7 ms·

My first reaction here was horror: Home Assistant and Zigbee integrate perfectly with IKEA’s devices, and the devices are beautifully designed! Please don’t ta

My first reaction here was horror: Home Assistant and Zigbee integrate perfectly with IKEA’s devices, and the devices are beautifully designed! Please don’t take these away! Only the other day did I marvel at how a low battery indicator flashes on one of my remotes when I use it. A design flourish that I really appreciated. But I read that Thread supports IPv6 via mesh networking. It did always feel a bit awkward having Zigbee networking and IP networking competing over the same site. It would be very nice to issue commands from any peer to any other peer, using standard networking. Can anyone here confirm that Matter/Thread will be a bright, open, and happy new future? A lot of people I know would scoff at “smart home” stuff. I used to. Having a programmable house is incredibly useful though. When all your lights and sensors are available for programming you can do stuff that’s cool not because it is particularly innovative but because it is incredibly easy to implement: - my partner can control a “do not enter, call in progress” red light bulb; - my outside lights trigger off PIR, door sensors, or Ring motion detection; - I have a series of indoor lamps come on in succession if motion is detected outside at night; - we programmed a push button to turn a light green on one tap and red on a double tap for a fun game of twenty questions; - and my indoor Ring cameras shut down unless both my partner and I are out of the house. All of these things were trivial to do given that everything is available on one Home Assistant instance!

