18 ms·

Smart ovens shouting out to servers in Russia and China

98 points by pseudotrash 4y ago

Havoc 4y ago
I spent last weekend moving my access point behind an opnsense firewall so that I can see what's happening. Things having wifi is grand...but needs to work locally. I've also had one case already where it works locally (HA) but eventually the device hits a overflow issue if it can't resolve the phone home address.
bognition 4y ago
The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes. My guess is this isn't about sending data to those sites, but rather using relying on high availability urls that you can connect to from most countries. Is this bad engineering? Probably. Is it nefarious? Probably not. One thing to keep in mind is that the companies making these smart appliances do not make their money from the internet connected features. Internet connectivity may be enough for to push a buyer over the edge or for the device to qualify for some rebate. The manufactures make them from selling ovens. This means they probably don't have the best software development team or processes.
- pyrolistical 4y ago
  You can never tell if it’s a covert channel. Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected
  - mstolpm 4y ago
    What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way? Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.
    - nerdponx 4y ago
      Oven usage data is probably extremely valuable for advertisers.
    - uoaei 4y ago
      The things you can do with statistical methods nowadays might blow your mind if you think there is not much information in oven usage. You could infer likely occupancy periods of the home, since obviously if the house is empty no one is pushing buttons on the oven, and use some basic priors (9-5 jobs, x number of kids) to develop what is likely a pretty accurate model that would be profitable to sell to advertisers. Perhaps there are sensitive voltmeters on the power supply that can detect usage of other devices on the same circuit. Not to mention that it is yet one more channel of information alongside the flood of data being generated about you and your home by the rest of the devices you have incorporated into your life, and these things tend to have superlinear benefits when combined a la "multi-task" ML contexts. This is not an exhaustive list.
  - tarotuser 4y ago
    Moreso, you never know if there's some logic bomb inserted in the response. And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.
- sizzzzlerz 4y ago
  For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.
  - jchw 4y ago
    No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known. As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch... I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.
    - sizzzzlerz 4y ago
      I agree its probably benign, but its really hard to trust companies these days to do the right thing. Consumers are basically being treated as sheep to be sheared.
  - pphysch 4y ago
    And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents). This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.
- Aperocky 4y ago
  looks like an OR relationship. Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.
- kurthr 4y ago
  I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).
  - rcme 4y ago
    Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.
    - evilduck 4y ago
      Removing antennas from electronics isn't too hard, or worst case, physically damaging them or installing faraday cages. Seems like an interesting cottage industry that could bloom around intentionally stupifying your unwanted smart home.
      - counttheforks 4y ago
        I'm sure they'll just throw error messages until they've managed to establish a connection. Device manufacturers have already shown they'd rather cripple your devices than respect your wishes.
      - HeyLaughingBoy 4y ago
        Antennas on cheap consumer devices are often just a trace on the PC board. Still not that hard to remove (could just cut the trace), but harder to do without damaging anything than unplugging an external one.
    - sizzzzlerz 4y ago
      Enclose your kitchen in a Faraday cage.
    - LeifCarrotson 4y ago
- BizarreByte 4y ago
  I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.
