3 ms·

I was amazed - in a bad way - when we were looking into getting solar for our home and almost all of the systems relied on some kind of mobile app for their UI,

I was amazed - in a bad way - when we were looking into getting solar for our home and almost all of the systems relied on some kind of mobile app for their UI, often via a cloud service. These are systems that should have a working life of decades! What mobile or cloud platform today will even still be here and fully compatible in ten years? Want to bet tens of thousands on that?! (Plus of course all the usual "smart" home concerns.)

mattmanser 3y ago
And worse still these things get inflicted on the next home owner. I bought a house with a "smart" boiler and the UI and app are absolutely atrocious. Worse still it doesn't have basic functionality like my parent's manual system had 40 years ago like temporarily being able to turn it on without changing the schedule, doesn't have a weekend setting, requires me to send my email address and address to a third party who then have full access to when I turn the system I to holiday mode. Basically a lovely treasure trove for thieves.
- jon-wood 3y ago
  I don’t disagree with you on shitty UI, but I’m going to question “a treasure trove for thieves”. I just don’t believe there’s some sort of house thieve’s Union running attacks on boiler infrastructure in order to work out who’s on holiday this week, especially given the low penetration on those things meaning you’re going to get visibility into one in a hundred homes. It just seems so low value compared to driving round the block for a few days and seeing who’s car hasn’t moved.
  - Silhouette 3y ago
    This is an important principle. If essential systems in everyone's homes start depending on remote connections to work and/or including spyware that phones home with any kind of data about how the system is being used then that's a serious security and privacy concern. It's bad enough that we have metered supplies of various utilities and instead of the old "agent pops round to read the meter every few months" we now have smart meters phoning home with metrics every few minutes. At least the metering is there for a legitimate reason and the change to smart meters does have some real advantages including for the homeowner so the risk is more an unintended but unavoidable side effect in those cases. Almost everything else that goes under the "smart home" banner seems to be like smart TVs and connected vehicles: if it's phoning home then it's a good bet it's doing it for their benefit and not yours.
  - egypturnash 3y ago
    Driving around costs gas and time every time you go do it. Compromising the centralized server is a one-time cost; once you've snuck something in there to regularly send updates where you can see them, you get alerts on those 1/100 houses that are rich and dumb enough to pay for this overpriced "smart" boiler. Maybe you can even work out a way to let people all over the world subscribe to these updates for a fee and let them take the risk of actually breaking in and fencing stuff. Heck, you could even hack your way into a bunch of other smart home servers, and bundle all of that up into a nice little darknet service offering regular updates of stuff like "everyone in a 20mi radius of a given point who is setting all their smart stuff to vacation mode". That sounds like it might be a pretty nice passive income stream if you don't care about the very obvious legal/ethical issues involved. And maybe your nice little darknet service could also let people say "hey, do you know anything about jon-wood?" and reply with "why yes we do, here's a few hints, would you like to pay for more?". The risk/reward calculations on this might only work out if you're a regular employee of a highly-organized crime ring instead of the mysterious hacker running a darknet site that serves as one of many hubs of a decentralized crime syndicate, I dunno. The hacker sure makes for a cooler story if you're writing a techno-thriller or a cyberpunk novel though. :)
michaelt 3y ago
99% of solar/battery systems will work just fine with no internet connection. In fact often the internet connectivity is a separate plug-in module you can just not install. Loads of these devices get installed into garages and suchlike where the wifi is no good, so most installers will know that their systems can work without internet connectivity and will be used to installing them that way.
- Silhouette 3y ago
  That all makes perfect sense and it's how we had always assumed these things worked. However we were told - by multiple installers - that they couldn't guarantee the products they were offering would continue to work for long without Internet access. Even if they didn't literally shut down with loss of power supply they wouldn't necessarily be configurable. That really matters with battery-backed systems where there are different strategies for charging them that might make sense depending on the conditions and expected usage. It seems a particularly bad design because if the power is out in our area then probably so is the Internet. (Apparently our local ISPs haven't discovered putting a UPS in with their last-mile equipment yet.) And yet these were battery-backed systems that could take over supply for our own property during an outage so having access to their UI to change settings in the event of a longer outage could be important.

