyers to enforce their right to render a product useless or obsolete, or simply becoming the only authorized to repair it then refuse the repair, so the user must buy a newer one, will eventually do that if allowed by the law. John Deere has been really hostile to their customers, for example. https://www.vice.com/en_us/article/xykkkd/why-american-farmers-are-hacking-their-tractors-with-ukrainian-firmware https://www.vice.com/en_us/article/xykkkd/why-american-farme...
- notimetorelax 6y ago
  The legislation will probably originate somewhere there. At some point world should realize that software sales are not different from hardware sales.
- fiftyacorn 6y ago
  John deere only made sense to me when I found out bill gates as it's largest shareholder
- encom 6y ago
  Don't forget Apple. They absolutely hate customers servicing the hardware they bought and paid for, and they fight it with both technology and lawyers. Remember that awesome time when Apple disabled phones, because they had a 3rd party home button installed? Absolute scumbags.
  - nkristoffersen 6y ago
    I mean, it sure seems like a scumbag move, until you understand the full reasoning behind enforcing encrypted keys for each piece of security hardware. Which I believe was to close a security loophole. To my memory the bricking of phones was a bug related to not handling the non-matching key condition correctly. But I believe they fixed that bug quickly?
userbinator 6y ago
I agree with your points, but in this case it was not obfuscated at all and as the article shows, not really difficult to figure out. Furthermore, this knowledge can now be shared with others. As long as RE is legal (and even when it isn't...), people will figure things out. We need a GDPR-sized hammer to fix this. AFAIK, RE for interoperability (which this is absolutely an instance of) has always been and is likely to remain legal in the EU.
- danielheath 6y ago
  As pointed out upthread, we’re increasingly seeing devices that never get reversed. Even many of the really popular ones take years to hack these days, because the mitigations keep getting stronger.
FpUser 6y ago
Generally yeah, fuck'em all. There are however cases when playing with the device using 3rd party software could lead to bypassing safety features and if people got hurt who is to answer?
- userbinator 6y ago
  "Freedom is not worth having if it doesn't include the freedom to make mistakes."
- sukilot 6y ago
  The person who bypassed safety features, or insurance coverage.
aiisjustanif 6y ago
Just wait until you here about this company called Tesla that is paving the way for “your car is an IoT subscription”. Oh yeah and this company called John Deere with their subscription model for their DMCA protected tractor that you “own”.
aranibatta 6y ago
trying to dig into the root of this frustration, i think it mostly stems from the misalignment for how we expect the internet to behave (open, accessible, all the other fun Tim BL stuff, etc). it’s extremely unfortunate that companies like peloton, john deere, skydio, on some level DJI, and others as we cross software into the real world haven’t kept up with those expectations. huge loss, and concerning behavior as the internet starts to expand further IRL.
Balgair 6y ago
This twitter account is well aligned to this sentiment, proof included: https://twitter.com/internetofshit https://twitter.com/internetofshit
rubber_duck 6y ago
>And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. Do you have IR controller for your AC ? If so you could get one of those smart plugs that you can control remotely (zigbee, wifi service, whatever) and it will communicate with your AC via IR, you plug it in to the AC socket and then plug AC into it.
flingo 6y ago
> I am absolutely willing to die on this hill. We need a GDPR-sized hammer to fix this. Any thoughts on a labelling system? Like, "re-flashable open source firmware", "cannot be remotely bricked", "API-spec and code examples included" stuck on the side of the box. I'm surprised some hardware hacker supply company, like adafruit/sparkfun hasn't gotten on this yet.
RangerScience 6y ago
Relevant to your interests: https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-near-future-tale-of-refugees-and-sinister-iot-appliances/ https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-...
CorruptVoices 6y ago
You must also hate Apple right?
lsllc 6y ago
Agreed. Right to repair, which I believe includes software should become law. I have a pile of bricked stuff, mostly electronics that I can't use (hello Pebble Watch). I hesitate to buy "connected" products unless they are open (e.g. Z-wave switches), never proprietary stuff!
twodave 6y ago
I might even take it a step further and say no product should be rendered unusable without an Internet connection unless the Internet is an absolute requirement of the product’s basic function. I.e even IoT devices ought to be able to be air-gapped and on their own closed network (unless, for instance, it’s a clock or something and relies specifically on things like weather/traffic APIs). And even in cases where there is a legitimate product feature that requires an internet connection, not having one should NOT render the other parts of that product unusable.