  - megous 4y ago
    Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.
    - lesuorac 4y ago
      Do you know how many ovens there are? The AWS lambda fees are going to be insane! So much cheaper just to ping google.com instead.
      - megous 4y ago
        Let's see: ping packet size is say 64 bytes so 128B both ways My $3 VPS has 1TiB/mo bandwidth limit. So that's 2^40 / 128 / 24 / 60 / 30 = ~200k ovens pinging once every minute (which is ridiculous frequency) for $3 I guess if manufacturer can't afford $3 per 200k ovens sold, he should go out of business or stop stuffing ovens with IoT shit. :)
      - skellera 4y ago
        Hopefully no one is using lambda for connection health checks. An empty static page on a CDN is probably a better use of resources. But yeah, at that point just ping google since they’ve spent millions on availability.
      - Tobani 4y ago
        I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.
- deleted 4y ago
  [deleted]
- cnorthwood 4y ago
  When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk http://www.bbc.co.uk might have broken some things.
  - luckylion 4y ago
    There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.
    - neurostimulant 4y ago
      Some internet connectivity check endpoints I see in my home networks: - http://detectportal.firefox.com http://detectportal.firefox.com - http://ping.manjaro.org/check_network_status.txt http://ping.manjaro.org/check_network_status.txt - http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 - http://captive.apple.com http://captive.apple.com - http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt - http://api.ipify.org http://api.ipify.org The manjaro one will respond with "NetworkManager is online" when accessed from curl, but redirect to manjaro homepage when accessed from a browser.
    - xxpor 4y ago
      A good use case for using HEAD instead of GET
      - alex_suzuki 4y ago
        Ancient wisdom… easily forgotten.
- United857 4y ago
  Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.
  - red-iron-pine 4y ago
    that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google. Guess you're out of luck in Turkmenistan, but works well enough most other places.
- amelius 4y ago
  > Is this bad engineering? Probably. Curious, how would you implement it?
- iforgotpassword 4y ago
  Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...
- counttheforks 4y ago
  They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.
- skibidibipiti 4y ago
  [dead]
- karmicthreat 4y ago
  So what IS the correct way?
gloyoyo 4y ago
You can supposedly keep the internet alive with just this method of using your stove... If you want more look up doomsday survival plan using stoves.
jesprenj 4y ago
Why would an oven need Internet access? You physically need to open the oven and put stuff in it and then take it out. Food over IP is not a thing yet. Unless it has an internal camera with which you can observe the food while it's cooking, I see no advantage of using an Internet connected oven. edit: okay, preheat, fair - that's actually useful
- harveywi 4y ago
  The electromagnetic radiation from the wi-fi antenna helps the food cook more quickly.
- simonsarris 4y ago
  I'm against stuff like this and totally eschew even offline gadgets, but its not that hard to come up with some use cases. After you left the house: "Did I turn off the oven? Did I turn off a burner (eg slowly cooking a bean bot)?" Now you can know. Is a (top or interior or anywhere) burner slowly leaking and should alert the owner? Maybe. And as you said, pre-heating, though this is actually a feature that makes things more dangerous! If you or someone else was temporarily storing something not-ovenable in the oven and pre-heated remotely, you could come home to something very bad.
  - nerdponx 4y ago
    I'd much rather have the oven connect to a physical device on my home LAN instead, which I could then access through a web interface with a tunneled port or whatever. Same with security cameras, smart lightbulbs, etc. None of this stuff should ever be connecting to the Internet directly.
  - rcme 4y ago
    You could add a camera to the oven to see what's inside from the app.
    - Finnucane 4y ago
      "How did that batch of cookies get in there?"
imtringued 4y ago
