4 ms·

Home Assistant users are small minority of many of these companies user bases (including ours), and these integrations being locally focused often poll HEAVILY

Home Assistant users are small minority of many of these companies user bases (including ours), and these integrations being locally focused often poll HEAVILY causing an upside down ratio in API traffic compared to all other users. The solution is to allow local interfaces (matter, HTTP, etc) but most company cybersecurity teams just freak out at this. Oh, and the reason we don't have a full time team managing HA is like I said.. addressable market versus FAANG/Samsung. It takes a full time person (persons) to manage Alexa, Google, Samsung, etc.

redeeman 3y ago
> but most company cybersecurity teams just freak out at this. Yeah, and we can see(in general) how good they are. is there any such shitty consumer thing that doesnt have atrocious security?
- supergeek133 3y ago
  Security via obscurity and "closed loop" tends to be the answer, plus whatever doesn't show up on a scan tool. Thankfully we have a (fairly) accessible API to the cloud side. TBD on what (if anything) matter will change.
stefan_ 3y ago
Why would the cybersecurity freak out at that, that seems opposite. The company owning the data (and controls!) is much more of a risk.
- supergeek133 3y ago
  Don't ask me to explain the mindset of your average "tool runner" cybersecurity person. I've long advocated a local HTTP interface for our products, but usually a losing battle.
  - kube-system 3y ago
    >local HTTP interface A lot of the worst IoT vulnerabilities in the past have been due to exactly that. 'Local' unfortunately isn't something decided at design time, it's decided when someone connects it to a network. Most people plugging these devices in don't have any clue how to simultaneously secure them and connect them to the internet, so they often end up directly on the internet with default credentials or with outdated vulnerable software and a port open. That's the biggest reason all of the major players now just close all inbound ports and reach outbound to a cloud service. It checks both boxes of usability and network security with even the most misguided user. Yes, this arrangement sucks for people who know better. But we aren't the people in the user stories.
    - supergeek133 3y ago
      Even though I advocate for a local interface, I also completely agree with your statement. But, the alternative is we either accept this completely upside down API traffic ratio with locally focused integrations (bad, costs lots of money) or allow a local interface. Another potential workaround I advocated for was a "cloud down" message that could enable the local interface for those that ONLY go looking for how to do it.
      - MostlyStable 3y ago
        I'd be 100% on board with local control being a minor PITA to enable, as long as it's allowed and supported. I'd even be ok all the way up to needing to reflash the board to allow it. Making it so that only people who care and are more likely to use it in a responsible way have access is pretty reasonable! Not having the option isn't (in my opinion).
      - kube-system 3y ago
        With my developer hat on, I agree. With my business hat on, I'm not so sure. "Why are we spending development resources on a feature that isn't valuable for our target users?" I could definitely see doing this if it were a product with a prosumer-type angle to the value prop. But for the devices we see on the shelf at a big-box store, I don't think those companies' management considers that valuable.
nostrademons 3y ago
Hah, the staff on Assistant working on home integrations measured in the hundreds (I used to work adjacent to those teams). Of course most of them were either laid off or reassigned to other projects, so it's pretty likely that Assistant will stop working soon, if it hasn't already.
- supergeek133 3y ago
  It takes a lot more to deal with/manage these integrations than some on HN ever realize, especially when these stories come up.
- MostlyStable 3y ago
  Hold up....Home Assistant staff has been recently cut in a way that you think the entire thing is likely to stop working in the near future? That is a very major claim to be making. If that's true (or even plausible) it's a very huge deal. Is there anywhere I could read about any of that? -edit- also I'm either misunderstanding your comment or learning something very major about HA. I didn't realize it was a cohesive enough entity to have "staff" that could be moved around/laid off.
  - supergeek133 3y ago
    I'm guessing when they're saying "Assistant" they're talking about Google. Not HA.
    - MostlyStable 3y ago
      That makes more sense, you're right.
  - antonyt 3y ago
    They must be talking about teams at Amazon, Google, or Samsung. HomeAssistant doesn't have hundreds of staff to begin with.
neurostimulant 3y ago
Yet most 3rd party home assistant integrations are maintained by a single person in their free time. The devs targeted by Haier even maintains TWO integrations in his own free time. It doesn't have to cost the manufacturer one full-time employee to maintain a relation with the home assistant community. Just let the community do the work to develop integration for your products for free! Just look at how companies like Asus maintain a relationship with open source router firmware maintainers for example. Asus spent a minimal effort in that front, yet the community is very happy and keep recommending Asus routers to their friends and family. It's basically a win-win relationship. All Haier need to do is sending an email to the maintainer of the open source integration asking them to not polling so heavily and they'll usually comply! It shouldn't take a dedicated employee 40 hours per week to send that email. Taking down an integration should be the last resort because it burns the goodwill of your community. The first step should be reaching out to the dev and work something out.

