Doubting anyone would do something is usually a losing proposition.
Not just copy infringement, but getting around parental filters, too. I can see a myriad of reasons someone might try to use this connection for things they dont want on their own network.
Amazon's traffic is essentially forwarded through a VPN, so there should never be any liability concerns.
On a technical level, it's not even IP forwarding but rather some heavily tunneled and encrypted protocol stack, and I doubt that it's possible to get the IP of a forwarding Sidewalk device.
Unfortunately, the article doesn't give any reasons as to why somebody might choose to opt-out of the network except for bad analogies:
> If suddenly my devices are going to start connecting to my neighbor's WiFi, or theirs to mine, it seems like you'd have to opt-in, right?
I can already connect to my neighbor's wifi, and they can connect to mine: Our ISP broadcasts a separate "public" SSID, which is routed over a separate IP address and available to all of their customers via a captive portal.
It also has its own bandwidth allotment (unlike Sidewalk, but bandwidth use there is probably very low).
This has been my dream for the internet since I first saw it: a completely decentralized communications network beholden to nobody. Sure, Amazon is controlling this mesh network, but once the concept is proven, there can be/will be others. This is a Good Thing or at least a step in the right direction.
The key is getting the behavior normalized in broad distribution. A few specially-arranged mesh networks is interesting, but not ultimately that useful. I've long expected the likes of Linksys to deliver routers with mesh network default-on (and sensible mitigation of over-using someone's paid ISP), with much better odds of market saturation reaching the critical mass necessary for broad use.
Cuba has had an almost-mesh internet using blue tooth on cellphones for at least a decade. It’s pretty cool. I remember using it and being told about it when I traveled there in ~2013 but I can’t for the life of me remember what it’s called so I’ve never been able to read more about how it came about. IIRC before the bluetooth they passed around USB thumb drives so I think it was born from that “network” of information sharing but my Spanish skills are pretty terrible and it was many years ago so I could be completely wrong.
That's like saying prime is great because it means fast shipping for everyone, as if Amazon will share access or some less wealthy entity can easily replicate. Maybe you haven't noticed this trend, but new internet technology comes pre-mono/duopolized thanks to the existence of big tech cos, or at least quickly gets absorbed by them. The trend is strongly away from end user control of tech, and that will continue not for the oft claimed reasons of safety or user experience, but specifically for social control.
From the screenshots in the article, it looks like this is "all-or-nothing". Does this mean that folks who don't want their network talking to the neighbors' can't have a mesh network running at all or is there a separate toggle to "only enable mesh networking for my devices"?
Absolutely. There is no way he is not pushing the agenda of the CIA. I'm not surprised at all since large corps and the CIA worked together so well in south america
You're thinking of a communist society. America is capitalist; the latter is market-driven, and the citizens pay for their own microphones to spy on them.
Apple effectively did the same thing with AirTags and turning everyone’s iOS device into a listening post for the Find My network, but there’s no uproar there.
I am trusting more the apple than the amazon. Former is having privacy as key of brand image, so not in interest for to violate privatcy. I am also still not use the apple track tag but am understanding why there exist more trust for these.
WTF is with this Borat-level parody of "bad English"? That's not how people actually sound when English is their second language, and you didn't sound like that two months ago. What's with the act?
(Sorry, mods, for the unrelated thread. It's just so weird.)
Wow that is really interesting. This person was writing regular, fluent sounding English sentences and then around 73 days ago they switched over to writing like this. I agree, it's very strange.
I think this comes down to an amount of perceived bad faith. Amazon’s goal, like Facebook and Google, is to collect as much as it can about everyone to sell more things. That makes anything like this feel nefarious.
Apple of course wants to sell you all the things, but they put privacy first, at least publicly, and don’t collect this information in order to do so.
How much is perception vs. reality? Not sure. But it doesn’t really matter.
You say that like it’s a bad thing (and if their business interests change, it will be) but I trust a corporation to follow its business interests much more than I trust one to act ideologically and to its own detriment. So for now, at least, that makes Apple’s privacy claims more credible.
My understanding is that it is on by default if you use it. If you haven’t enabled Find My $device it is _not_ turned on by default.
Of course that isn’t much of a distinction since the vast majority of iPhone users will
have Find My Phone turned on and I believe are encouraged to turn Find My Phone on during device setup.
I stand corrected. Just turned off “Find My iPad” and the switch for “Find My network” disappears. So I guess it’s “opt-out of this if you’ve opted in to that”? Regardless you are right, thanks.