pabs3 6y ago
What does the GDPR-sized solution look like? Maybe "every IoT vendor must put their source code in escrow and when they go out of business the source code becomes GPL"? Of course they could just escrow incomplete software with parts just being sourceless blobs and no-one would have verified it is complete by the time they go out of business. It also doesn't work when they buy proprietary software bits from other companies.
pabs3 6y ago
I would like to see a "Right to Repair" for software.
- Drdrdrq 6y ago
  Any FOSS or Commons Clause software fits the bill. Or are you saying you would like to see Right to repair legislation for software? Me too, but it won't happen.
  - pabs3 6y ago
    The latter
thedanbob 6y ago
I'm looking into mini splits for an apartment and project room I'm building in my shop. I really like the Mitsubishi ones partly because they have a documented port to connect to them and people have already written code and schematics. Unfortunately, they are twice the price of the cheap ones that only have a proprietary wifi dongle that I'd have to reverse engineer myself.
- gog 6y ago
  Get the Mitsubishi Super Inverter. Not because of the wifi (mine does not have that option), but because it's a really good product. I have one running for the last 6 years and I always say that it was the best purchase of an electrical appliance I ever made. Super quiet also, my model is around 19dB inside and the outside unit is also quiet.
dvcrn 6y ago
> And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. My aircon is infrared based so I bought a $20 infrared emitter, recorded all the button signals from the remote control and plugged it into HomeKit. Now I can voicecontrol/Remote control my antique aircon better than current models that still don’t support HomeKit Bonus points: I put the emitter in line with both aircon and TV and use the same device to control both
1vuio0pswjnm7 6y ago
The scariest thing IMO is that this strategy seems to work for the seller. (Besides John Deere oweners and the HN crowd) How many consumers are protesting this kind of nonsense? I would bet most are dazzled by the prospect of some "futuristic" product feature. To me, this stuff actually devalues the product. It has the potential to be useful but the way it is being used is to deny the buyer full ownership and reserve additional rights for the seller.
pentae 6y ago
My condo building has these fancy new Technogym "MyRun" cardio machines which are basically regular workout machines with giant iPads on them. So now instead of turning them on and starting a workout I must wait 3 1/2 minutes for the touchscreen to boot every morning and every other week theres a failed software update causing the machine to shut down mid workout to restart the software in an endless loop. Or it just won't turn on due to the software on/off switch not working and we have to call the technician. It's unbelievably bad. Unless you actually care about connecting your workout to an app (i dont) a prehistoric cheap workout machine from 20 years ago has a better experience and is actually maintainable
juskrey 6y ago
Hey, we both know the answer - you don't need fancy app to be fit on your bike. Neither for making sense from your aircon.
Too 6y ago
The bike is not even close to being bricked. You can use it without the app, there are multiple replacement apps; both a free version from the same vendor, a equvalent subscription from the new owner and some other third party apps. Otherwise yes, agree that subscription dependent IoT needs regulation.
postit 6y ago
And to think I‘m used to make fun of RMS for complaining about how he wanted to run his own software on his microwave.
deleted 6y ago
[deleted]
m463 6y ago
I just return stuff. I bought a segway mini years ago, only to find out you had to download an app before you could ride it. Same with with a DJI mavic quadcopter.. you could not just turn it on and fly it with the included RC remote controller - it would just say "see app" or some nonsense. both got sent back. Seemed a little silly at the moment (I just got this cool new thing -- cave.. cave..) but I'm way better off. (turns out the mavic sends details of EVERYTHING to lots of sites willy-nilly)
gorgoiler 6y ago
It has to be fixed through regulation. The free market does not support long term, expensive solutions, such as APIs. If you provide the bike with a public API, it’s going to cost more. You now need to actually test the API works, instead of simply testing the bike works, end-to-end, with your own software. A stable API with supported version changes and backwards compatibility is a much more challenging engineering prospect. Forever ‘twas this. Maybe they can start by using something like an automotive CAN bus.