WhyNotHugo 1y ago
> Can anyone here confirm that Matter/Thread will be a bright, open, and happy new future? Sorry, it’s a closed ecosystem. It relies on PKI and device attestation to ensure that only devices from approved partners are usable. It’s unlikely that small players can participate, and zero chance of any homebrew scene.
- madwolf 1y ago
  What? You can buy a very cheap ESP32 with Thread and easily build your own device with Matter/Thread and it will work. Doesn't seem that closed. There is OpenThread that is an open source implementation of Thread. Home Assistant is compatible with Matter over Thread devices... What's closed about this?
  - Asmod4n 1y ago
    You can’t talk to other devices unless you got the private key of them.
    - meepmorp 1y ago
      > You can’t talk to other devices unless you got the private key of them can you explain what you mean by this?
      - Asmod4n 1y ago
        Buy a device from the manufacturer “Eve” try to add it to homeassistant after upgrading its firmware to use matter/thread: no can do, they don’t give you their key to talk to their devices.
        fnwbr 1y ago
        I did exactly this. Got an Eve smart plug meter and it works flawlessly in HomeAssistant. I'm also pretty sure I had upgraded to the latest firmware via Apple Home app before doing so.
        Asmod4n 1y ago
        They work without issues Ine HomeKit mode. With thread/matter only Apple got the keys or whoever paid them to get them. Also: the Apple home app can’t change their mode to matter, you have to do that in home assistant.
        Asmod4n 1y ago
        Great, their new devices actually work in thread mode with HA, but their older ones only when you got an Apple hub device. I’ve got 6-7 of their devices before matter was a thing and 0 work with HA. Even those that got firmware updates.
    - mmastrac 1y ago
- 0x000xca0xfe 1y ago
  And manufacturers tend to lock down their Matter devices, too, so you can't flash Tasmota or ESPHome on them. See: Shelly, Sonoff.
  - 3nwf248 1y ago
    Not just tend to, have to. Matter certification requires flash encryption and FW signing.
    - 0x000xca0xfe 1y ago
      Are these requirements public? I was working on a Matter device but it never got certified due to high cost/lack of customer demand.
      - Chihuahua0633 1y ago
        Matter specifies that all firmware images must be signed so the device can verify authenticity before installation, ensuring they haven’t been tampered with. Matter further requires mechanisms to prevent unauthorized firmware execution and ensure that firmware can't be downgraded. Matter states that firmware images “may be encrypted.” This is not a requirement, though encryption is allowed and may add security (https://community.arm.com/arm-community-blogs/b/internet-of-things-blog/posts/achieving-secure-device-updates-on-matter https://community.arm.com/arm-community-blogs/b/internet-of-...)
        0x000xca0xfe 1y ago
        This sounds like it only affects OTA updates going through the Matter stack, not an explicit requirement to block serial flashing. Disclaimer: I haven't tried serial flashing of Shelly/Sonoff Matter-enabled devices myself, just remember some complaints of customers that failed to re-flash such devices.
    - jekwoooooe 1y ago
      You say that as if that’s a bad thing. I would love to have more iot security
- bri3d 1y ago
  I disagree that there’s zero chance for a homebrew scheme; it’s pretty easy to enable development mode and commission self-made devices using Google Home or Apple Home on both iOS and Android.
  - lukeschlather 1y ago
    Dev mode seems like such a nonstarter. I don't know what dev mode entails, but I don't want to be running my kitchen light in dev mode, I'll just use an analog switch.
    - bri3d 1y ago
      > Dev mode seems like such a nonstarter. I don't know what dev mode entails, ... what? All it means is that the "commissioner" (broker which attaches Matter devices to your Fabric) ignores the chaining of the device attestation to an approved CA. In the case of using Google's Commissioner, this requires adding a Vendor and Product ID in your account's Developer console. In the case of Apple's Commissioner, it's just pressing a "Trust this unknown device" button. That's it.
      - lukeschlather 1y ago
        I can't conceptualize exactly what the use case is here, but I get the impression there's a set of steps that have to be done in sequence after installing my light bulb, and that's another step to an already fairly involved process. All to screw in a light bulb. And the light bulb is the easy case. If it's actually two devices and I want them to talk to each other, and one of them is automatically trusted, and the other one is untrusted, I'm skeptical that just pushing the button is going to help. (Actually in general I'm skeptical that it will typically work without extensive research, and this is just one in a long list of potential gotchas.)
- ValentineC 1y ago
  > It’s unlikely that small players can participate, and zero chance of any homebrew scene. I personally think the worst part of this is that China manufacturers are less likely to produce Matter/Thread equipment. Cheap China equipment has been great for Zigbee adoption. They're much less reliable, but fantastic for getting a smart home going for cheap.
  - petre 1y ago
    I wouldn't worry too much. Espresiff is going to flood the market with countless units of this chip available for cheap. It can do Zigbee/Thread/BLE. https://www.espressif.com/en/products/socs/esp32-h2 https://www.espressif.com/en/products/socs/esp32-h2
- magicalhippo 1y ago
  Z-wave requires certification[1] which includes alliance membership and compliance testing, and there you can do your own stuff using shields or modules[2]. Some manufacturers also make Z-wave devices, like this[3], which has some generic low-voltage inputs and outputs. So while not as trivial as other things, it's possible to do a lot of DIY stuff. [1]: https://z-wavealliance.org/development-process-overview-2/ https://z-wavealliance.org/development-process-overview-2/ [2]: https://z-uno.z-wave.me/module/ https://z-uno.z-wave.me/module/ [3]: https://www.fibaro.com/en/products/smart-implant/ https://www.fibaro.com/en/products/smart-implant/
alex_duf 1y ago
> It did always feel a bit awkward having Zigbee networking and IP networking competing over the same site Funny, to me that's a feature. It makes the threat of a hacked device that exfiltrate data from within your network much less likely. I avoid any wifi device because of that.
- stego-tech 1y ago
  This. The network fragmentation is the point, just like how some businesses would run IPX internally and use a proxy for web/IP traffic to protect corporate infrastructure from malicious devices or software. Not everything has to be on TCP/IP. For smart home connectivity, I’d say that’s a feature, provided said networking standard is just as open as TCP/IP.
  - Eduard 1y ago
    > just like how some businesses would run IPX internally when? In the 1990s?
    - stego-tech 1y ago
      As late as the early 2000s! I was still setting up IPX for some older DOS/Win95 games to play over the LAN as recently as 2008, and my Novell class (last one offered at my college, around 2007) cited several large local companies who were still employing that technique as a “security through obscurity” thing, though the professor was mainly just citing use cases for IPX rather than promoting new implementations of it.
- vachina 1y ago
  Yes, not to mention WiFi is so much more power hungry.
thedougd 1y ago
The thread border gateway (Apple TV, HomePod, Google Nest Speaker, etc) sends an IPv6 router advertisement to the network for the Thread IP space. Multiple border gateways can advertise the same IP space for redundancy. I have/had a segmented network, so I made sure my router accepted this route so that devices on different networks could communicate with the Thread devices. It worked, usually. However, I ran into some challenges with the reliability of communicating from my phone to various devices. I never quite got mDNS reflection 100% correct, and I strongly suspect that's my problem. If you look at an mDNS entry for a device, you'll see some advertise all their IPv6 addresses including link local (fe80::). I suspected some clients were dumb, trying the first IP they found, and giving up when it didn't work. I was working on modifying the golang mdns-reflector project to filter these entries. I had some success, but I haven't finished.
pixxel 1y ago
[dead]

