6 ms·
Volkswagen blocks Home Assistant by requiring client assertion
- deleted 4mo ago[deleted]
- vincnetas 4mo agoThis comment has really nice translation of corpo-speek to human language : https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967#issuecomment-4554004983 https://github.com/robinostlund/homeassistant-volkswagencarn... Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?
- HDThoreaun 4mo ago> Why are they shooting them selves in the feet? 1. They dont think anyone will stop buying their cars because of this 2. They want to make more money 3. (speculation) The drop in demand for their cars in china is leaving them fucked, they need revenue now
- close04 4mo agoUnfortunately I think they're right on #1. In the grand scheme of things the lost sales because of this change are a drop in the bucket. HA and similar tools are not that popular, very few people who have their mind set on buying a VW will change their minds because of this alone. What's worse is that other manufacturers are starting to do the same thing. They all see unofficial integrations as lost revenue (less of your data to sell because you don't use their app), and higher costs because the usage still comes on their cloud spend bill. I was talking to my gadget-passionate (but not techie) best friend when the company making our cars made it more difficult to authenticate using the HA integration. He looked at me like I switched to an alien language. "Who cares? Don't you use the app?".
- haritha-j 4mo ago> Why are they shooting them selves in the feet? Because people will still buy their cars. The average Joe has very little regard for their privacy. We've been trained to be numb. > Is this really a tangible income stream? Yep. > Is it really increasing security? Nope.
- mrweasel 4mo agoHow is this a tangible income stream? I suspect that the amount of customers willing to pay for some weird API access or We Connect offering is rather limited. It would have to be bundled into some other solution, which again I'd guess have a limited customer base. I have VW and I suppose We Connect, there's not a single thing that's worth paying for, not when you have CarPlay and Android Auto (or whatever that's called). If anything I'd prefer that they'd just drop the personalization they do with users. Our car will forever assume that my wife is driving, because that what the dealer configured and none of us care to mess around with it. But yeah, people will buy the cars anyway, because all the automation is something that only an incredibly small segment has any interest in. It's just weird that those who actually care about connected cars are the only one VW is punishing with this move.
- rootusrootus 4mo ago> I suspect that the amount of customers willing to pay for some weird API access or We Connect offering is rather limited I tend to agree. But the counterpoint is Tesla. They charge for API access, and there are several businesses that exist to make that data available to customers. I don’t know how valuable it really is, but it’s working. My wife would pay Ford for the level of data she was getting from TeslaFi but instead she gives it to MileIQ. It’s not huge but that adds up.
- mrweasel 4mo agoThat's my line of thinking with the "bundled into some other solution". It doesn't make a ton of sense for an individual to buy API access, but other companies could provide a service built in the API, and they are the ones paying VW.
- wiseowise 4mo ago> Why are they shooting them selves in the feet? They don’t. Majority of users don’t care, and some middle manager shmuck, working on MySkoda, can report how “we” prevented a huge security risk and funneled valuable ~~cattle~~ user data where it belongs.
- pydry 4mo agoMost executives make commercially disadvantageous decisions in exchange for more power. It's practically a law of business: executives prioritize their power first and their company's profit margins second. This is one reason why outsourcing coding was so popular despite not saving money and being so commercially disastrous - execs were in the driving seat with that relationship much more than they were with us. Despite what some people will tell you about how the home assistant consumer segment "doesn't matter" (it does) it really is more about the tangibility of control over data vs the intangibility of lost consumer goodwill. Companies are not profit maximizing at all costs. The shareholders and the executives are not a singular body they have different and sometimes wildly divergent interests.
- izacus 4mo agoI haven't seen anyone put this dynamic in such a clear and succinct description - the fact is that a lot of people (especially corporate managers) just hate the loss of control and will go out of their way to ban people accessing their things "wrong" - even if it's counterproductive for their larger corporation or a goal.
- ryandrake 4mo agoYea, I don't really see the revenue potential here. They seem to be doing this purely to force developers to have a "formal relationship" with them, and to grief all other developers who don't. Same mentality behind companies who insist users have an "account" to use their otherwise-unconnected products.
- ra 4mo agowow - I was looking at moving from Tesla to Skoda for our next EV. Last month it was interceptor missiles for Israel and now this.
- vincnetas 4mo agoBy the way, regarding additional profit stream, to access VW data before you still needed WeConnect subscription (100€ a year), just that before you could use another app or automation to access the data. Now you MUST use exclusively WeConnect and partners to access same data even though you paying already for subscription.