by ohazi 6y ago

DebtDeflation 6y ago

>GE app #12 that's going to be abandoned in two years anyway Not merely abandoned, but abandoned with gaping security flaws, no other way to update the device, and an always-on internet connection. We really have not thought this IOT stuff through.

lstamour 6y ago
Inevitably the long-term solution is going to be more layers of abstraction. Web application firewalls for every wifi device in your router, for example, or operating systems maintained by cloud vendors (for “edge devices”). If always transmitting connectivity isn’t required, maybe HomeKit-style app-based (offline or app-based updating) devices that use other devices as repeaters which can then be reverse engineered from their apps (largely illegally in many countries). I don’t think we’ll see open specs unless Apple or Google or government make a significant push, or a future large-scale chipset manufacturer uses open source as a way to both get customers and maintain long-term support for their chips. But we know how well GPL works with most hardware (poorly, unusably, etc.)
- TeMPOraL 6y ago
  What worries me is not layers of abstraction, but layers of control. Who owns that WAF? Who owns the apps? And if it's not user that owns it in practical (control) sense, then I hate it already and personally won't buy it.
dcow 6y ago
Or, maybe the whole impetus behind the free software movement isn't wacko bullshit after all... We had a solution and everyone pissed on it because the misinformed and perhaps intellectually lazy lawyers and leaders and yes even engineers convinced everyone that the GPL was unfit for a capitalist society. “Was” is admittedly unfair because free software is not actually dead. It’s just popularly dead. If this type of crap actually outrages you, it’s not GDPR that we need (it makes no sense if you think about it, too), it’s smarter consumers and more courageous engineers/leaders. Go speak with your feet and use free software products. And help breath life into a culture that has been wounded by greed.
- TeMPOraL 6y ago
  At the risk of repeating the "Stallman was right" meme, Stallman really was right about this stuff. The more I work in and with tech, the more I'm appreciating GNU/FSF philosophy. Some time ago I finally understood what's the point of GPL vs. just Open Source - the former is written with end users in mind, not developers. And unfortunately, these days not only developers aren't end users, they're very often working against end users.
  - smichel17 6y ago
    Yep. Permissive licenses (MIT et al) maximize freedom for developers. Copyleft licenses place sometimes-frustrating restrictions on developers in order to guarantee more freedom for end users. I like to compare it to laws against slavery. Yes, they impose restrictions on would-be owners, but society is freer as a result. or any abuse of power imbalances.
    - skinkestek 6y ago
      > Yes, they impose restrictions on would-be owners, but society is freer as a result. I'm still going to prefer MIT but this is probably the best rhetoric I've seen in favor of copyleft.
- ohazi 6y ago
  We need a free hardware movement.

thereisnospork 6y ago

Its a pretty good hill to die on. Everything IOT should be forced to communicate over transparent and self-documenting protocols so a. anyone can write an app to control said device and b.[0] Alexa/Cortana/Siri can query to set up a voice control interface. [0] Maybe in the future when their capabilities get a bit better, but the gist is every device should respond to a 'hello' ping with a list of commands and NLP'able descriptions such that for an air conditioner 'alexa set temp 67 degrees F' just works.

crooked-v 6y ago
HomeKit is probably the closest thing at the moment as, while it's a proprietary protocol, it's already been mostly-reverse-engineered enough to have open-source HomeKit controllers for most devices, as well as open-source bridges from non-HomeKit devices to HomeKit protocols.
- Mister_Snuggles 6y ago
  Home Assistant[0] is a great tool to act as this bridge. It can act as a HomeKit device, so anything it knows about can be exposed to Apple devices via the Home app. It also has integrations to talk to virtually anything, or you can build your own IoT devices with ESPHome[1]. [0] https://home-assistant.io/ https://home-assistant.io/ [1] https://esphome.io/ https://esphome.io/
  - lostlogin 6y ago
    So much this - ESPHome is incredible. The next amazing bit is how good a system you can cook up with some low cost ESP8266 or ESP32 chips and a few sensors. I’ve been looking for ages for a decent thermometer that connects to Home Assistant. All were expensive and required all sorts of contortions to get into HA. A week or two ago I bought some US$6 chips and a few US$3 sensors and they had me there in short order. I have no electronics background and very little coding experience.
    - Mister_Snuggles 6y ago

bigmattystyles 6y ago

Just like the wink hub. They recently switched from free always to we now need 60 bucks a year from you. Talk about bait and switch.

