10 ms·

All IoT devices Bricked after Insteon shuts down?

162 points by ClumsyPilot 5y ago

RoyTyrell 5y ago
That really sucks, but this is exactly why I refuse to buy any smart-home devices that I can't control directly and work with Home Assistant. I prefer bulbs and switches that I can also reflash. I do have a few Wyze cameras because they're cheap and I needed something "now" for a vacation home hours away, but long-term I'd like something that works either with Synology or control myself and preferably that I could reflash - again without cloud connectivity requirements.
- Karunamon 5y ago
  FWIW Wyze makes an RTSP-enabled firmware that, while not as featureful, works well with Surveillance Station.
  - pathartl 5y ago
    Yes, but overall the RTSP implementation is absolutely terrible. Wyze cameras are a novelty, but any permanent implementation should use something better.
  - radnor 5y ago
    This RTMP/RTSP/HLS docker container bridge is leagues better, and there's no firmware to mess with. https://github.com/mrlt8/docker-wyze-bridge https://github.com/mrlt8/docker-wyze-bridge
- chipsa 5y ago
  I have Lutron Caseta switches. They can be controlled entirely locally. You can't reflash them, AFAIK, but they work with Home Assistant just fine, and it's all local (it doesn't need to talk to a web service)
- mschuster91 5y ago
  Maybe Ubiquiti's lineup would be something for you?
  - thinkmassive 5y ago
    Don’t all Ubiquiti device phone home now? At the very least they require a controller to manage, and flashing openWRT on them is a pain.
    - sokoloff 5y ago
      Depends on what you mean by "all Ubiquiti devices". My Unifi APs, switches, and EdgeRouter don't need to phone home and the controller can be run (intermittently if desired) on your laptop or a VM. My parents have an all-Ubiquiti network and the only time they have a controller in their house is when I come visit and do an upgrade. My network has an always-on Ubuntu VM hosting the controller, but it's not needed for normal operation here either. (It is needed for things like guest portal pages and some network stats tracking.) I just tested my local admin login and it still works. (Now, can I guarantee that nothing has even called-home and told Ubiquiti about that? Of course not.) Cameras are a different ballgame; Ubiquiti cameras are much more tied to their software and hardware (and thus I don't have any).
      - thinkmassive 5y ago
        UniFi devices don’t need to phone home, but they do try to collect telemetry https://help.ui.com/hc/en-us/articles/360042384093 https://help.ui.com/hc/en-us/articles/360042384093)
  - PeterisP 5y ago
    Didn't Ubiquiti recently start to push cloud management for all their devices? I don't use their products but I recall seeing a heated discussion on HN about this.
  - zrail 5y ago
    Unifi Protect requires a) their hardware, either a UNVR or a CloudKey Gen2+ or higher and b) their cloud to SSO into the mobile app. If you don't want the mobile app you can use it entirely locally, but you still have to use their hardware. edit: I know this because I have a Unifi Protect system.
- imglorp 5y ago
  +1 for HA. I'm using some Tasmota firmware gear, ie outlets from Athom, just works, no cloud, all mine forever.
- outworlder 5y ago
  Any local camera recommendations? I got quite fed up with existing solutions and bought a couple of ESP32 + camera to try to create my own.
  - joshstrange 5y ago
    I use a Reolink NVR and then I pull the feeds into Home Assistant for viewing. I ran ZoneMinder for years but you really have to make sure your hardware can support it and you are using the right disks. Moving all my cameras to their own dedicated hardware was the best decision I've made when it comes to cameras.
- joshstrange 5y ago
  Yes on "refuse to buy any smart-home devices that I can't control directly and work with Home Assistant" but I'll go a step further. Only buy Z-wave/Zigbee or devices that use a similar standard (ESP32 comes to mind, especially with HA's new-ish core integration with that). Wifi devices are a mess and you are often still reliant on a cloud/app for setup.
x86_64Ubuntu 5y ago
I'm not a security expert in the least and I have never heard of this company till it folded, but I've got a question. How do they prevent someone from later acquiring the domain down the line, and then talking to these devices for malicious purposes? Do these devices expect a specific certificate, and won't communicate regardless of the domain?
- newaccount74 5y ago
  That would be the proper way to do it. But I doubt a random IoT company does stuff the proper way...
- mmastrac 5y ago
  It's easy: they don't. Certificate pinning in IoT devices is pretty unlikely. If you're lucky, some engineers added signature validation for firmware updates, but then your device is a brick because you can't do anything new with it.
  - asciimike 5y ago
    A long time ago on a BaaS platform I worked on, we dealt with an IoT company that pinned certs and when we rotated them they had no way of updating their devices... I think we had to put them on their own server and just left the old cert running forever. As the sibling comment here says, "I doubt a random IoT company does stuff the proper way..."