House fire as a service...
- JonChesterfield 4y ago
  I started to write "surely the network connection can't control the temperature" but, ah, on second thoughts you're probably right. Expect it gives root access if asked sternly too.
somat 4y ago
The real wtf here, I mean once you get past how stupid it is that your oven is now connected to the internet. Is why does it need to check if the internet is available? There are two cases, it can reach it's api endpoint and will work, or it can not reach it's api endpoint and will not work. The availability of several well known domains has no effect on this. The only reason I can think of is so you can have a different error message for "the oven service is down" and "unable to access the oven service". Even then you only need to make that check when the api access fails. Tangently: I don't quite buy the prewarming use case, the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on.
- pixl97 4y ago
  Prewarming notification/timer complete is nice especially when I'm gaming/programming and tend forget the world exists. Also reaching out for NTP and keeping the time updated is useful. But yea, keeping these internet of shit devices on their own VLAN and monitoring what they are up to leads to a lot of 'um, what is going on' moments.
  - TheCapn 4y ago
    Ovens with a probe: is my roast at temperature yet? Of all appliances in my kitchen the oven makes the most sense to have network features. Fridge perhaps a distant second, and that's only because I really wish I knew my compressor had failed and could've rescued the $350+ of groceries that spoiled if something had alerted me to the temp rising while the compressor was still attempting to run.
- iforgotpassword 4y ago
  Not that I'd ever connect an iot device to my wifi/internet, but yes, that only reason is the reason. I absolutely would want to know if it's potentially a problem on my end or their end.
- tgv 4y ago
  > the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on. Do they still sell ovens without a timer? Mine (which is quite old) requires setting the time in advance. Forgetting is simply not an option. Of course, they could start selling ovens without timers to stimulate the sales of internet-connected ones...
pokepim 4y ago
Tbh as American should I be more worried if my data is shared with some far away government agent who is probably pronouncing my name incorrectly or our domestic favourites NSA or FBI? I believe the current paranoia about China completely overshadows the real danger for american citizens, but maybe that is the intention.
jeoqn 4y ago
Wow… Russia AND China… that’s like the axis of evil, dude!
RobotToaster 4y ago
Now the entire CCP knows I just burnt this souffle, my god!
- BitwiseFool 4y ago
  Individually the vast majority of IOT data points will not be of any espionage value. But I'm sure intelligence agencies will be able to glean insight from the data in unexpected but still useful ways in aggregate.
  - tgv 4y ago
    Imagine being able to turn on all electric ovens at once in time of war. That already might be enough to cripple your enemy's electric grid.
    - okasaki 4y ago
      Well, it would definitely be enough to cripple your exports because nobody would buy from you any more. You might want to re-calibrate your imagination.
      - tgv 4y ago
        It would be a bit late to demand a refund, wouldn't it? There are more incentives in this world than such a narrow profit-oriented view.
    - jstarfish 4y ago
      More likely all this IoT garbage gets recruited into a botnet for domestic DDoS/amplification attacks.
fwungy 4y ago
My oven and refrigerator pump out RF beyond the range of my RF meter. I found the wifi chips in both and pulled them out. There was no way to turn them off through the interface for either.
Finnucane 4y ago
We have a simple rule: do not buy anything with wifi that does not actually need to have wifi. Which is most things. I've survived my entire life with dumb appliances. Maybe I am just becoming a cranky old man, but there aren't any smart 'features' that seem worth the surveillance and security hassles, as well as the eventual obsolescence and failure of the smart components, which will only serve to shorten the useful lifespan of the appliance. Are we being promised support for 20 or more years of service?