This is my understanding too, it isn't immediately clear so I understand the confusion but if you do not onboard your device into the network on setup, you won't be pinging other devices (like AirTags) via ULB Bluetooth
Anyone know if it is possible to use airtags without an iPhone? I am interested in getting general location information of a tag, say within a few hundred meters.
I’ve researched this for probably the same reason. The simple answer is „no“. As far as I know you can locate an AirTag through the Find My-App on a Mac, but you can’t add one to your account.
Retrieval of the data from Apple requires an iCloud account and the keys required to decrypt it is stored in the key storage of your iDevices.
By my knowledge it seems to be theoretically possible to use the network with no iDevice and a bunch of faking, but I think it hasn’t been done so far.
There's a very real difference in that Apple's Find My is using Bluetooth LE and pinging a location/identifier string back to iCloud. Sidewalk literally takes over a slice of your Wifi and shares it with devices that aren't even in your home. Your neighbor's Ring cam could be permanently on your WiFi connection without your knowledge or consent. They should at least ask.
*Amazon Ring. If they don't have to ask to make the mesh in the first place, why will they ask for, use by themselves, permission to use their mesh to further entrench their business and cut out other competitors.
Your smart speaker connects to your wifi AP and acts as a node in the Sidewalk mesh network. Your neighbour's Ring device connects to your speaker through Sidewalk and uses it as an exit point. The good thing is that 900 MHz narrowband has a 400 ms on air time limitation.
I don't think SideWalk is for high bandwidth audio/video communication. It uses LoRa for communication, which tops out at 27 kbps, and usually no where near that.
I'm expecting both systems transmit well under 50 MB/month. They use fundamentally alike premises. Find My also literally takes over a slice of your wifi & share info on gobs of devices it sees. That there is less user interaction with Find My does not make me- like it seems to make you- feel much better about the situation. But it also ought be a relatively negligible amount of throughput
Alas, as usual, these cloud-run devices seem to offer no visibility, no way to see or understand what devices we "own" are doing, gives us no grasp on how they are behaving.
In that sense, Find My takes "a slice of your Wifi" (or even mobile data) as well.
There isn't a qualitative difference between the two in my view (there might be a quantitative one – Sidewalk's data cap is 80 kbit/s or 500 MB per month; Apple isn't publishing this data, but I'd expect it to be lower, although not limited to wi-fi and also using battery power).
The maximum bandwidth of a Sidewalk Bridge to the Sidewalk server is 80Kbps, which is about 1/40th of the bandwidth used to stream a typical high definition video. Today, when you share your Bridge’s connection with Sidewalk, total monthly data used by Sidewalk, per account, is capped at 500MB, which is equivalent to streaming about 10 minutes of high definition video
Apple's marketing, which constantly gets shit on by tech professionals, does work. Those guys need a raise. Apple, Google & Amazon are equally invasive, all track usage in apps and websites on their devices, but Apple gets a free pass.
It honestly just strikes me as one gets way more favorable press coverage and everyone is swayed.
It's because Google and Facebook do much worse things, and Apple is shouting: "We don't do these (specific) terrible things!"
This is really an excellent marketing strategy. Ask anyone and they'll tell you that Facebook is trying to sell your data and Apple is a privacy-focused company.
- As far as I can tell, Apple still has extensive analytics about App Store usage, iOS usage. Google does too, but they aren't pretending Android is private, just private from anybody not called Google.
- That data is considered "first party" so Apple gets a massive exception when it comes to running targeted advertisements. iAd 2 could be just round the corner, and after crippling AdMob and FB it's highly likely it will be more profitable this time.
- Anything in iCloud (files, photos, text messages, browsing history) is accessible to law enforcement. Apple China keeps their encryption keys on the mainland.
Apple makes the bulk of their money from devices, Google from selling your data. I don't see how you can't see the difference. Sure, Apple is not pure, but their ad revenue is like 1 billion dollars (out of 272), compared to 80% out of 196 for Google.
They’re not the same, but I’m more curious how you managed to miss the pages of outraged comments here on every thread pertaining to AirTags (for extra fun you can also check the outrage in the thread where Apple announced they were giving higher quality music to subscribers for free).
Shit, this is a thread about Amazon and Apple are still getting flack somehow.
> That's because Amazon has enabled Sidewalk on every capable device by default. Whether or not you want your device connecting to other devices, or want your neighbors connecting to your WiFi, Amazon went ahead and made Sidewalk opt-out.
Privacy concerns aside, how is this legal in a world where data caps and limited bandwidth exist?
To paraphrase an old saying - "Amazon is too big to do illegal stuff". They, and other megacorps, have transcended most of the plebeian laws and are slowly getting close to a full independence.