- ben174 5y ago
  This will inevitably happen at some point in the future. And it could be very very ugly, depending on what hardware is compromised. There is no chance that we can count on IOT manufacturers to pin certificates or to have any motivation whatsoever to focus on security. That is up to the user. So we really need some sort of firewall / antivirus / etc. living on the user end to defend them from this.
aolle 5y ago
creeble 5y ago
> and every single device they've ever sold is bricked. That’s simply untrue, Cory. I have a couple dozen Insteon switches, all controlled locally (by a non-Insteon controller from Universal Devices, which way predates the Insteon hub) and everything works exactly the same as it has for the last dozen years. People who bought the Insteon hub and have no local control are a bit screwed, and if / when my interface module dies, I’ll be screwed too. But all my switches will still have local control.
- ChrisMarshallNY 5y ago
  > exactly the same as it has for the last dozen years. As long as no zdays for Insteon hub show up. In that case, you.f**ked(goat.tied). It seems that you should not factory reset Insteon switches, as a call to home server is a part of the startup. The scrubbing of the LinkedIn accounts was a classy touch.
  - Spivak 5y ago
    So by this logic there is no way to not brick devices when a company shuts down. You could OSS the code but to first order nobody will bother using the community maintained version so it still creates just as much e waste.
    - robonerd 5y ago
      > So by this logic there is no way to not brick devices when a company shuts down Uh, don't make the device phone home? Make the phone home optional? Don't put software in it in the first place? There are many ways for devices to continue working long after the manufacturer is dead and forgotten. Something has become clear to me: Since the IoT industry refuses to regulate itself, we need environmental legislation to regulate this industry.
      - Spivak 5y ago
        Done! But it still wont get any security updates then so by the parent’s comment it might as well be useless.
johnasmith 5y ago
The Arstechnica article Doctorow is linking to: https://arstechnica.com/gadgets/2022/04/shameful-insteon-looks-dead-just-like-its-users-smart-homes/ https://arstechnica.com/gadgets/2022/04/shameful-insteon-loo...
hslee16 5y ago
Insteon, Insteoff
- ginkgotree 5y ago
  comment of the year right there
macintux 5y ago
Recent discussion: https://news.ycombinator.com/item?id=31056027 https://news.ycombinator.com/item?id=31056027
blinding-streak 5y ago
https://twitter.com/internetofshit https://twitter.com/internetofshit
EMIRELADERO 5y ago
So, could this lead to legal action?
- shadowgovt 5y ago
  Only if they really screwed up their licensing agreement. But if they have, I'm not seeing information that they filed for bankruptcy, so they (or their owning company) may be at risk.
2Gkashmiri 5y ago
this is the kind of IOT hell i hate. sure you can open and close your power strip from anywhere in the world but when you FORCE the said power brick to first talk to their server and then flip the switch, aka it wont work locally, that is the scummy kind of company that i refuse to give my money to.
- cogman10 5y ago
  I honestly don't understand why these companies aren't publishing their code for both firmware and server source. AFAIK, they aren't charging any money for this shit, so why not make it open source so, in the event you go out of business, your customers can figure out workarounds. Bonus point, you'll get security fixes for free.
  - InitialLastName 5y ago
    I agree that publishing the source would be positive for the consumer, but I can think of lots of (variably sensible/moral/legal) reasons why they wouldn't: - A public-facing codebase is a reflection of the company, and thus needs to be polished and maintained in a way that a private one doesn't. - You might have trade secrets in your code base that you don't want your competitors to have - Even without explicit secrets, your code base is a substantial investment that any competitor will need to make themselves in order to enter the market; publishing the code would give that to everyone (and let's not pretend that licensing terms and copyright will prevent a knock-off hardware manufacturer in a less cooperative country from reusing the code wholesale) - Alongside the free security fixes, you give adversaries more opportunity to look for, and exploit, flaws in your security. - The IP represented by the source code has a value that might well be a substantial part of your company's valuation, in which case you might need to sell it as part of an acquisition/bankruptcy proceeding. - (I am not accusing Insteon of this, but) if you publish your source code, you may expose all the 3rd-party code you are using/modifying whose license terms you may not be respecting.
  - deleted 5y ago
    [deleted]
  - 5y ago
rlpb 5y ago