stuaxo 4y ago
Yeah, an oven you can turn on remotely, I'm glad it's secure but that really should not be a thing, no no and no again.
snapetom 4y ago
I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering. I'll at least give this company credit for giving an example, but like usual, the response is flimsy. There's almost always much better ways to handle situations these companies claim they're covering. I recently discovered I couldn't change my email address at Target.com. When I asked the rep why, they responded "It's because of security." I told them, "I know you have nothing to do with the policy, but please let your managers know there's better ways to handle this. One thing you guys can do is never again hire an MFA as a CISO in the future."
- dsfyu404ed 4y ago
  >I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering. See also liability/safety and in a more limited set of contexts, national security and children. The people who really make me want to break out ye olden guillotine are the ones who'll spot the BS in one context but who's knee-jerk reaction is to take it right down the throat or even defend the BS without even a hint of critical thought in another. Have some self-awareness people.
  - deleted 4y ago
    [deleted]
danabrams 4y ago
Those spies are going to know I burned the roast!
consumer451 4y ago
You know what's much worse? When I was playing with blocking shady countries via pfSense, I found that making a NVIDIA GeForce Now account uses .cn servers by default. Why?
jonathanlydall 4y ago
My Siemens dishwasher is smart and it’s got a nice feature where from my phone I can set it to start or finish washing at a certain time. Except, if there is a power failure it forgets the schedule. At the moment in South Africa we lose power 2-4 times a day for 2 hours at a time due to load shedding (useless government and power utility). This powerloss scenario is not a rare edge case here. It’s a pity because I would like to schedule the dishwasher to start after the power is due back (the load shedding is on a mostly reliable schedule), but with this loss of memory, that doesn’t work. Relatedly, on my oven (and the AEG one at my previous place) you can’t turn them on until you set the clock, as someone who lives where there are multiple power outages a day, this seems like the most counter productive “feature” ever, is it actually useful in some way?
- anonomousename 4y ago
  If your dishwasher is simply idle until you schedule it, a small UPS may be able to do the job, as during a power outage it would just be powering the electronics and not anything else. Unrelated, but it sounds like scheduled power outages is a great use case for a backup inverter for your home.
  - jonathanlydall 4y ago
    I actually do have an inverter and solar panels and I have my house divided into two circuits, essential and non-essential. Non-essential loses power when grid is disconnected, essential is on UPS. I have 10kw/h of batteries, but I’ve set their minimum charge (while on grid) to 40%. Things on my non-essential: - Geyser - Stove and Oven - Pool pump - Dishwasher - Under floor heating (which is on a timer to only run during sunlight hours). I have been considering moving the dishwasher to the essential circuit, but if someone accidentally runs it when the grid is offline, it drains the batteries very fast. What would actually be nice is if the dishwasher could out the box integrate with some sort of home automation system and it could then make decisions to stop it during power outage automatically.
pleb_nz 4y ago
This article got me thinking about the use of the term smart. I'm not sure why we call the every connected device smart. For the most part they're connected devices not smart devices. Smart to me means more than just being able to be controlled remotely. I think this is likely been pushed by marketing, but just because corporations say it's 'smart', does that mean we should all blindly start following suit. On a bigger note, we probably do this blindly for lots of products and services, trust and use the terms we're sold by entities that are mostly only interested in one thing... I'm as guilty as anyone, bit it would be good if we wised up to this stuff a bit more.