WhyNotHugo 1y ago

> Can anyone here confirm that Matter/Thread will be a bright, open, and happy new future? Sorry, it’s a closed ecosystem. It relies on PKI and device attestation to ensure that only devices from approved partners are usable. It’s unlikely that small players can participate, and zero chance of any homebrew scene.

madwolf 1y ago
What? You can buy a very cheap ESP32 with Thread and easily build your own device with Matter/Thread and it will work. Doesn't seem that closed. There is OpenThread that is an open source implementation of Thread. Home Assistant is compatible with Matter over Thread devices... What's closed about this?
- Asmod4n 1y ago
  You can’t talk to other devices unless you got the private key of them.
  - meepmorp 1y ago
    > You can’t talk to other devices unless you got the private key of them can you explain what you mean by this?
    - Asmod4n 1y ago
      Buy a device from the manufacturer “Eve” try to add it to homeassistant after upgrading its firmware to use matter/thread: no can do, they don’t give you their key to talk to their devices.
      - fnwbr 1y ago
        I did exactly this. Got an Eve smart plug meter and it works flawlessly in HomeAssistant. I'm also pretty sure I had upgraded to the latest firmware via Apple Home app before doing so.
        Asmod4n 1y ago
        They work without issues Ine HomeKit mode. With thread/matter only Apple got the keys or whoever paid them to get them. Also: the Apple home app can’t change their mode to matter, you have to do that in home assistant.
        Asmod4n 1y ago
        Great, their new devices actually work in thread mode with HA, but their older ones only when you got an Apple hub device. I’ve got 6-7 of their devices before matter was a thing and 0 work with HA. Even those that got firmware updates.
  - mmastrac 1y ago
0x000xca0xfe 1y ago
And manufacturers tend to lock down their Matter devices, too, so you can't flash Tasmota or ESPHome on them. See: Shelly, Sonoff.
- 3nwf248 1y ago
  Not just tend to, have to. Matter certification requires flash encryption and FW signing.
  - 0x000xca0xfe 1y ago
    Are these requirements public? I was working on a Matter device but it never got certified due to high cost/lack of customer demand.
    - Chihuahua0633 1y ago
      Matter specifies that all firmware images must be signed so the device can verify authenticity before installation, ensuring they haven’t been tampered with. Matter further requires mechanisms to prevent unauthorized firmware execution and ensure that firmware can't be downgraded. Matter states that firmware images “may be encrypted.” This is not a requirement, though encryption is allowed and may add security (https://community.arm.com/arm-community-blogs/b/internet-of-things-blog/posts/achieving-secure-device-updates-on-matter https://community.arm.com/arm-community-blogs/b/internet-of-...)
      - 0x000xca0xfe 1y ago
        This sounds like it only affects OTA updates going through the Matter stack, not an explicit requirement to block serial flashing. Disclaimer: I haven't tried serial flashing of Shelly/Sonoff Matter-enabled devices myself, just remember some complaints of customers that failed to re-flash such devices.
  - jekwoooooe 1y ago
    You say that as if that’s a bad thing. I would love to have more iot security
bri3d 1y ago
I disagree that there’s zero chance for a homebrew scheme; it’s pretty easy to enable development mode and commission self-made devices using Google Home or Apple Home on both iOS and Android.
- lukeschlather 1y ago
  Dev mode seems like such a nonstarter. I don't know what dev mode entails, but I don't want to be running my kitchen light in dev mode, I'll just use an analog switch.
  - bri3d 1y ago
    > Dev mode seems like such a nonstarter. I don't know what dev mode entails, ... what? All it means is that the "commissioner" (broker which attaches Matter devices to your Fabric) ignores the chaining of the device attestation to an approved CA. In the case of using Google's Commissioner, this requires adding a Vendor and Product ID in your account's Developer console. In the case of Apple's Commissioner, it's just pressing a "Trust this unknown device" button. That's it.
    - lukeschlather 1y ago
      I can't conceptualize exactly what the use case is here, but I get the impression there's a set of steps that have to be done in sequence after installing my light bulb, and that's another step to an already fairly involved process. All to screw in a light bulb. And the light bulb is the easy case. If it's actually two devices and I want them to talk to each other, and one of them is automatically trusted, and the other one is untrusted, I'm skeptical that just pushing the button is going to help. (Actually in general I'm skeptical that it will typically work without extensive research, and this is just one in a long list of potential gotchas.)
ValentineC 1y ago
> It’s unlikely that small players can participate, and zero chance of any homebrew scene. I personally think the worst part of this is that China manufacturers are less likely to produce Matter/Thread equipment. Cheap China equipment has been great for Zigbee adoption. They're much less reliable, but fantastic for getting a smart home going for cheap.
- petre 1y ago
  I wouldn't worry too much. Espresiff is going to flood the market with countless units of this chip available for cheap. It can do Zigbee/Thread/BLE. https://www.espressif.com/en/products/socs/esp32-h2 https://www.espressif.com/en/products/socs/esp32-h2
magicalhippo 1y ago
Z-wave requires certification[1] which includes alliance membership and compliance testing, and there you can do your own stuff using shields or modules[2]. Some manufacturers also make Z-wave devices, like this[3], which has some generic low-voltage inputs and outputs. So while not as trivial as other things, it's possible to do a lot of DIY stuff. [1]: https://z-wavealliance.org/development-process-overview-2/ https://z-wavealliance.org/development-process-overview-2/ [2]: https://z-uno.z-wave.me/module/ https://z-uno.z-wave.me/module/ [3]: https://www.fibaro.com/en/products/smart-implant/ https://www.fibaro.com/en/products/smart-implant/