In an article covering bad engineering resulting in bricking, I think it's relevant to point out that Insteon's kind of bricking is impossible if you choose the right product, and which product that is. I did some research before investing in home automation. I settled on Z-Wave exclusively exactly because there are multiple manufacturers in the market, their devices are interoperable, and I can use Free Software controller software that I host myself that doesn't phone home. Admittedly I am dependent on binary firmware blobs embedded in every device, but at least my system has no Internet dependency whatsoever.
- ClumsyPilot 5y ago
  'I am dependent on binary firmware blobs embedded in every device' As long at they follow a standard, i think this is somewhat acceptable
- shadowgovt 5y ago
  What do you use for your hub software? I've heard good things about home-assistant.io but I haven't tried it.
  - rlpb 5y ago
    I wrote my own (in Python+trio). I still need to publish it :-/ I'm sure Home Assistant would also be fine though! Currently it uses openzwave, but I found that it didn't suit me very well. So I have a half-written replacement for the low level protocol parts too, to eventually take it to pure Python.
    - jjeaff 5y ago
      Home assistant has deprecated open zwave and is now using zwave JS. Which has worked very well for me so far.
mperham 5y ago
I’m just shocked and amazed. Presumably this company had hundreds of employees, millions in revenue, etc. what would have caused them to disappear like this? I’m guessing there is a large legal aspect we haven’t heard about yet. Somebody did some crimes.
- novok 5y ago
  I looked into insteon products a few months before this, and there was that much community activity about it. Nobody really has talked about insteon products in the past couple years much, which has led me to believe they were dying as a company. I think it was a competition thing. There is way more cheap stuff out there now, and insteon is known as annoying and unreliable (as in devices die after a few years), so the high end market just moved to lutron.
  - mperham 5y ago
    But to have no sunsetting. Unreal. I believe they were bought by private equity a few years back and their MO is: buy, leverage and go bankrupt. This fits that pattern.
llamataboot 5y ago
The LinkedIn scrubbing is the most obnoxious part of this IMHO - we've learned to expect IoT companies to go out of business or just stop supporting a product at this point, but the people involved trying to pretend they weren't is ehhhhhhh (highly recommend using home assistant and getting everything onto as much local control as possible, both to own your own data, and to know you aren't dependent on a phone home server being shut off. It can be a bit of a heavy list initially, but getting easier everyday, and onboarding is way quicker than 2-3 years ago)
- usrn 5y ago
  You don't even need Home Assistant. Many compliant devices just speak UPNP and have MDNS so you can just use UPNP clients. There's even a nice GTK UPNP IOT GUI for Linux.
  - llamataboot 5y ago
    You don't NEED home assistant no, but likely if you have many different smart products form many different vedors and want to be able to see what is set to what and set up automations etc it would be nicer than sniffing packets to figure out what you need to say
    - haswell 5y ago
      Agreed. I use Home Assistant to standardize across the various devices I have. I have a collection of misc. Hue bulbs, Tasmota-compatible plugs and other random devices. HA acts as a HomeKit bridge, meaning that as long as I get a thing working with HA, I can control it from my Apple ecosystem. Do I need it? No. But it's extremely helpful and still meets my goals around data ownership and no dependency on an Internet connection to turn off the lights before bed.
- steelframe 5y ago
  > but the people involved trying to pretend they weren't is ehhhhhhh Nothing wrong with removing information about yourself in some random online profile. When the only thing that is coming from that is angry people yelling at you, I'd just as soon do the same thing. I'd get awefully bored of repeatedly pasting something like, "Per a legal agreement I have with my former employer I cannot comment on this issue," and then blocking the sender for their inevitable rage-reply. Better to just let the rage subside and then quietly add that back in your profile so you can tell a good story about an acquisition gone wrong in a future job interview.
ginkgotree 5y ago
I've stopped buying IoT devices. At first I thought, "wow, how neat, I can turn lights on with my voice." But really, switches work fine. They cost $5, don't really fail, and have filled their role since the ~1880s. I'd rather spent my mental energy coding or building more interesting things than futzing around with IoT.
- antattack 5y ago
  Solution is straightforward, although often not plug and play - only use IoT devices that you can control, based on ESP8266 or ESP32, that can be flashed to Tasmota, ESPhome, etc and controlled with Home Assistant.
  - giantg2 5y ago