98 points by pseudotrash 4y ago

I spent last weekend moving my access point behind an opnsense firewall so that I can see what's happening. Things having wifi is grand...but needs to work locally. I've also had one case already where it works locally (HA) but eventually the device hits a overflow issue if it can't resolve the phone home address.

bognition 4y ago

The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes. My guess is this isn't about sending data to those sites, but rather using relying on high availability urls that you can connect to from most countries. Is this bad engineering? Probably. Is it nefarious? Probably not. One thing to keep in mind is that the companies making these smart appliances do not make their money from the internet connected features. Internet connectivity may be enough for to push a buyer over the edge or for the device to qualify for some rebate. The manufactures make them from selling ovens. This means they probably don't have the best software development team or processes.

pyrolistical 4y ago
You can never tell if it’s a covert channel. Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected
- mstolpm 4y ago
  What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way? Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.
  - nerdponx 4y ago
    Oven usage data is probably extremely valuable for advertisers.
  - uoaei 4y ago
    The things you can do with statistical methods nowadays might blow your mind if you think there is not much information in oven usage. You could infer likely occupancy periods of the home, since obviously if the house is empty no one is pushing buttons on the oven, and use some basic priors (9-5 jobs, x number of kids) to develop what is likely a pretty accurate model that would be profitable to sell to advertisers. Perhaps there are sensitive voltmeters on the power supply that can detect usage of other devices on the same circuit. Not to mention that it is yet one more channel of information alongside the flood of data being generated about you and your home by the rest of the devices you have incorporated into your life, and these things tend to have superlinear benefits when combined a la "multi-task" ML contexts. This is not an exhaustive list.
- tarotuser 4y ago
  Moreso, you never know if there's some logic bomb inserted in the response. And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.
sizzzzlerz 4y ago
For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.
- jchw 4y ago
  No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known. As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch... I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.
  - sizzzzlerz 4y ago
    I agree its probably benign, but its really hard to trust companies these days to do the right thing. Consumers are basically being treated as sheep to be sheared.
- pphysch 4y ago
  And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents). This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.
Aperocky 4y ago
looks like an OR relationship. Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.
kurthr 4y ago
I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).
- rcme 4y ago
  Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.
  - evilduck 4y ago
    Removing antennas from electronics isn't too hard, or worst case, physically damaging them or installing faraday cages. Seems like an interesting cottage industry that could bloom around intentionally stupifying your unwanted smart home.
    - counttheforks 4y ago
      I'm sure they'll just throw error messages until they've managed to establish a connection. Device manufacturers have already shown they'd rather cripple your devices than respect your wishes.
    - HeyLaughingBoy 4y ago
      Antennas on cheap consumer devices are often just a trace on the PC board. Still not that hard to remove (could just cut the trace), but harder to do without damaging anything than unplugging an external one.
  - sizzzzlerz 4y ago
    Enclose your kitchen in a Faraday cage.
  - LeifCarrotson 4y ago
BizarreByte 4y ago
I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.
- megous 4y ago
  Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.
  - lesuorac 4y ago
    Do you know how many ovens there are? The AWS lambda fees are going to be insane! So much cheaper just to ping google.com instead.
    - megous 4y ago
      Let's see: ping packet size is say 64 bytes so 128B both ways My $3 VPS has 1TiB/mo bandwidth limit. So that's 2^40 / 128 / 24 / 60 / 30 = ~200k ovens pinging once every minute (which is ridiculous frequency) for $3 I guess if manufacturer can't afford $3 per 200k ovens sold, he should go out of business or stop stuffing ovens with IoT shit. :)
    - skellera 4y ago
      Hopefully no one is using lambda for connection health checks. An empty static page on a CDN is probably a better use of resources. But yeah, at that point just ping google since they’ve spent millions on availability.
    - Tobani 4y ago
      I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.
deleted 4y ago
[deleted]
cnorthwood 4y ago
When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk http://www.bbc.co.uk might have broken some things.
- luckylion 4y ago
  There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.
  - neurostimulant 4y ago
    Some internet connectivity check endpoints I see in my home networks: - http://detectportal.firefox.com http://detectportal.firefox.com - http://ping.manjaro.org/check_network_status.txt http://ping.manjaro.org/check_network_status.txt - http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 - http://captive.apple.com http://captive.apple.com - http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt - http://api.ipify.org http://api.ipify.org The manjaro one will respond with "NetworkManager is online" when accessed from curl, but redirect to manjaro homepage when accessed from a browser.
  - xxpor 4y ago
    A good use case for using HEAD instead of GET
    - alex_suzuki 4y ago
      Ancient wisdom… easily forgotten.
United857 4y ago
Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.
- red-iron-pine 4y ago
  that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google. Guess you're out of luck in Turkmenistan, but works well enough most other places.
amelius 4y ago
> Is this bad engineering? Probably. Curious, how would you implement it?
iforgotpassword 4y ago
Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...
counttheforks 4y ago
They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.
skibidibipiti 4y ago
[dead]
karmicthreat 4y ago
So what IS the correct way?

gloyoyo 4y ago

You can supposedly keep the internet alive with just this method of using your stove... If you want more look up doomsday survival plan using stoves.