redeeman 3y ago

> but most company cybersecurity teams just freak out at this. Yeah, and we can see(in general) how good they are. is there any such shitty consumer thing that doesnt have atrocious security?

supergeek133 3y ago
Security via obscurity and "closed loop" tends to be the answer, plus whatever doesn't show up on a scan tool. Thankfully we have a (fairly) accessible API to the cloud side. TBD on what (if anything) matter will change.

stefan_ 3y ago

Why would the cybersecurity freak out at that, that seems opposite. The company owning the data (and controls!) is much more of a risk.

supergeek133 3y ago
Don't ask me to explain the mindset of your average "tool runner" cybersecurity person. I've long advocated a local HTTP interface for our products, but usually a losing battle.
- kube-system 3y ago
  >local HTTP interface A lot of the worst IoT vulnerabilities in the past have been due to exactly that. 'Local' unfortunately isn't something decided at design time, it's decided when someone connects it to a network. Most people plugging these devices in don't have any clue how to simultaneously secure them and connect them to the internet, so they often end up directly on the internet with default credentials or with outdated vulnerable software and a port open. That's the biggest reason all of the major players now just close all inbound ports and reach outbound to a cloud service. It checks both boxes of usability and network security with even the most misguided user. Yes, this arrangement sucks for people who know better. But we aren't the people in the user stories.
  - supergeek133 3y ago
    Even though I advocate for a local interface, I also completely agree with your statement. But, the alternative is we either accept this completely upside down API traffic ratio with locally focused integrations (bad, costs lots of money) or allow a local interface. Another potential workaround I advocated for was a "cloud down" message that could enable the local interface for those that ONLY go looking for how to do it.
    - MostlyStable 3y ago
      I'd be 100% on board with local control being a minor PITA to enable, as long as it's allowed and supported. I'd even be ok all the way up to needing to reflash the board to allow it. Making it so that only people who care and are more likely to use it in a responsible way have access is pretty reasonable! Not having the option isn't (in my opinion).
    - kube-system 3y ago
      With my developer hat on, I agree. With my business hat on, I'm not so sure. "Why are we spending development resources on a feature that isn't valuable for our target users?" I could definitely see doing this if it were a product with a prosumer-type angle to the value prop. But for the devices we see on the shelf at a big-box store, I don't think those companies' management considers that valuable.

nostrademons 3y ago

Hah, the staff on Assistant working on home integrations measured in the hundreds (I used to work adjacent to those teams). Of course most of them were either laid off or reassigned to other projects, so it's pretty likely that Assistant will stop working soon, if it hasn't already.

supergeek133 3y ago
It takes a lot more to deal with/manage these integrations than some on HN ever realize, especially when these stories come up.
MostlyStable 3y ago
Hold up....Home Assistant staff has been recently cut in a way that you think the entire thing is likely to stop working in the near future? That is a very major claim to be making. If that's true (or even plausible) it's a very huge deal. Is there anywhere I could read about any of that? -edit- also I'm either misunderstanding your comment or learning something very major about HA. I didn't realize it was a cohesive enough entity to have "staff" that could be moved around/laid off.
- supergeek133 3y ago
  I'm guessing when they're saying "Assistant" they're talking about Google. Not HA.
  - MostlyStable 3y ago
    That makes more sense, you're right.
- antonyt 3y ago
  They must be talking about teams at Amazon, Google, or Samsung. HomeAssistant doesn't have hundreds of staff to begin with.

neurostimulant 3y ago

Yet most 3rd party home assistant integrations are maintained by a single person in their free time. The devs targeted by Haier even maintains TWO integrations in his own free time. It doesn't have to cost the manufacturer one full-time employee to maintain a relation with the home assistant community. Just let the community do the work to develop integration for your products for free! Just look at how companies like Asus maintain a relationship with open source router firmware maintainers for example. Asus spent a minimal effort in that front, yet the community is very happy and keep recommending Asus routers to their friends and family. It's basically a win-win relationship. All Haier need to do is sending an email to the maintainer of the open source integration asking them to not polling so heavily and they'll usually comply! It shouldn't take a dedicated employee 40 hours per week to send that email. Taking down an integration should be the last resort because it burns the goodwill of your community. The first step should be reaching out to the dev and work something out.