    Similar here. I'd rather set up my own home tech than pay for some connected service. My stuff isn't actually smart home stuff, but stuff like PoE security cameras with ZoneMinder, home assembled cycle timers to run sprayers or air bubblers (agriculture related), etc. I built it, so if it breaks I know how to fix it. No chance of the cloud shutting down bricking my devices.
- mysterydip 5y ago
  We had to mute an echo dot because our toddler was constantly trying to tell it to play songs, and alexa kept misinterpreting his requests into not-child-appropriate music.
- outworlder 5y ago
  IoT switches work fine (specially those with local control) and they can have the exact same role as the current switches - with the ability to also be controlled remotely. Which means that you can control them even if you are not present. Those downstairs lights you forgot to turn off? Yes, those. Or maybe you forgot to turn the coffee machine off and went on a trip? Can be turned off too, remotely, on a timer, or by sensing the reduced power draw once your cup is done. They can also be turned on and off based on presence, on time of the day, on the fact that you just turned on your TV, etc. If companies were actually trying to make good products, there would be almost zero drawbacks if we turned all current switches 'smart'. It's just a single bit in the case of switches and lights. The problem is that they want to monetize said bit in addition to the device cost, they want it to talk to a cloud, they want to make it so only their hub can flip the bit, etc. Oh, and they will have unnecessarily complex firmware with security vulnerabilities and that require regular updates. EVEN when most of the logic is in the cloud, which is mind-boggling. And cloud integrations will randomly fail. I do like the ability to be able to make all things 'smarter'. In particular, I want to be able to collect data from all devices(this all feeds to Home Assistant in my case). When you have all the data, and the ability to remotely control, you start thinking of all the use-cases you can automate. Today, I can automate when light switches turn on or off, I can have my robo vacuum not run if my 3d printer is running so it won't bump it, I can have reminders to plug in my EV (when the @#%6 Nissan API works properly). I have locally controlled power switches. I can have reminders when laundry is done. If my dishwasher was 'smart' I would be able to control when it runs (as it is, I'm going to jury rig my own solution). Also thinking about automating my garden next (I already have weather forecast information, just need moisture sensors and a pump). Honestly, we could turn our homes into a Star Trek ship bridge today, if only companies got their act together. I think there will be an 'IoT winter' as consumers get fed up with all the shenanigans.
joshstrange 5y ago
This is why I warn everyone to only buy devices that use a standard like Z-wave or Zigbee and ideally use a hub that works locally. I first got into IoT/SmartHouse stuff with SmartThings but I only would buy Z-wave/Zigbee which paid off in spades when I moved to Home Assistant. All my devices came over and the manufacturer didn't matter. Wifi IoT devices are terrible IMHO. Yes, they are easy to add and cheap to buy but you are left juggling 3-4+ apps even if they all talk to Alexa/Google/Siri. Also you are putting god-knows-what on your network. Yes, you can put them on their own vlan but still, I do not like devices in my house that can phone home even if they can't see my local devices. Stick with Z-wave or Zigbee (ideally pick just 1 or 1 main one) and if you want a nicer onboarding then SmartThings is fine but Home Assistant is probably more attractive to people on HN. At least if/when SmartThings goes under you can move your devices to a new hub.
- MrStonedOne 5y ago
- margalabargala 5y ago
  I just started automating my house, mostly with ZigBee. For WiFi stuff- setting up ESPHome and programming ESP32s to do whatever it is I want them to do (report sensor values, twiddle gpios to control an h-bridge, whatever) is stupid easy. Highly recommend anyone who's been meaning to try ESP32s but hasn't yet take the half hour to try it out.
  - joshstrange 5y ago
    ESP32 is my 1 exception to my "No WiFi rule". Really I use that rule as a blanket statement since 99.9% of what people are talking about when they have a WiFi IoT device is crap. I don't personally have any ESP32 devices but I'm not opposed and at some point I want to play with them. I've heard very good things about them on the various subreddits and on the HA podcast.
    - margalabargala 5y ago
bombcar 5y ago
Best Buy did the same thing with their HomeKit compatible light switches - they were nice enough to give you gift cards equal to the purchase price, and the switches continue to work just fine with HomeKit, though maybe you cannot set up new ones. They also annoyingly blink a green LED because they can't contact the server.
ficklepickle 5y ago
Does anyone know the current state of WebThings? I dabbled back before Mozilla dropped it and it seemed cool, but with some rough edges. I wonder if it survived the transition to a community run project.