alex_duf 1y ago

> It did always feel a bit awkward having Zigbee networking and IP networking competing over the same site Funny, to me that's a feature. It makes the threat of a hacked device that exfiltrate data from within your network much less likely. I avoid any wifi device because of that.

stego-tech 1y ago
This. The network fragmentation is the point, just like how some businesses would run IPX internally and use a proxy for web/IP traffic to protect corporate infrastructure from malicious devices or software. Not everything has to be on TCP/IP. For smart home connectivity, I’d say that’s a feature, provided said networking standard is just as open as TCP/IP.
- Eduard 1y ago
  > just like how some businesses would run IPX internally when? In the 1990s?
  - stego-tech 1y ago
    As late as the early 2000s! I was still setting up IPX for some older DOS/Win95 games to play over the LAN as recently as 2008, and my Novell class (last one offered at my college, around 2007) cited several large local companies who were still employing that technique as a “security through obscurity” thing, though the professor was mainly just citing use cases for IPX rather than promoting new implementations of it.
vachina 1y ago
Yes, not to mention WiFi is so much more power hungry.

thedougd 1y ago

The thread border gateway (Apple TV, HomePod, Google Nest Speaker, etc) sends an IPv6 router advertisement to the network for the Thread IP space. Multiple border gateways can advertise the same IP space for redundancy. I have/had a segmented network, so I made sure my router accepted this route so that devices on different networks could communicate with the Thread devices. It worked, usually. However, I ran into some challenges with the reliability of communicating from my phone to various devices. I never quite got mDNS reflection 100% correct, and I strongly suspect that's my problem. If you look at an mDNS entry for a device, you'll see some advertise all their IPv6 addresses including link local (fe80::). I suspected some clients were dumb, trying the first IP they found, and giving up when it didn't work. I was working on modifying the golang mdns-reflector project to filter these entries. I had some success, but I haven't finished.

pixxel 1y ago

[dead]