lostlogin 6y ago

> app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. It was a revelation putting a Pihole on the network and making a firewall rule that forced any non-Pihole port 53 traffic back to the Pihole. Samsung and Google make a lot of connections to home.

twicetwice 6y ago
HTTPS is great for users, but I'm annoyed that it will let companies get around this sort of thing. I want to control the traffic on my network.
- TeMPOraL 6y ago
  That's why the combination of DoH and certificate pinning worries me - individually they're sound security technologies, but together, they're a nice package to disenfranchise end users with respect to networked devices they own.
  - kuschku 6y ago
    One of the top reasons for DoH with cert pinning was to prevent DNS ad blocking with pihole on e.g. chromecasts

sokoloff 6y ago

Is it really that different than the razors-and-blades, inkjet printers, games consoles, or electric toothbrush business model? Or even the new cars and service model [wherein more money is made in the service bays than on the showroom floor].

TeMPOraL 6y ago
I wasn't around on this planet when razors-and-blades model was first invented, but it wouldn't surprise me if people raised objections back then. To me, the general model of selling/giving away a device that serves only to lock the customers into buying overpriced consumables is ethically questionable. I find it exploitative, dishonest, wasteful and anti-competitive. Such business model requires the corrupting the law to create completely artificial constraints, to make it illegal for competitors to offer said consumables, in order to prevent competitive pressure from pushing the price of consumables down to where it should be[0]. I can't give a detailed and coherent argument for why I feel that way, not just yet - part of the reason I comment in IoT/DRM/another-product-turned-into-bullshit-service threads is to try and discover that argument through discussion. But it really feels wrong, compared to a hypothetical reality where both the devices and their consumables were properly priced closer to the marginal cost of production, which can happen only if people can freely build on top of platforms. -- [0] - And if I'm listing negative adjectives, I might add parasitic - in the sense that if you imagine business models as organisms, this one took over host society's legal system to ensure it could to outcompete more straightforward (honest) ones.
- devcpp 6y ago
  I don't think you need to expand so much on the reason why you're opposed to this business model, it's all understood and well-documented. The usual argument against this sentiment is that it's difficult to establish clear legislation on it. See the very similar debates on planned obsolescence and right to repair. > Such business model requires the corrupting the law to create completely artificial constraints So what? As long as no such laws exist that's fine, and a corrupt country will get bigger problems anyway. The problem is that it's not true since constructors can increasingly rely on complexity: reverse-engineering is getting more and more complex (see recent iPhones).

dfox 6y ago

One issue with open interfaces for these kinds of applications is BT-LE itself. It is nominally designed as open standard for transferring exactly this kind of data, but it cannot do anything else than SNMP-like get/put/trap on some attribute, so everybody ends up designing their own proprietary L4 TCP-like protocol on top of attribute writes and reads to accomplish anything interesting.

floatboth 6y ago
Most "smart" devices don't need anything beyond attributes, heck, some of them (thermometers and the like) could just fit all the data into a beacon advertisement! Manufacturers often do really silly things like encoding all the data into one custom attribute: https://github.com/open-homeautomation/miflora/blob/31e59bdb20dc7262ea5ee2964eeed8753806f420/miflora/miflora_poller.py#L201-L224 https://github.com/open-homeautomation/miflora/blob/31e59bdb... All of this easily could've been done with standardized attributes but fuck interoperability lol. > it cannot do anything else than SNMP-like get/put/trap on some attribute It can do whatever you want. Nobody is forcing you to use ATT, you can speak anything over L2CAP.