The article describes the reason why this is opt-out as such:
> To be fair, there's a good reason it did. A mesh network of devices requires, well, a mesh. That means Amazon needs as many devices as possible to have the feature turned on. If it required you to enable it on your own, Amazon knows that almost no one would.
So Amazon's business reasons are "good reasons", but my privacy/bandwidth/etc. reasons are secondary at best. This sums up the relationship between companies and their customers in the modern tech industry: You take what we'll give you, and you'll like it. At some point we're going to have to come up with a concept like "informed consent" for these things.
I wonder what would be a good solution here, if you really wanted to offer something of value (without treating your users as a product), that depended on the users opting in? Most people won't opt in, out of convenience, it's pretty much a fact of life. You could incentivize them - say, pay them for being a part of the network and performing a service for others. But a dishonest vendor could just make the purchase price higher by the amount they expect to pay out to the user over service's lifetime.
The inherent flexibility/relativity of prices seems to be making it too easy for businesses to scam the customers in general. "Ad subsidizing", "razor-and-blades" model, fake paybacks... is there even a way to ensure that a business that pays you something with one hand, doesn't try to take it back with the other one?
To get what we want out of businesses, we'd need an intelligence behind the buying power. Supply side holds all the cards for steering consumer tech, because buyers aren't generally informed and coordinated enough to flex their collective control, unlike on supply side where everything is super consolidated. We've got no "buyers unions", the big brands are basically unavoidable to average consumers, so big brands do what they want.
> I wonder what would be a good solution here, if you really wanted to offer something of value (without treating your users as a product), that depended on the users opting in?
Certainly asking for permission and paying for it if permission granted, for a start.
Imagine in the physical world if some company decided they need water for their own benefit, so they'll take it by filling buckets from everyones front lawn hoses. That is unambiguously called theft.
There shouldn't be any gray area in the electronic world where theft of bandwidth by amazon could be considered anything other than what it is.
I would be fine with it if they offered to pay up. Say, popup a message in the next update of the Alexa app asking me: "do you want to allow our device to participate in this mesh network? It will use a little bit of your internet but you'll get 1 dollar credit in Amazon purchases each month." Hell, even make it 2 dollars of digital content. At least give me the choice.
There is competition: Helium seems to be doing a very similar thing (although "on the blockchain" and with its own cryptocurrency to go with it, which I have not looked at in detail and can't vouch for in any way).
For a more limited use case (for now), Apple is a competitor too with their "find my..." network as well.
I'm hoping for an open alternative to show up as well.
Not sure whether there are any rules on linking/promoting crypto projects here, and please don't consider this an endorsement in any way, but you'll be able to find it when searching for "helium hotspot".
A nice middle ground would have been to make participation a condition for using your own client devices with the network, i.e. you can only register a Tile if you agree to participating in Sidewalk with your linked Amazon account.
That would make adoption much harder, though – a lot more people have just an Echo device than an Echo device and a Tile.
> This sums up the relationship between companies and their customers
I'm constantly surprised people let this stuff into their house. IMO modern tech companies are the best argument that a "software market" will never make sense because users not only seem incapable of shopping for software but will often choose the worst option.
There is a simple solution to this botnet and others. Don't buy these devices, any convenience is out weighed by privacy concerns. Resist becoming a NPC.
Behold as I trade one shallow insult ("NPC") for another with even less depth ("incel")!
Oddly, people most likely to use the "incel" insult are somehow against sexual objectification, despite the fact that they have reduced the entirety of someone's value as to whether or not they get laid. It's a bit of self-contradiction that rarely gets examined.
Not good enough, we need severe regulation. These companies are playing a game that’s unwinnable for consumers.
The respectable device from Brand A you own today will auto-update 2 years from now to one with privacy-invading bloatware. You can’t do anything about it because you would need the security updates which are part of the update.
If you switch to Brand B, then over time they’ll do the same thing while Brand A slowly transitions to the “respectable” company. Rinse and repeat.
I wonder if users are now liable for the CP or other illegal data being downloaded through the mesh?
I think I remember that Comcast, when they have enabled public network on private routers, have created a separate network with separate ID and that supposedly is enough to protect router owners from legal problems.
But here mesh is using the same (single) network all devices use in the household. So if someone will abuse their mesh connected device to download illegal data and traffic will pass through your main network, are you liable for it too?
so when some CP gets on the Amazon servers, they must report that to the authorities, right? by law! Now, the upload came from your device....did you do it or did someone else?
It matters very little how it's designed to work. If it can be abused, it will. Encryption can be broken, protocols can be circumvented. It's why we have physical covers for webcams, because they can and are used by malicious parties, even though it should be possible.
