5 ms·

I’m really worried this will become common practice. We MUST fight against this otherwise they will take away open source from us. Making an integration to work

I’m really worried this will become common practice. We MUST fight against this otherwise they will take away open source from us. Making an integration to work with devices you own is NOT ILLEGAL. I’m happy to contribute to a qualified and trustworthy gofundme to protect devs. I myself have a few integrations I made and would refuse to take them down. Granted, I intentionally don’t use any “cloud” api garbage.

DyslexicAtheist 3y ago
not only will it be common practice but likely also the law. upcoming legislation in Europe mandates secure-boot for any IoT device sold by 2025 in EU. this and the cybersec resilience act will ensure only firmware shipped and signed by the vendor are able to boot :) ... so your comment is spot-on.
- beeboobaa 3y ago
  What legalization is that? That's atrocious and only serves to fuck the end user.
  - DyslexicAtheist 3y ago
    legislation? Radio Equipment Directive which now has a huge cybersec impact. So if you want to sell hardware in EU it must be certified here is a lot of what will be in there. https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02... the final standard is not the above but based on the ideas in ETSI. While the above applies mostly to the "thing" the cloud and edge that enable services for IoT will be covered by the hotly debated CRA: https://news.ycombinator.com/item?id=38818734 https://news.ycombinator.com/item?id=38818734 https://news.ycombinator.com/item?id=38787005 https://news.ycombinator.com/item?id=38787005
deleted 3y ago
[deleted]
supergeek133 3y ago
Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company
- asylteltine 3y ago
  So? If you don’t want people using your APIs there are ways to block them. If it’s public, don’t complain.
  - supergeek133 3y ago
    That's exactly what Haier is doing, just via legal means than technical ones. We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me. In this case, it appears they've taken the same access/creds as the mobile app maybe? Another one of our platforms we cert-pinned the API to prevent this as well. Yes there are ways, the other part we don't know is if they went straight to the legal route or not.
    - asylteltine 3y ago
      Haier is abusing the threat of legal action that’s not the same thing
- beeboobaa 3y ago
  Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund. Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then! Now also just design an official home assistant module and you've turned this drama into community goodwill.
  - 3y ago
kevin_thibedeau 3y ago
Everyone working this space should include the following in their headers: * A declaration that no content copyrighted by the hardware vendor is in the codebase * The code cannot be classified as a DMCA circumvention device as it does not provide access to copyrighted works * An assertion that the RE activities are protected under US fair use doctrine for the purposes of hardware interoperability (even if not a US citizen) * Any potential trade secrets were discovered independently through the RE process This will deflate their legal team's attempts to exploit common ignorance when the code is admitted as evidence.

DyslexicAtheist 3y ago

not only will it be common practice but likely also the law. upcoming legislation in Europe mandates secure-boot for any IoT device sold by 2025 in EU. this and the cybersec resilience act will ensure only firmware shipped and signed by the vendor are able to boot :) ... so your comment is spot-on.

beeboobaa 3y ago
What legalization is that? That's atrocious and only serves to fuck the end user.
- DyslexicAtheist 3y ago
  legislation? Radio Equipment Directive which now has a huge cybersec impact. So if you want to sell hardware in EU it must be certified here is a lot of what will be in there. https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02... the final standard is not the above but based on the ideas in ETSI. While the above applies mostly to the "thing" the cloud and edge that enable services for IoT will be covered by the hotly debated CRA: https://news.ycombinator.com/item?id=38818734 https://news.ycombinator.com/item?id=38818734 https://news.ycombinator.com/item?id=38787005 https://news.ycombinator.com/item?id=38787005

deleted 3y ago

[deleted]

supergeek133 3y ago

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company

asylteltine 3y ago
So? If you don’t want people using your APIs there are ways to block them. If it’s public, don’t complain.
- supergeek133 3y ago
  That's exactly what Haier is doing, just via legal means than technical ones. We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me. In this case, it appears they've taken the same access/creds as the mobile app maybe? Another one of our platforms we cert-pinned the API to prevent this as well. Yes there are ways, the other part we don't know is if they went straight to the legal route or not.
  - asylteltine 3y ago
    Haier is abusing the threat of legal action that’s not the same thing
beeboobaa 3y ago
Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund. Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then! Now also just design an official home assistant module and you've turned this drama into community goodwill.
- 3y ago

kevin_thibedeau 3y ago

Everyone working this space should include the following in their headers: * A declaration that no content copyrighted by the hardware vendor is in the codebase * The code cannot be classified as a DMCA circumvention device as it does not provide access to copyrighted works * An assertion that the RE activities are protected under US fair use doctrine for the purposes of hardware interoperability (even if not a US citizen) * Any potential trade secrets were discovered independently through the RE process This will deflate their legal team's attempts to exploit common ignorance when the code is admitted as evidence.