squarefoot 6y ago

> Fuck Peloton. Fuck Flywheel. Fuck all the proprietary IoT companies. And not just in the IoT field. Pretty much every company that could use their closed software/firmware/designs plus lawyers to enforce their right to render a product useless or obsolete, or simply becoming the only authorized to repair it then refuse the repair, so the user must buy a newer one, will eventually do that if allowed by the law. John Deere has been really hostile to their customers, for example. https://www.vice.com/en_us/article/xykkkd/why-american-farmers-are-hacking-their-tractors-with-ukrainian-firmware https://www.vice.com/en_us/article/xykkkd/why-american-farme...

notimetorelax 6y ago
The legislation will probably originate somewhere there. At some point world should realize that software sales are not different from hardware sales.
fiftyacorn 6y ago
John deere only made sense to me when I found out bill gates as it's largest shareholder
encom 6y ago
Don't forget Apple. They absolutely hate customers servicing the hardware they bought and paid for, and they fight it with both technology and lawyers. Remember that awesome time when Apple disabled phones, because they had a 3rd party home button installed? Absolute scumbags.
- nkristoffersen 6y ago
  I mean, it sure seems like a scumbag move, until you understand the full reasoning behind enforcing encrypted keys for each piece of security hardware. Which I believe was to close a security loophole. To my memory the bricking of phones was a bug related to not handling the non-matching key condition correctly. But I believe they fixed that bug quickly?

userbinator 6y ago

I agree with your points, but in this case it was not obfuscated at all and as the article shows, not really difficult to figure out. Furthermore, this knowledge can now be shared with others. As long as RE is legal (and even when it isn't...), people will figure things out. We need a GDPR-sized hammer to fix this. AFAIK, RE for interoperability (which this is absolutely an instance of) has always been and is likely to remain legal in the EU.

danielheath 6y ago
As pointed out upthread, we’re increasingly seeing devices that never get reversed. Even many of the really popular ones take years to hack these days, because the mitigations keep getting stronger.

FpUser 6y ago

Generally yeah, fuck'em all. There are however cases when playing with the device using 3rd party software could lead to bypassing safety features and if people got hurt who is to answer?

userbinator 6y ago
"Freedom is not worth having if it doesn't include the freedom to make mistakes."
sukilot 6y ago
The person who bypassed safety features, or insurance coverage.

aiisjustanif 6y ago

Just wait until you here about this company called Tesla that is paving the way for “your car is an IoT subscription”. Oh yeah and this company called John Deere with their subscription model for their DMCA protected tractor that you “own”.

aranibatta 6y ago

trying to dig into the root of this frustration, i think it mostly stems from the misalignment for how we expect the internet to behave (open, accessible, all the other fun Tim BL stuff, etc). it’s extremely unfortunate that companies like peloton, john deere, skydio, on some level DJI, and others as we cross software into the real world haven’t kept up with those expectations. huge loss, and concerning behavior as the internet starts to expand further IRL.

Balgair 6y ago

This twitter account is well aligned to this sentiment, proof included: https://twitter.com/internetofshit https://twitter.com/internetofshit

rubber_duck 6y ago

>And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. Do you have IR controller for your AC ? If so you could get one of those smart plugs that you can control remotely (zigbee, wifi service, whatever) and it will communicate with your AC via IR, you plug it in to the AC socket and then plug AC into it.

flingo 6y ago

> I am absolutely willing to die on this hill. We need a GDPR-sized hammer to fix this. Any thoughts on a labelling system? Like, "re-flashable open source firmware", "cannot be remotely bricked", "API-spec and code examples included" stuck on the side of the box. I'm surprised some hardware hacker supply company, like adafruit/sparkfun hasn't gotten on this yet.

RangerScience 6y ago

Relevant to your interests: https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-near-future-tale-of-refugees-and-sinister-iot-appliances/ https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-...