162 points by ClumsyPilot 5y ago

That really sucks, but this is exactly why I refuse to buy any smart-home devices that I can't control directly and work with Home Assistant. I prefer bulbs and switches that I can also reflash. I do have a few Wyze cameras because they're cheap and I needed something "now" for a vacation home hours away, but long-term I'd like something that works either with Synology or control myself and preferably that I could reflash - again without cloud connectivity requirements.

Karunamon 5y ago
FWIW Wyze makes an RTSP-enabled firmware that, while not as featureful, works well with Surveillance Station.
- pathartl 5y ago
  Yes, but overall the RTSP implementation is absolutely terrible. Wyze cameras are a novelty, but any permanent implementation should use something better.
- radnor 5y ago
  This RTMP/RTSP/HLS docker container bridge is leagues better, and there's no firmware to mess with. https://github.com/mrlt8/docker-wyze-bridge https://github.com/mrlt8/docker-wyze-bridge
chipsa 5y ago
I have Lutron Caseta switches. They can be controlled entirely locally. You can't reflash them, AFAIK, but they work with Home Assistant just fine, and it's all local (it doesn't need to talk to a web service)
mschuster91 5y ago
Maybe Ubiquiti's lineup would be something for you?
- thinkmassive 5y ago
  Don’t all Ubiquiti device phone home now? At the very least they require a controller to manage, and flashing openWRT on them is a pain.
  - sokoloff 5y ago
    Depends on what you mean by "all Ubiquiti devices". My Unifi APs, switches, and EdgeRouter don't need to phone home and the controller can be run (intermittently if desired) on your laptop or a VM. My parents have an all-Ubiquiti network and the only time they have a controller in their house is when I come visit and do an upgrade. My network has an always-on Ubuntu VM hosting the controller, but it's not needed for normal operation here either. (It is needed for things like guest portal pages and some network stats tracking.) I just tested my local admin login and it still works. (Now, can I guarantee that nothing has even called-home and told Ubiquiti about that? Of course not.) Cameras are a different ballgame; Ubiquiti cameras are much more tied to their software and hardware (and thus I don't have any).
    - thinkmassive 5y ago
      UniFi devices don’t need to phone home, but they do try to collect telemetry https://help.ui.com/hc/en-us/articles/360042384093 https://help.ui.com/hc/en-us/articles/360042384093)
- PeterisP 5y ago
  Didn't Ubiquiti recently start to push cloud management for all their devices? I don't use their products but I recall seeing a heated discussion on HN about this.
- zrail 5y ago
  Unifi Protect requires a) their hardware, either a UNVR or a CloudKey Gen2+ or higher and b) their cloud to SSO into the mobile app. If you don't want the mobile app you can use it entirely locally, but you still have to use their hardware. edit: I know this because I have a Unifi Protect system.
imglorp 5y ago
+1 for HA. I'm using some Tasmota firmware gear, ie outlets from Athom, just works, no cloud, all mine forever.
outworlder 5y ago
Any local camera recommendations? I got quite fed up with existing solutions and bought a couple of ESP32 + camera to try to create my own.
- joshstrange 5y ago
  I use a Reolink NVR and then I pull the feeds into Home Assistant for viewing. I ran ZoneMinder for years but you really have to make sure your hardware can support it and you are using the right disks. Moving all my cameras to their own dedicated hardware was the best decision I've made when it comes to cameras.
joshstrange 5y ago
Yes on "refuse to buy any smart-home devices that I can't control directly and work with Home Assistant" but I'll go a step further. Only buy Z-wave/Zigbee or devices that use a similar standard (ESP32 comes to mind, especially with HA's new-ish core integration with that). Wifi devices are a mess and you are often still reliant on a cloud/app for setup.

x86_64Ubuntu 5y ago

I'm not a security expert in the least and I have never heard of this company till it folded, but I've got a question. How do they prevent someone from later acquiring the domain down the line, and then talking to these devices for malicious purposes? Do these devices expect a specific certificate, and won't communicate regardless of the domain?