Turned on by default makes me think I have to locate a setting to switch off, and sounds insidious? But I recall my Echo Show prompts for choice on Sidewalk during initial setup?
I just took a look at the Sidewalk website as it pertains to Ring devices. Per the site, Sidewalk is enabled on the Ring Floodlight Cams but not the doorbells (for now at least).
Perhaps I would leave it on to help the network, same as with AirTags and iPhones. What I don't want is any of my devices to find the internet without my specific approval. That is a much more important thing for me to be able to turn off.
(i.e., I don't mind if people use a small amount of my bandwidth if there is no risk to me. I do mind my Samsung smart TV with a mic getting online without me knowing about it, because I don't trust that mic in my living room and assumed not giving it my WiFi password would keep it offline.)
The worst part is that I KNOW 100% that I opted-out of this at least 6 months ago, but to my surprise it was still enabled in the Alexa App when I double checked this AM. SMH. Do I need to take a screen shot and physically print it out and mail it to Amazon HQ? Sheesh.
I disabled it as well but when I went to check if it was still disabled, the option isn't there. Was it removed and will be added back and enabled by default again? Is this the from beta to live transition? How many people think they've disabled it only to have it re-enabled?
Mine was there just now. The Amazon Apps are awful on IOS, I often have to wait a few for a page in the app to fully load with all the options/settings.
It's awful everywhere. The Privacy screen doesn't load at all on Android for me, it flashes up for a moment then an error displays. I have to open the Web App to view it.
From a psychological standpoint, people are more likely to keep the default as is - even if the opt-out is super simple.
I assume, unfortunately, this will grant Amazon a lot of benefits.
106 comments
[ 4.9 ms ] story [ 101 ms ] threadIf such networks kills the industry of lawyers hunting copyright infringements, I have no problem with that.
Not just copy infringement, but getting around parental filters, too. I can see a myriad of reasons someone might try to use this connection for things they dont want on their own network.
On a technical level, it's not even IP forwarding but rather some heavily tunneled and encrypted protocol stack, and I doubt that it's possible to get the IP of a forwarding Sidewalk device.
This could all be very nice tech, if it wasn't for surveillance ambitions and too curious corporations.
If I were Jeff Bezos, I totally would use it.
> If suddenly my devices are going to start connecting to my neighbor's WiFi, or theirs to mine, it seems like you'd have to opt-in, right?
I can already connect to my neighbor's wifi, and they can connect to mine: Our ISP broadcasts a separate "public" SSID, which is routed over a separate IP address and available to all of their customers via a captive portal.
It also has its own bandwidth allotment (unlike Sidewalk, but bandwidth use there is probably very low).
Sidewalk is capped at 80 kbit/s transfer rate and 500 MB/month total transfers.
Is anyone else as creeped out that John Brennan is on the board?
(Sorry, mods, for the unrelated thread. It's just so weird.)
Apple of course wants to sell you all the things, but they put privacy first, at least publicly, and don’t collect this information in order to do so.
How much is perception vs. reality? Not sure. But it doesn’t really matter.
It also does much, much less than Sidewalk.
Of course that isn’t much of a distinction since the vast majority of iPhone users will have Find My Phone turned on and I believe are encouraged to turn Find My Phone on during device setup.
Retrieval of the data from Apple requires an iCloud account and the keys required to decrypt it is stored in the key storage of your iDevices.
By my knowledge it seems to be theoretically possible to use the network with no iDevice and a bunch of faking, but I think it hasn’t been done so far.
For work around the network you may be interested in OpenHaystack (custom trackers and client, https://github.com/seemoo-lab/openhaystack) and Send My (custom messages over the network utilizing OpenHaystack, https://github.com/positive-security/send-my).
I'm expecting both systems transmit well under 50 MB/month. They use fundamentally alike premises. Find My also literally takes over a slice of your wifi & share info on gobs of devices it sees. That there is less user interaction with Find My does not make me- like it seems to make you- feel much better about the situation. But it also ought be a relatively negligible amount of throughput
Alas, as usual, these cloud-run devices seem to offer no visibility, no way to see or understand what devices we "own" are doing, gives us no grasp on how they are behaving.
There isn't a qualitative difference between the two in my view (there might be a quantitative one – Sidewalk's data cap is 80 kbit/s or 500 MB per month; Apple isn't publishing this data, but I'd expect it to be lower, although not limited to wi-fi and also using battery power).