- formerly_proven 4mo agoPretty sure connect is free for like ten years.
- vincnetas 4mo agoWell, might be depending on model. I own eUp and it was free for first year.
- Roark66 4mo agoAnd that is why I'll not be buying a vw ever again despite being a fan of the brand so far.
- wolvoleo 4mo agoDieselgate should have been enough reason already IMO. And VW's response to it. Throwing some low level employees under the bus (transporter?) so that the big bosses could walk free
- pseudopolous 4mo ago[dead]
- supergeek133 4mo agoI have first hand view of traffic Home Assistant creates.. there is an upside down usage model. Infrastructure (servers, bandwidth, etc) costs money. For better or worse, most devices don't have local interfaces. Some matter devices exist in the past year or two, but not all data/functions are available via matter. Older devices likely won't ever be updated to support matter. Also lump in the fact that HA is a locally run/focused application, it isn't super compatible with a cloud based API/data delivery system without some additional development from the OEM end. Last I did the math for an internal system.. in 24 hours HA traffic was ~20% of total, for less than 1% of users. That's wild. Mostly because each instance is pinging the API directly every X or less minutes. If an executive here heard that math, they'd likely ask to block it as well. Right or wrong that's how people react.
- holoduke 4mo agoI recently saw a group of automakers together during an event. The contrast between Chinese and Germans was bizare. The group of german automakers were older men in black suits all wearing badge with titles like Senior Executive Sales blablabla. Whereas the Chinese were all young people wearing causual clothing and much more engineering minded. No wonder why european auto makers are doing so badly. They forgot to please people. The only know how to please their untergang.
- SuddsMcDuff 4mo agoThis could equally illustrate the difference between long established multi national companies with an overbearing corporate culture vs young upstart companies with a dynamic startup culture.
- calgoo 4mo agoYea is there not a saying about when the suits and bean counters take over a company the culture dies?
- chao- 4mo agoI know it as "when the Elves leave Middle Earth" from an essay of the same name: https://steveblank.com/2009/12/21/the-elves-leave-middle-earth-%E2%80%93-soda%E2%80%99s-are-no-longer-free/ https://steveblank.com/2009/12/21/the-elves-leave-middle-ear...
- joe_mamba 4mo agoThe question is why doesn't Germany have any young upstart auto companies when the US and China do? The question being the rhetorical kind.
- tormeh 4mo agoIt's not like the US has that many either. It's not the kind of winner-takes-all network effects industry that attracts venture capital outside of the Musk reality distortion field.
- pojntfx 4mo agoThere needs to be a law that makes remote attestation - no matter who provides the root certificates, Google/Apple/GrapheneOS - illegal. There is only one use for this technology right now, and it is to prevent people from doing what they want to do with the devices they own, while also making interoperability cryptographically impossible. This is anti-competitive and should simply be illegal.
- 5701652400 4mo ago[flagged]
- worthless-trash 4mo agoI wonder if companies can T&C their way out of any problem.
- 5701652400 4mo agopretty much. correct me if I am wrong, but these T&C treated like "local" laws (in respect to interaction of client and business within their interaction) within most jurisdictions by courts. so even if T&C does not make sense, usually courts are in favour of enforcing them. unless some severe contradiction with constitution or alike, or serious harm to people or something, they would throw away T&C in cases. but AFAIK that is rare.
- alerighi 4mo agoNo: T&C cannot override the law, that is a national/EU law is still superior to anything that is written in the T&C. If there is a contrast between T&C and the law of course that T&C are just scratch paper.
- UqWBcuFx6NV4r 4mo agoNobody claimed that this wasn’t the case.
- 5701652400 4mo ago[flagged]
- vladvasiliu 4mo ago> if you don't like that car/company, don't buy their product. buy competitors. that will show them much better. I'm all for voting with my wallet, but it gets exhausting trying to be a few steps ahead. And then nothing guarantees that there won't be a rug pull once you bought the car. > or petition to government to put pressure on them Right. Not sure why you have to mention it, since everybody knows this works oh so well. The problem is that all these T&Cs are just pages upon pages of legalese that not only nobody understands or even reads, but that also aren't exactly advertised before buying. "Buy our smart widget! It only works with its own app, and we'll only support it for a ridiculously short time! Please don't upgrade your phone, or it will stop working!" Of course governments should do something about it, but even here in the EU, they don't seem too bothered. Hell, even people seem generally fine with it, judging by the number of crappy widgets they buy.