newaccount74 5y ago
That would be the proper way to do it. But I doubt a random IoT company does stuff the proper way...
mmastrac 5y ago
It's easy: they don't. Certificate pinning in IoT devices is pretty unlikely. If you're lucky, some engineers added signature validation for firmware updates, but then your device is a brick because you can't do anything new with it.
- asciimike 5y ago
  A long time ago on a BaaS platform I worked on, we dealt with an IoT company that pinned certs and when we rotated them they had no way of updating their devices... I think we had to put them on their own server and just left the old cert running forever. As the sibling comment here says, "I doubt a random IoT company does stuff the proper way..."
ben174 5y ago
This will inevitably happen at some point in the future. And it could be very very ugly, depending on what hardware is compromised. There is no chance that we can count on IOT manufacturers to pin certificates or to have any motivation whatsoever to focus on security. That is up to the user. So we really need some sort of firewall / antivirus / etc. living on the user end to defend them from this.

aolle 5y ago

creeble 5y ago

> and every single device they've ever sold is bricked. That’s simply untrue, Cory. I have a couple dozen Insteon switches, all controlled locally (by a non-Insteon controller from Universal Devices, which way predates the Insteon hub) and everything works exactly the same as it has for the last dozen years. People who bought the Insteon hub and have no local control are a bit screwed, and if / when my interface module dies, I’ll be screwed too. But all my switches will still have local control.

ChrisMarshallNY 5y ago
> exactly the same as it has for the last dozen years. As long as no zdays for Insteon hub show up. In that case, you.f**ked(goat.tied). It seems that you should not factory reset Insteon switches, as a call to home server is a part of the startup. The scrubbing of the LinkedIn accounts was a classy touch.
- Spivak 5y ago
  So by this logic there is no way to not brick devices when a company shuts down. You could OSS the code but to first order nobody will bother using the community maintained version so it still creates just as much e waste.
  - robonerd 5y ago
    > So by this logic there is no way to not brick devices when a company shuts down Uh, don't make the device phone home? Make the phone home optional? Don't put software in it in the first place? There are many ways for devices to continue working long after the manufacturer is dead and forgotten. Something has become clear to me: Since the IoT industry refuses to regulate itself, we need environmental legislation to regulate this industry.
    - Spivak 5y ago
      Done! But it still wont get any security updates then so by the parent’s comment it might as well be useless.

johnasmith 5y ago

The Arstechnica article Doctorow is linking to: https://arstechnica.com/gadgets/2022/04/shameful-insteon-looks-dead-just-like-its-users-smart-homes/ https://arstechnica.com/gadgets/2022/04/shameful-insteon-loo...

hslee16 5y ago

Insteon, Insteoff

ginkgotree 5y ago
comment of the year right there

macintux 5y ago

Recent discussion: https://news.ycombinator.com/item?id=31056027 https://news.ycombinator.com/item?id=31056027

blinding-streak 5y ago

https://twitter.com/internetofshit https://twitter.com/internetofshit

EMIRELADERO 5y ago

So, could this lead to legal action?

shadowgovt 5y ago
Only if they really screwed up their licensing agreement. But if they have, I'm not seeing information that they filed for bankruptcy, so they (or their owning company) may be at risk.

2Gkashmiri 5y ago

this is the kind of IOT hell i hate. sure you can open and close your power strip from anywhere in the world but when you FORCE the said power brick to first talk to their server and then flip the switch, aka it wont work locally, that is the scummy kind of company that i refuse to give my money to.

cogman10 5y ago
I honestly don't understand why these companies aren't publishing their code for both firmware and server source. AFAIK, they aren't charging any money for this shit, so why not make it open source so, in the event you go out of business, your customers can figure out workarounds. Bonus point, you'll get security fixes for free.
- InitialLastName 5y ago
  I agree that publishing the source would be positive for the consumer, but I can think of lots of (variably sensible/moral/legal) reasons why they wouldn't: - A public-facing codebase is a reflection of the company, and thus needs to be polished and maintained in a way that a private one doesn't. - You might have trade secrets in your code base that you don't want your competitors to have - Even without explicit secrets, your code base is a substantial investment that any competitor will need to make themselves in order to enter the market; publishing the code would give that to everyone (and let's not pretend that licensing terms and copyright will prevent a knock-off hardware manufacturer in a less cooperative country from reusing the code wholesale) - Alongside the free security fixes, you give adversaries more opportunity to look for, and exploit, flaws in your security. - The IP represented by the source code has a value that might well be a substantial part of your company's valuation, in which case you might need to sell it as part of an acquisition/bankruptcy proceeding. - (I am not accusing Insteon of this, but) if you publish your source code, you may expose all the 3rd-party code you are using/modifying whose license terms you may not be respecting.
- deleted 5y ago
  [deleted]
- 5y ago

rlpb 5y ago

In an article covering bad engineering resulting in bricking, I think it's relevant to point out that Insteon's kind of bricking is impossible if you choose the right product, and which product that is. I did some research before investing in home automation. I settled on Z-Wave exclusively exactly because there are multiple manufacturers in the market, their devices are interoperable, and I can use Free Software controller software that I host myself that doesn't phone home. Admittedly I am dependent on binary firmware blobs embedded in every device, but at least my system has no Internet dependency whatsoever.