CorruptVoices 6y ago

You must also hate Apple right?

lsllc 6y ago

Agreed. Right to repair, which I believe includes software should become law. I have a pile of bricked stuff, mostly electronics that I can't use (hello Pebble Watch). I hesitate to buy "connected" products unless they are open (e.g. Z-wave switches), never proprietary stuff!

twodave 6y ago

I might even take it a step further and say no product should be rendered unusable without an Internet connection unless the Internet is an absolute requirement of the product’s basic function. I.e even IoT devices ought to be able to be air-gapped and on their own closed network (unless, for instance, it’s a clock or something and relies specifically on things like weather/traffic APIs). And even in cases where there is a legitimate product feature that requires an internet connection, not having one should NOT render the other parts of that product unusable.

pabs3 6y ago

What does the GDPR-sized solution look like? Maybe "every IoT vendor must put their source code in escrow and when they go out of business the source code becomes GPL"? Of course they could just escrow incomplete software with parts just being sourceless blobs and no-one would have verified it is complete by the time they go out of business. It also doesn't work when they buy proprietary software bits from other companies.

pabs3 6y ago

I would like to see a "Right to Repair" for software.

Drdrdrq 6y ago
Any FOSS or Commons Clause software fits the bill. Or are you saying you would like to see Right to repair legislation for software? Me too, but it won't happen.
- pabs3 6y ago
  The latter

thedanbob 6y ago

I'm looking into mini splits for an apartment and project room I'm building in my shop. I really like the Mitsubishi ones partly because they have a documented port to connect to them and people have already written code and schematics. Unfortunately, they are twice the price of the cheap ones that only have a proprietary wifi dongle that I'd have to reverse engineer myself.

gog 6y ago
Get the Mitsubishi Super Inverter. Not because of the wifi (mine does not have that option), but because it's a really good product. I have one running for the last 6 years and I always say that it was the best purchase of an electrical appliance I ever made. Super quiet also, my model is around 19dB inside and the outside unit is also quiet.

dvcrn 6y ago

> And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway. My aircon is infrared based so I bought a $20 infrared emitter, recorded all the button signals from the remote control and plugged it into HomeKit. Now I can voicecontrol/Remote control my antique aircon better than current models that still don’t support HomeKit Bonus points: I put the emitter in line with both aircon and TV and use the same device to control both

1vuio0pswjnm7 6y ago

The scariest thing IMO is that this strategy seems to work for the seller. (Besides John Deere oweners and the HN crowd) How many consumers are protesting this kind of nonsense? I would bet most are dazzled by the prospect of some "futuristic" product feature. To me, this stuff actually devalues the product. It has the potential to be useful but the way it is being used is to deny the buyer full ownership and reserve additional rights for the seller.

pentae 6y ago

My condo building has these fancy new Technogym "MyRun" cardio machines which are basically regular workout machines with giant iPads on them. So now instead of turning them on and starting a workout I must wait 3 1/2 minutes for the touchscreen to boot every morning and every other week theres a failed software update causing the machine to shut down mid workout to restart the software in an endless loop. Or it just won't turn on due to the software on/off switch not working and we have to call the technician. It's unbelievably bad. Unless you actually care about connecting your workout to an app (i dont) a prehistoric cheap workout machine from 20 years ago has a better experience and is actually maintainable

juskrey 6y ago

Hey, we both know the answer - you don't need fancy app to be fit on your bike. Neither for making sense from your aircon.

Too 6y ago

The bike is not even close to being bricked. You can use it without the app, there are multiple replacement apps; both a free version from the same vendor, a equvalent subscription from the new owner and some other third party apps. Otherwise yes, agree that subscription dependent IoT needs regulation.

postit 6y ago

And to think I‘m used to make fun of RMS for complaining about how he wanted to run his own software on his microwave.

deleted 6y ago

[deleted]

m463 6y ago

I just return stuff. I bought a segway mini years ago, only to find out you had to download an app before you could ride it. Same with with a DJI mavic quadcopter.. you could not just turn it on and fly it with the included RC remote controller - it would just say "see app" or some nonsense. both got sent back. Seemed a little silly at the moment (I just got this cool new thing -- cave.. cave..) but I'm way better off. (turns out the mavic sends details of EVERYTHING to lots of sites willy-nilly)

gorgoiler 6y ago

It has to be fixed through regulation. The free market does not support long term, expensive solutions, such as APIs. If you provide the bike with a public API, it’s going to cost more. You now need to actually test the API works, instead of simply testing the bike works, end-to-end, with your own software. A stable API with supported version changes and backwards compatibility is a much more challenging engineering prospect. Forever ‘twas this. Maybe they can start by using something like an automotive CAN bus.