- 5701652400 4mo agotrue. on both accounts.
- alerighi 4mo ago> if you don't like that car/company, don't buy their product. buy competitors. that will show them much better. (or petition to government to put pressure on them). That maybe fine, but if something is allowed at the time I've bought the car, and then the manufacturer changes their policy such that the usage that I did is no longer allowed? BTW, to me this is bullshit, first cars shouldn't be connected to the internet in the first place, in the case that they are, I would need to be in full control of what I can do with the API, not that I need to use special software to talk to my own car.
- 5701652400 4mo ago> something is allowed at the time I've bought the car, good point. yet, I bet in their T&C it was covered. it was just not enforced. and usually they have claim like "if we fail to enforce any part of agreement does not constitue waiver.". so most likely it was expected all along, they were not technically adept to actualyl enforce this. now they can. but, if your claim stands, I bet you can win case against them. > cars shouldn't be connected to the internet yep, same with you on this one.
- darkwater 4mo ago/me scratches VAG cars from a possible new EV purchase. I hate Elon as much as the next guy, but Tesla is still playing the API game way better than the rest of the pack (even with the "not so new" Tesla Fleet API change)
- connicpu 4mo agoVolvo is also doing pretty good with offering an official API
- darkwater 4mo agoBut Volvo does not have cheap models with a reasonable range, unfortunately. I'm seeing right now on their Spain's website 40k EUR for a single motor EX30 with 337km WLTP which is ridiculous
- eloycoto 4mo agoEX30 in Spain starts at 29K small battery version, and 36 the large battery version. The dealerships make a huge discounts to be honest. I was dealing with this 6 weeks ago!
- darkwater 4mo agoYeah this surprised me. 40k is for a vehicle ready to buy immediately from their website. At the same time they have an ongoing campaign for 29k for a financed EX30 + charger installation. But I hate to deal with car dealerships, they are the worse kind of salespeople out there, trying to sell you what they need to sell rather what you need to buy. You need to go there with a very, very well informed opinion about it. But then they will play the discounts card...
- kotaKat 4mo agoVolvo also has the fully mandatory requirement of a consumer Google Account to use the vehicle now due to how tightly integrated Google Automotive is.
- aenis 4mo agoGarmin recently did something similar, resorting to tls fingerprinting to prevent unofficial logins to their api (via the popular garth library). They lost a lifetime customer in me - i think i have spent close to 20k on garmin gear between my wife and myself, watches, gps devices for cars, boats, and hiking gear. If they refuse to give me access to my data, i will (a) lobby for laws to be passed to make this mandatory (b) absolutely never ever buy anything garmin until i see a reversal of this policy and an apology. More broadly though, its yet another service that blocks API access. No doubt this is caused by proliferation of amateurs armed with agentic tools building nice, personalized frontends for themselves. Companies seem to absolutely hate it when people dont go through their shitty websites with dark patterns, misleading search results and analytics.
- V1ndaar 4mo agoHuh, I completely missed that. I've been using python-garminconnect [0] for a few months without issues. I agree though that it's annoying, though not reason enough for me to switch away from Garmin yet. [0]: https://github.com/cyberjunky/python-garminconnect
- msiemens 4mo agoSame here. I've been scraping the data from my Garmin watch for years with very little problems (first with https://github.com/tcgoetz/GarminDB https://github.com/tcgoetz/GarminDB, then https://github.com/sealbro/dotnet.garmin.connect https://github.com/sealbro/dotnet.garmin.connect). The only annoyance is that Garmin requires 2FA if you enable the ECG feature on your smart watch/fitness tracker, but I have a small program that reads the 2FA codes from my Gmail inbox and supplies them to the scraper without too much trouble.
- saltcured 4mo agoHave you looked at the feasibility of making your own CIQ app to push data from the watch to your alternate internet endpoint? I have the impression there are permissions and APIs to access sensor history and activity records, but I haven't had a need to dig in and learn what restrictions there might be...
- venzaspa 4mo agoQuite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.
- ethagnawl 4mo agoRight? I imagine there would be a non-trivial sales/marketing boost for the one/first company (in any segment) to fully embrace HA. IKEA is arguably a good example of this.
- summm 4mo agoThey already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assistant" in the local press. This list circulates, and since nobody in the middle management wants to be responsible for anything, and there is no officially approved positive use case, draconian countermeasures are drafted and constructed one by one.