ClumsyPilot 5y ago
'I am dependent on binary firmware blobs embedded in every device' As long at they follow a standard, i think this is somewhat acceptable
shadowgovt 5y ago
What do you use for your hub software? I've heard good things about home-assistant.io but I haven't tried it.
- rlpb 5y ago
  I wrote my own (in Python+trio). I still need to publish it :-/ I'm sure Home Assistant would also be fine though! Currently it uses openzwave, but I found that it didn't suit me very well. So I have a half-written replacement for the low level protocol parts too, to eventually take it to pure Python.
  - jjeaff 5y ago
    Home assistant has deprecated open zwave and is now using zwave JS. Which has worked very well for me so far.

mperham 5y ago

I’m just shocked and amazed. Presumably this company had hundreds of employees, millions in revenue, etc. what would have caused them to disappear like this? I’m guessing there is a large legal aspect we haven’t heard about yet. Somebody did some crimes.

novok 5y ago
I looked into insteon products a few months before this, and there was that much community activity about it. Nobody really has talked about insteon products in the past couple years much, which has led me to believe they were dying as a company. I think it was a competition thing. There is way more cheap stuff out there now, and insteon is known as annoying and unreliable (as in devices die after a few years), so the high end market just moved to lutron.
- mperham 5y ago
  But to have no sunsetting. Unreal. I believe they were bought by private equity a few years back and their MO is: buy, leverage and go bankrupt. This fits that pattern.

llamataboot 5y ago

The LinkedIn scrubbing is the most obnoxious part of this IMHO - we've learned to expect IoT companies to go out of business or just stop supporting a product at this point, but the people involved trying to pretend they weren't is ehhhhhhh (highly recommend using home assistant and getting everything onto as much local control as possible, both to own your own data, and to know you aren't dependent on a phone home server being shut off. It can be a bit of a heavy list initially, but getting easier everyday, and onboarding is way quicker than 2-3 years ago)

usrn 5y ago
You don't even need Home Assistant. Many compliant devices just speak UPNP and have MDNS so you can just use UPNP clients. There's even a nice GTK UPNP IOT GUI for Linux.
- llamataboot 5y ago
  You don't NEED home assistant no, but likely if you have many different smart products form many different vedors and want to be able to see what is set to what and set up automations etc it would be nicer than sniffing packets to figure out what you need to say
  - haswell 5y ago
    Agreed. I use Home Assistant to standardize across the various devices I have. I have a collection of misc. Hue bulbs, Tasmota-compatible plugs and other random devices. HA acts as a HomeKit bridge, meaning that as long as I get a thing working with HA, I can control it from my Apple ecosystem. Do I need it? No. But it's extremely helpful and still meets my goals around data ownership and no dependency on an Internet connection to turn off the lights before bed.
steelframe 5y ago
> but the people involved trying to pretend they weren't is ehhhhhhh Nothing wrong with removing information about yourself in some random online profile. When the only thing that is coming from that is angry people yelling at you, I'd just as soon do the same thing. I'd get awefully bored of repeatedly pasting something like, "Per a legal agreement I have with my former employer I cannot comment on this issue," and then blocking the sender for their inevitable rage-reply. Better to just let the rage subside and then quietly add that back in your profile so you can tell a good story about an acquisition gone wrong in a future job interview.

ginkgotree 5y ago

I've stopped buying IoT devices. At first I thought, "wow, how neat, I can turn lights on with my voice." But really, switches work fine. They cost $5, don't really fail, and have filled their role since the ~1880s. I'd rather spent my mental energy coding or building more interesting things than futzing around with IoT.