mattmanser 3y ago

And worse still these things get inflicted on the next home owner. I bought a house with a "smart" boiler and the UI and app are absolutely atrocious. Worse still it doesn't have basic functionality like my parent's manual system had 40 years ago like temporarily being able to turn it on without changing the schedule, doesn't have a weekend setting, requires me to send my email address and address to a third party who then have full access to when I turn the system I to holiday mode. Basically a lovely treasure trove for thieves.

jon-wood 3y ago
I don’t disagree with you on shitty UI, but I’m going to question “a treasure trove for thieves”. I just don’t believe there’s some sort of house thieve’s Union running attacks on boiler infrastructure in order to work out who’s on holiday this week, especially given the low penetration on those things meaning you’re going to get visibility into one in a hundred homes. It just seems so low value compared to driving round the block for a few days and seeing who’s car hasn’t moved.
- Silhouette 3y ago
  This is an important principle. If essential systems in everyone's homes start depending on remote connections to work and/or including spyware that phones home with any kind of data about how the system is being used then that's a serious security and privacy concern. It's bad enough that we have metered supplies of various utilities and instead of the old "agent pops round to read the meter every few months" we now have smart meters phoning home with metrics every few minutes. At least the metering is there for a legitimate reason and the change to smart meters does have some real advantages including for the homeowner so the risk is more an unintended but unavoidable side effect in those cases. Almost everything else that goes under the "smart home" banner seems to be like smart TVs and connected vehicles: if it's phoning home then it's a good bet it's doing it for their benefit and not yours.
- egypturnash 3y ago
  Driving around costs gas and time every time you go do it. Compromising the centralized server is a one-time cost; once you've snuck something in there to regularly send updates where you can see them, you get alerts on those 1/100 houses that are rich and dumb enough to pay for this overpriced "smart" boiler. Maybe you can even work out a way to let people all over the world subscribe to these updates for a fee and let them take the risk of actually breaking in and fencing stuff. Heck, you could even hack your way into a bunch of other smart home servers, and bundle all of that up into a nice little darknet service offering regular updates of stuff like "everyone in a 20mi radius of a given point who is setting all their smart stuff to vacation mode". That sounds like it might be a pretty nice passive income stream if you don't care about the very obvious legal/ethical issues involved. And maybe your nice little darknet service could also let people say "hey, do you know anything about jon-wood?" and reply with "why yes we do, here's a few hints, would you like to pay for more?". The risk/reward calculations on this might only work out if you're a regular employee of a highly-organized crime ring instead of the mysterious hacker running a darknet site that serves as one of many hubs of a decentralized crime syndicate, I dunno. The hacker sure makes for a cooler story if you're writing a techno-thriller or a cyberpunk novel though. :)

michaelt 3y ago

99% of solar/battery systems will work just fine with no internet connection. In fact often the internet connectivity is a separate plug-in module you can just not install. Loads of these devices get installed into garages and suchlike where the wifi is no good, so most installers will know that their systems can work without internet connectivity and will be used to installing them that way.

Silhouette 3y ago
That all makes perfect sense and it's how we had always assumed these things worked. However we were told - by multiple installers - that they couldn't guarantee the products they were offering would continue to work for long without Internet access. Even if they didn't literally shut down with loss of power supply they wouldn't necessarily be configurable. That really matters with battery-backed systems where there are different strategies for charging them that might make sense depending on the conditions and expected usage. It seems a particularly bad design because if the power is out in our area then probably so is the Internet. (Apparently our local ISPs haven't discovered putting a UPS in with their last-mile equipment yet.) And yet these were battery-backed systems that could take over supply for our own property during an outage so having access to their UI to change settings in the event of a longer outage could be important.