- ornornor 4mo ago> draconian countermeasures are drafted and constructed one by one. Except when it’s about privacy or anything else we actually care about: then absolutely nothing is done because it would cost more than 0 to do anything.
- reactordev 4mo agoOn the contrary, lots are being done about it, they have to update their terms of service…
- 4mo ago
- neya 4mo agoI mean, it was founded by the Nazi party, they single handedly destroyed diesels through the world's largest scam, what ethics can you really expect from them? I find it extremely funny when people boycott Teslas for being "Nazi" but won't boycott actual Volkswagens that was founded by the real Nazi party and to date - followed some of the most unethical practices in automative history :)
- davidwritesbugs 4mo ago“Nazis”: see Godwins law
- charcircuit 4mo agoJust because the Nsdap party created something that doesn't mean you can automatically treat it is bad. That is prejudice. Something bad happening decades and decades after the party's dissolution is not going to be directly related. It is a reach to think unsupported third party apps breaking is related.
- Markoff 4mo agoYup, I wonder if Israelis visiting Germany avoid highways.
- neya 4mo agoWhile I agree with you in principle, I don't think this is followed equally. Tesla's are still being vandalized to date, though. Selective outrage is a dangerous thing.
- Hikikomori 4mo agoMusk is still a nazi, just stopped heiling publicly for now.
- stonogo 4mo agoMore or less dangerous than non-selective outrage?
- 4mo ago
- londons_explore 4mo agoSeems doubtful that this security will be very strong. It won't be hard to spoof an official client.
- brabel 4mo agoIf they’ve done it using Secure Enclave it’s essentially physically impossible to spoof.
- dullcrisp 4mo agoWouldn’t any Volkswagen keys need to cross the network to get into the Secure Enclave? Or couldn’t you exploit the Volkswagen app itself?
- brabel 4mo agoKeys in the Secure Enclave never leave the device (or the SE for that matter) and cannot be extracted even physically.
- Retr0id 4mo agoNewer devices support Remote Key Provisioning (RKP), so you still can't export keys but you can import them. (Physical attacks are still possible, just very difficult)
- Retr0id 4mo agoThe github OP reports that browser-based login still works, so it'll likely be circumventable.
- msandford 4mo agoIf the data is going through the air or a wire it can be sniffed, right? Is every message signed or encrypted like ssl/tls, or is this just some kind of extra header(s)?
- 4mo ago
- verisimi 4mo agoWhere's the 'Open Source Car'? Where's the open source phone? The open source washing machine?
- spaqin 4mo agoWe used to have them. Devices so simple anyone with a hammer could fix. Maybe not open source as we understand it today, but rather - trivially reverse engineerable, often with schematics included. Most complex would be rewiring the motor on a washing machine. Did their job fine, but you can't sell them forever, so more complex devices were introduced. Nowadays motorcycles would probably be the closest equivalent, they're often very simple to work on.
- mcosta 4mo ago> more complex devices were introduced And people buys them because they don't care
- Finnucane 4mo agoAnd have been convinced there is no alternative. And if you suggest investing in public transit or building mixed-use neighborhoods that don't require car access they'll pop their suburbanite heads.
- consp 4mo ago> often with schematics included That was even the norm for complex electronics for decades. But since it makes it easy to reverse engineer it, it's no longer being done due to fear of cheap clones (often inferior, and still doesn't stop anyone these days).
- deleted 4mo ago[deleted]
- driverdan 4mo agoThere are freely available plans for all of those things. They are just more primitive than what you have in mind.
- baq 4mo agoWith the software supply chain running amok recently having anything connected feels like playing Russian roulette and I say this as somebody who is running home assistant for years. I’m particularly paranoid about connecting my ev (non-vw) to it now, feels like a serious footgun today, would’ve been convenient three months ago, true.
- zb3 4mo agoSad to see some people still believe raw capitalism works and that they can "vote with their wallet".. but they don't see that all car manufacturers can just agree to enshittify their products the same way and use their position to ensure you won't just "start your own car company". There's no real choice and those in power don't care. Only regulation can help.. or a revolution in case the political system in your country is broken..
- vladms 4mo agoAnti-competitive practices that you describe ("all car manufacturers can just agree") is definitely not a capitalistic thing (market competition being an important part of capitalism), and indeed regulation can improve the bad outcomes. I think revolutions are more successful when there is some new idea of what to replace the system with. Currently I did not see anything remotely interesting (ex: french revolution came with the new idea of equality before the law, which was not the case before), and I think is mostly due to low overall education - you can't improve a system if most of the people do not think about complex issues like laws, taxes, efficiency, etc. Everybody loves to point a finger at someone and blame them (immigrants, rich people, woke people, etc.) like that would "miraculously" solve any issue.