jesprenj 4y ago

Why would an oven need Internet access? You physically need to open the oven and put stuff in it and then take it out. Food over IP is not a thing yet. Unless it has an internal camera with which you can observe the food while it's cooking, I see no advantage of using an Internet connected oven. edit: okay, preheat, fair - that's actually useful

harveywi 4y ago
The electromagnetic radiation from the wi-fi antenna helps the food cook more quickly.
simonsarris 4y ago
I'm against stuff like this and totally eschew even offline gadgets, but its not that hard to come up with some use cases. After you left the house: "Did I turn off the oven? Did I turn off a burner (eg slowly cooking a bean bot)?" Now you can know. Is a (top or interior or anywhere) burner slowly leaking and should alert the owner? Maybe. And as you said, pre-heating, though this is actually a feature that makes things more dangerous! If you or someone else was temporarily storing something not-ovenable in the oven and pre-heated remotely, you could come home to something very bad.
- nerdponx 4y ago
  I'd much rather have the oven connect to a physical device on my home LAN instead, which I could then access through a web interface with a tunneled port or whatever. Same with security cameras, smart lightbulbs, etc. None of this stuff should ever be connecting to the Internet directly.
- rcme 4y ago
  You could add a camera to the oven to see what's inside from the app.
  - Finnucane 4y ago
    "How did that batch of cookies get in there?"

imtringued 4y ago

House fire as a service...

JonChesterfield 4y ago
I started to write "surely the network connection can't control the temperature" but, ah, on second thoughts you're probably right. Expect it gives root access if asked sternly too.

somat 4y ago

The real wtf here, I mean once you get past how stupid it is that your oven is now connected to the internet. Is why does it need to check if the internet is available? There are two cases, it can reach it's api endpoint and will work, or it can not reach it's api endpoint and will not work. The availability of several well known domains has no effect on this. The only reason I can think of is so you can have a different error message for "the oven service is down" and "unable to access the oven service". Even then you only need to make that check when the api access fails. Tangently: I don't quite buy the prewarming use case, the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on.

pixl97 4y ago
Prewarming notification/timer complete is nice especially when I'm gaming/programming and tend forget the world exists. Also reaching out for NTP and keeping the time updated is useful. But yea, keeping these internet of shit devices on their own VLAN and monitoring what they are up to leads to a lot of 'um, what is going on' moments.
- TheCapn 4y ago
  Ovens with a probe: is my roast at temperature yet? Of all appliances in my kitchen the oven makes the most sense to have network features. Fridge perhaps a distant second, and that's only because I really wish I knew my compressor had failed and could've rescued the $350+ of groceries that spoiled if something had alerted me to the temp rising while the compressor was still attempting to run.
iforgotpassword 4y ago
Not that I'd ever connect an iot device to my wifi/internet, but yes, that only reason is the reason. I absolutely would want to know if it's potentially a problem on my end or their end.
tgv 4y ago
> the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on. Do they still sell ovens without a timer? Mine (which is quite old) requires setting the time in advance. Forgetting is simply not an option. Of course, they could start selling ovens without timers to stimulate the sales of internet-connected ones...

pokepim 4y ago

Tbh as American should I be more worried if my data is shared with some far away government agent who is probably pronouncing my name incorrectly or our domestic favourites NSA or FBI? I believe the current paranoia about China completely overshadows the real danger for american citizens, but maybe that is the intention.

jeoqn 4y ago

Wow… Russia AND China… that’s like the axis of evil, dude!

RobotToaster 4y ago

Now the entire CCP knows I just burnt this souffle, my god!

BitwiseFool 4y ago
Individually the vast majority of IOT data points will not be of any espionage value. But I'm sure intelligence agencies will be able to glean insight from the data in unexpected but still useful ways in aggregate.
- tgv 4y ago
  Imagine being able to turn on all electric ovens at once in time of war. That already might be enough to cripple your enemy's electric grid.
  - okasaki 4y ago
    Well, it would definitely be enough to cripple your exports because nobody would buy from you any more. You might want to re-calibrate your imagination.
    - tgv 4y ago
      It would be a bit late to demand a refund, wouldn't it? There are more incentives in this world than such a narrow profit-oriented view.
  - jstarfish 4y ago
    More likely all this IoT garbage gets recruited into a botnet for domestic DDoS/amplification attacks.

fwungy 4y ago

My oven and refrigerator pump out RF beyond the range of my RF meter. I found the wifi chips in both and pulled them out. There was no way to turn them off through the interface for either.