The maximum bandwidth of a Sidewalk Bridge to the Sidewalk server is 80Kbps, which is about 1/40th of the bandwidth used to stream a typical high definition video. Today, when you share your Bridge’s connection with Sidewalk, total monthly data used by Sidewalk, per account, is capped at 500MB, which is equivalent to streaming about 10 minutes of high definition video
It honestly just strikes me as one gets way more favorable press coverage and everyone is swayed.
https://en.wikipedia.org/wiki/Reality_distortion_field
This is really an excellent marketing strategy. Ask anyone and they'll tell you that Facebook is trying to sell your data and Apple is a privacy-focused company.
- As far as I can tell, Apple still has extensive analytics about App Store usage, iOS usage. Google does too, but they aren't pretending Android is private, just private from anybody not called Google.
- That data is considered "first party" so Apple gets a massive exception when it comes to running targeted advertisements. iAd 2 could be just round the corner, and after crippling AdMob and FB it's highly likely it will be more profitable this time.
- Anything in iCloud (files, photos, text messages, browsing history) is accessible to law enforcement. Apple China keeps their encryption keys on the mainland.
Shit, this is a thread about Amazon and Apple are still getting flack somehow.
Privacy concerns aside, how is this legal in a world where data caps and limited bandwidth exist?
Don't you remember reading about it in the terms and conditions?
Practical via monitoring network traffic density, and only using a small percentage of that (say, 1%).
> To be fair, there's a good reason it did. A mesh network of devices requires, well, a mesh. That means Amazon needs as many devices as possible to have the feature turned on. If it required you to enable it on your own, Amazon knows that almost no one would.
So Amazon's business reasons are "good reasons", but my privacy/bandwidth/etc. reasons are secondary at best. This sums up the relationship between companies and their customers in the modern tech industry: You take what we'll give you, and you'll like it. At some point we're going to have to come up with a concept like "informed consent" for these things.
The inherent flexibility/relativity of prices seems to be making it too easy for businesses to scam the customers in general. "Ad subsidizing", "razor-and-blades" model, fake paybacks... is there even a way to ensure that a business that pays you something with one hand, doesn't try to take it back with the other one?
Hold tighter when they try to take it back.
No there is no way to ensure that businesses don't try to maximize profits. Its the same reason you want the thing of value for lowest cost.
Certainly asking for permission and paying for it if permission granted, for a start.
Imagine in the physical world if some company decided they need water for their own benefit, so they'll take it by filling buckets from everyones front lawn hoses. That is unambiguously called theft.
There shouldn't be any gray area in the electronic world where theft of bandwidth by amazon could be considered anything other than what it is.
For a more limited use case (for now), Apple is a competitor too with their "find my..." network as well.
I'm hoping for an open alternative to show up as well.
That would make adoption much harder, though – a lot more people have just an Echo device than an Echo device and a Tile.
I'm constantly surprised people let this stuff into their house. IMO modern tech companies are the best argument that a "software market" will never make sense because users not only seem incapable of shopping for software but will often choose the worst option.
Oddly, people most likely to use the "incel" insult are somehow against sexual objectification, despite the fact that they have reduced the entirety of someone's value as to whether or not they get laid. It's a bit of self-contradiction that rarely gets examined.
The respectable device from Brand A you own today will auto-update 2 years from now to one with privacy-invading bloatware. You can’t do anything about it because you would need the security updates which are part of the update.
If you switch to Brand B, then over time they’ll do the same thing while Brand A slowly transitions to the “respectable” company. Rinse and repeat.
For those who prefer a better link: https://archive.is/lqAd2
I think I remember that Comcast, when they have enabled public network on private routers, have created a separate network with separate ID and that supposedly is enough to protect router owners from legal problems.
But here mesh is using the same (single) network all devices use in the household. So if someone will abuse their mesh connected device to download illegal data and traffic will pass through your main network, are you liable for it too?
(Counter to quite some propaganda out there.)
It matters very little how it's designed to work. If it can be abused, it will. Encryption can be broken, protocols can be circumvented. It's why we have physical covers for webcams, because they can and are used by malicious parties, even though it should be possible.
If it is not something people would turn on then perhaps it is not something they need.
This is another case of "ask for forgiveness instead of permission".
A simple hyopthesis applies to the "products and services" of the "tech" industry: If they required a fee, users few to none would pay for them.
The only way to test this hypothesis is to start charging fees.
(i.e., I don't mind if people use a small amount of my bandwidth if there is no risk to me. I do mind my Samsung smart TV with a mic getting online without me knowing about it, because I don't trust that mic in my living room and assumed not giving it my WiFi password would keep it offline.)
I live in the PNW, and avid reader of GeekWire. They wrote a piece in December of 2020 about this issue and the forced Opt In scenario with Sidewalk and Comcast for those curious: https://www.geekwire.com/2020/amazon-sidewalk-rollout-shows-...