- pornel 4mo agoI don't think there's a consensus about that, as demonstrated by divided opinions on EU DMA and Apple vs Epic. The anti-regulation arguments aren't framed as "market competition is bad", but rather "the market will sort itself out without intervention" and "let companies do whatever they want to avoid killing innovation".
- chromehearts 4mo agoseems like google is playing a part in this ? https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967#issuecomment-4567861114 https://github.com/robinostlund/homeassistant-volkswagencarn...
- drtz 4mo agoYes this is Google helping vendors block access to their APIs by using hardware attestation. I recently hit the same wall trying to directly my garage door opener's API (MyQ). I'd be amazed if Google enabling this behavior doesn't violate some EU competition laws.
- spuz 4mo agoWhat does client assertion mean here? I don't see any mention in the GitHub issue.
- fhars 4mo agoIt means that the request to the API contains cryptographic proof that is was generated by a legitimate, reviewed app running on a unmodified and non-rooted mobile device controlled by Apple or Google.
- Retr0id 4mo agofwiw this is a correct definition of Remote Attestation, matching what is mentioned in the github thread, but Client Assertion is something mostly unrelated (an OAuth implementation detail)
- Retr0id 4mo agoClient Assertion is an OAuth feature, but that is not at all what is being discussed here, if anyone else was confused. It is only present in the HN title and is not mentioned on the page.
- kuizu 4mo agoWasn't the EU Data Act (https://digital-strategy.ec.europa.eu/en/policies/data-act https://digital-strategy.ec.europa.eu/en/policies/data-act) put in place to exactly prevent these kind of scenarios (Article 4 and 5)? "where the user cannot directly access the data from the connected product or related service, the data holder must make the readily available data and necessary metadata accessible to the user without undue delay, in the same quality as available to the data holder, easily, securely, free of charge, in a structured, commonly used, machine-readable format, and continuously/in real time where relevant and technically feasible." There is even special EU guidance for vehicle data for it: https://digital-strategy.ec.europa.eu/en/library/guidance-vehicle-data-accompanying-data-act https://digital-strategy.ec.europa.eu/en/library/guidance-ve...
- deleted 4mo ago[deleted]
- Confiks 4mo agoIndeed, this seems to be exactly the area where the Data Act could be used to regain access. Unfortunately it seems that it's not possible to directly sue (e.g.) Volkswagen to get access, unlike the GDPR where you have direct standing under article 79 [1]. There doesn't seem to be much written about enforcing the Data Act, so I looked at the regulation directly. Article 39 [2] seems to require to first lodge a complaint with the competent authority as designated by the member state of your residence. Then when that authority invariably fails to act – I have no idea which timeframe we're talking about here – you can "in accordance with national law, either have the right to an effective judicial remedy or access to review by an impartial body with the appropriate expertise". But then you are suing that authority, and not the company directly (edit: I was originally unsure about who to sue under article 39, but 39(3) does clarify that it is the authority). I would very much like to be wrong about this. I can imagine Muñoz vs. Superior Fruiticola applies [3] ("it must be possible to enforce that obligation by means of civil proceedings"), but I'm not at all sure, and it's a much weaker route than the one which the GDPR explicitly describes. Would anyone know or have better references on how to enforce the Data Act, preferably individually? [1] https://gdpr-info.eu/art-79-gdpr/ https://gdpr-info.eu/art-79-gdpr/ [2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202302854#art_39 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:... [3] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:62000CJ0253 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
- NiekvdMaas 4mo agoBYD DMCAd my whole repo to connect to their cars... https://github.com/github/dmca/blob/master/2026/05/2026-05-22-byd-auto-app.md https://github.com/github/dmca/blob/master/2026/05/2026-05-2... It's a shame these car makers are locking down their cars (which are brought for a premium!) and going on a crusade against open source.
- RobotToaster 4mo agoYou should email Louis Rossmann, he's been helping people in similar situations.
- NoSalt 4mo agoI cannot figure out of Louis is Batman or Don Quixote, charging at the "windmills" of MAMAA: (Meta, Apple, Microsoft, Amazon, Alphabet).
- mindslight 4mo agoDo we really need to embrace these companies' attempts to distance themselves from their toxic brands? The way I see it they're still Google and Faceboot.