Finnucane 4y ago

We have a simple rule: do not buy anything with wifi that does not actually need to have wifi. Which is most things. I've survived my entire life with dumb appliances. Maybe I am just becoming a cranky old man, but there aren't any smart 'features' that seem worth the surveillance and security hassles, as well as the eventual obsolescence and failure of the smart components, which will only serve to shorten the useful lifespan of the appliance. Are we being promised support for 20 or more years of service?

stuaxo 4y ago

Yeah, an oven you can turn on remotely, I'm glad it's secure but that really should not be a thing, no no and no again.

snapetom 4y ago

I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering. I'll at least give this company credit for giving an example, but like usual, the response is flimsy. There's almost always much better ways to handle situations these companies claim they're covering. I recently discovered I couldn't change my email address at Target.com. When I asked the rep why, they responded "It's because of security." I told them, "I know you have nothing to do with the policy, but please let your managers know there's better ways to handle this. One thing you guys can do is never again hire an MFA as a CISO in the future."

dsfyu404ed 4y ago
>I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering. See also liability/safety and in a more limited set of contexts, national security and children. The people who really make me want to break out ye olden guillotine are the ones who'll spot the BS in one context but who's knee-jerk reaction is to take it right down the throat or even defend the BS without even a hint of critical thought in another. Have some self-awareness people.
- deleted 4y ago
  [deleted]

danabrams 4y ago

Those spies are going to know I burned the roast!

consumer451 4y ago

You know what's much worse? When I was playing with blocking shady countries via pfSense, I found that making a NVIDIA GeForce Now account uses .cn servers by default. Why?

jonathanlydall 4y ago

My Siemens dishwasher is smart and it’s got a nice feature where from my phone I can set it to start or finish washing at a certain time. Except, if there is a power failure it forgets the schedule. At the moment in South Africa we lose power 2-4 times a day for 2 hours at a time due to load shedding (useless government and power utility). This powerloss scenario is not a rare edge case here. It’s a pity because I would like to schedule the dishwasher to start after the power is due back (the load shedding is on a mostly reliable schedule), but with this loss of memory, that doesn’t work. Relatedly, on my oven (and the AEG one at my previous place) you can’t turn them on until you set the clock, as someone who lives where there are multiple power outages a day, this seems like the most counter productive “feature” ever, is it actually useful in some way?

anonomousename 4y ago
If your dishwasher is simply idle until you schedule it, a small UPS may be able to do the job, as during a power outage it would just be powering the electronics and not anything else. Unrelated, but it sounds like scheduled power outages is a great use case for a backup inverter for your home.
- jonathanlydall 4y ago
  I actually do have an inverter and solar panels and I have my house divided into two circuits, essential and non-essential. Non-essential loses power when grid is disconnected, essential is on UPS. I have 10kw/h of batteries, but I’ve set their minimum charge (while on grid) to 40%. Things on my non-essential: - Geyser - Stove and Oven - Pool pump - Dishwasher - Under floor heating (which is on a timer to only run during sunlight hours). I have been considering moving the dishwasher to the essential circuit, but if someone accidentally runs it when the grid is offline, it drains the batteries very fast. What would actually be nice is if the dishwasher could out the box integrate with some sort of home automation system and it could then make decisions to stop it during power outage automatically.

pleb_nz 4y ago

This article got me thinking about the use of the term smart. I'm not sure why we call the every connected device smart. For the most part they're connected devices not smart devices. Smart to me means more than just being able to be controlled remotely. I think this is likely been pushed by marketing, but just because corporations say it's 'smart', does that mean we should all blindly start following suit. On a bigger note, we probably do this blindly for lots of products and services, trust and use the terms we're sold by entities that are mostly only interested in one thing... I'm as guilty as anyone, bit it would be good if we wised up to this stuff a bit more.