antattack 5y ago
Solution is straightforward, although often not plug and play - only use IoT devices that you can control, based on ESP8266 or ESP32, that can be flashed to Tasmota, ESPhome, etc and controlled with Home Assistant.
- giantg2 5y ago
  Similar here. I'd rather set up my own home tech than pay for some connected service. My stuff isn't actually smart home stuff, but stuff like PoE security cameras with ZoneMinder, home assembled cycle timers to run sprayers or air bubblers (agriculture related), etc. I built it, so if it breaks I know how to fix it. No chance of the cloud shutting down bricking my devices.
mysterydip 5y ago
We had to mute an echo dot because our toddler was constantly trying to tell it to play songs, and alexa kept misinterpreting his requests into not-child-appropriate music.
outworlder 5y ago
IoT switches work fine (specially those with local control) and they can have the exact same role as the current switches - with the ability to also be controlled remotely. Which means that you can control them even if you are not present. Those downstairs lights you forgot to turn off? Yes, those. Or maybe you forgot to turn the coffee machine off and went on a trip? Can be turned off too, remotely, on a timer, or by sensing the reduced power draw once your cup is done. They can also be turned on and off based on presence, on time of the day, on the fact that you just turned on your TV, etc. If companies were actually trying to make good products, there would be almost zero drawbacks if we turned all current switches 'smart'. It's just a single bit in the case of switches and lights. The problem is that they want to monetize said bit in addition to the device cost, they want it to talk to a cloud, they want to make it so only their hub can flip the bit, etc. Oh, and they will have unnecessarily complex firmware with security vulnerabilities and that require regular updates. EVEN when most of the logic is in the cloud, which is mind-boggling. And cloud integrations will randomly fail. I do like the ability to be able to make all things 'smarter'. In particular, I want to be able to collect data from all devices(this all feeds to Home Assistant in my case). When you have all the data, and the ability to remotely control, you start thinking of all the use-cases you can automate. Today, I can automate when light switches turn on or off, I can have my robo vacuum not run if my 3d printer is running so it won't bump it, I can have reminders to plug in my EV (when the @#%6 Nissan API works properly). I have locally controlled power switches. I can have reminders when laundry is done. If my dishwasher was 'smart' I would be able to control when it runs (as it is, I'm going to jury rig my own solution). Also thinking about automating my garden next (I already have weather forecast information, just need moisture sensors and a pump). Honestly, we could turn our homes into a Star Trek ship bridge today, if only companies got their act together. I think there will be an 'IoT winter' as consumers get fed up with all the shenanigans.

joshstrange 5y ago

This is why I warn everyone to only buy devices that use a standard like Z-wave or Zigbee and ideally use a hub that works locally. I first got into IoT/SmartHouse stuff with SmartThings but I only would buy Z-wave/Zigbee which paid off in spades when I moved to Home Assistant. All my devices came over and the manufacturer didn't matter. Wifi IoT devices are terrible IMHO. Yes, they are easy to add and cheap to buy but you are left juggling 3-4+ apps even if they all talk to Alexa/Google/Siri. Also you are putting god-knows-what on your network. Yes, you can put them on their own vlan but still, I do not like devices in my house that can phone home even if they can't see my local devices. Stick with Z-wave or Zigbee (ideally pick just 1 or 1 main one) and if you want a nicer onboarding then SmartThings is fine but Home Assistant is probably more attractive to people on HN. At least if/when SmartThings goes under you can move your devices to a new hub.

MrStonedOne 5y ago
margalabargala 5y ago
I just started automating my house, mostly with ZigBee. For WiFi stuff- setting up ESPHome and programming ESP32s to do whatever it is I want them to do (report sensor values, twiddle gpios to control an h-bridge, whatever) is stupid easy. Highly recommend anyone who's been meaning to try ESP32s but hasn't yet take the half hour to try it out.
- joshstrange 5y ago
  ESP32 is my 1 exception to my "No WiFi rule". Really I use that rule as a blanket statement since 99.9% of what people are talking about when they have a WiFi IoT device is crap. I don't personally have any ESP32 devices but I'm not opposed and at some point I want to play with them. I've heard very good things about them on the various subreddits and on the HA podcast.
  - margalabargala 5y ago

bombcar 5y ago

Best Buy did the same thing with their HomeKit compatible light switches - they were nice enough to give you gift cards equal to the purchase price, and the switches continue to work just fine with HomeKit, though maybe you cannot set up new ones. They also annoyingly blink a green LED because they can't contact the server.

ficklepickle 5y ago

Does anyone know the current state of WebThings? I dabbled back before Mozilla dropped it and it seemed cool, but with some rough edges. I wonder if it survived the transition to a community run project.