- jmholla 4mo agoDon Quixote feels like a bad analogy. These are real dragons. Just, more difficult to fight against.
- joxdosba 4mo agoAt least some of Louis’s dragons seem to live in a bottle, considering his very public freakout a few years ago where he accused Apple of putting secret spy chips in his laptop to spy on him through the camera. In the end there were no spy chips, obviously.
- consp 4mo agoThis sure reads like a "you did nothing illegal but will attempt to make it look illegal" kind of thing. Like putting the key to a public space under the doormat, with a sign "key here" and then complaining you cannot use that key to access the already public space.
- ivolimmen 4mo agoOk it's clear my next car will not be a Sköda (or Volkswagen)
- loloquwowndueo 4mo agoWhich brand are you thinking of, then?
- CamperBob2 4mo agoDone buying new cars in general. It was always a sucker's game, and now a new car offers little besides various unwanted features and added restrictions, all in support of misguided regulations and other peoples' business models.
- loloquwowndueo 4mo agoUsed cars also have brands! Which one would you be thinking of? Just curious!
- CamperBob2 4mo agoThat's a matter of taste, really. Good-quality brands with historically-good parts support are what I stick with. If you like traditional coupes/sedans, Toyota or Lexus are probably good bets. I just read about a guy who is making a career out of restoring and reselling a specific Lexus model, which I thought was pretty cool: https://www.roadandtrack.com/news/a71435133/wisconsin-dealer-jdm-tanin-found-a-niche-business-selling-the-2004-2006-lexus-ls-430/ https://www.roadandtrack.com/news/a71435133/wisconsin-dealer... That kind of effort is going to become more common over the next few years, IMO. If you like sports cars, Porsche peaked in the early-to-mid 2010s in terms of both quality and features. If you like SUVs, I would think Japanese legacy brands would still be a good way to go. The last car on earth will probably be somebody's Toyota pickup or Land Cruiser from c. 2010.
- loloquwowndueo 4mo ago
- dest 4mo agoDIY alternative with https://www.openvehicles.com/ https://www.openvehicles.com/
- deleted 4mo ago[deleted]
- nunez 4mo agoI've been doing smart home stuff for a long time. This is one of the reasons why I got off of Home Assistant. It's a very cool and functional project but it is entirely dependent on companies keeping their APIs open, or, more commonly, companies not patching teh magic that makes reverse-engineered APIs possible. Unfortunately, developments over the years have NOT gone in their favor. Tesla, Ring, MyQ, Ecobee and probably others have closed their APIs over the years. They've usually cited "security concerns" as the motivating factor for the API closures, which has some legitimacy, but IMO it's usually driven by fear of losing subscription revenue. (Tesla charges a lot for official OAuth apps, though, to be fair, earlier hacks relied on a leaked OAuth app that they never got around to patching. Ecobee locked HomeKit and some other stuff behind their Security+ Subscription, which is a joke considering how anemic their security platform is. MyQ definitely did it to protect their $45/year subscription; jokes on them since RATGDO is infinitely better. Ring still works for some reason, but HomeKit Secure Video support is extremely dicey in part due to the fear of them turning their API off as well.) For someone like me who primarily used HA for HomeKit integration, depending on it is a ticking timebob. When we moved into our new house, I focused on finding stuff that was natively compatible with HomeKit without workarounds. Our smart home works much better now because of it.
- ramses0 4mo agoThat's a frying pan => fire situation. I started my home automation journey in the same way, and being HK-centric is pretty decent. HA with 100% local-control devices that _bridges_ to HK is what I'm looking at next. Often, the HK-only devices are terrible wrt WiFi stability, and I need to pay more attention to how matter/thread is working lately. I know some people complain about zigbee/zwave but they've been way better on average than HK over wifi.
- MostlyStable 4mo agoThis seems like less of a reason to get off of Homeassistant and more a reason to stop buying closed source/cloud only products to connect to HomeAssistant.
- nunez 4mo ago
- NoSalt 4mo agoThis entire thing is simply ridiculous, and infuriating! Just sell me a car, or TV, or washing machine, etc. Don't sell me a multi-layered safe with different combinations for each level.
- fcpk 4mo agoAnd this is why there should be very very unpleasant for manufacturer legislation about allowing access to hardware you buy. This is a generic problem not limited to automotive industry, though they are a major offender. Locked down android auto, systems, buses, everything is proprietary and you are the whims of the manufacturers decisions