I took a Vornado TRANSOM, a Broadlink RM4, and a Shelly Smart Plug, a Qingping Air Quality Monitor Gen 2 + claude and HASS, and now I have a fan that turns itself on when the CO2 level gets too high.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Nice! I have a similar setup. You might like the custom visualization or temperature and humidity offsets I’ve made for that air monitor. Its screen and battery cause excess heat to throw off readings and the calibration is rough from the factory, I used a cheap bluetooth govee thermo-hygrometer as reference to build a better cal curve.
I love how it has become a trend now to take some device that required a cloud subscription, reverse engineer it, then connect it to your own server you control.
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
Enjoy it while you can. You can see the AI companies have already started the process of locking us out of this, with Opus 5.5.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
> So this only works on products that was developed before ~now.
You're under the assumption that the companies producing these give a shit about security. It'll probably increase a bit but I doubt it will be by much. If they have shipped devices that leave the doors wide open for almost any intrusion, they won't invest engineering/AI time and money to make these better than before and certainly won't review the code that the model spit out beyond a quick check if the promised base functionality still works.
OpenAI and Anthropic models seem to be the most affected by these barriers, from my own experience.
Mistral, QWEN, and other models (read non-American) tend to have little to no restrictions. There were some tasks where I was actively trying to sabotage my own local network and Mistral had no issue helping. Anthropic and OpenAI refused outright or had to be "convinced" but would often hit further barricades along the way.
Opus 5.5 will absolutely refuse to touch anti-cheat systems in video games, even when the end game isn't to cheat but to work on Linux compatibility or to bypass/spoof the checks to enable gameplay.
The other problem is that the manufacturers can also use AI to improve their DRM and do red-teaming to fix "vulnerabilities" before release. Right now they're not because it actually takes some effort but eventually they'll be able to just tell their agents "make sure no unauthorized clients can connect". I expect that several years from now there will be a sizeable market for pre-2027 hackable devices.
Coway sells tons of devices with no smart/connected features. Their best-reviewed ones for home air purification are not connected. Everyone will be better served by supporting such product lines or pressuring companies to create them more than they will be by reverse engineering "connected" features no one ever needed.
Unironically a gift. On your own home network, the one most likely to MITM you is yourself. And eMudhra's fuckup allows for a nice attack on a few devices you'd otherwise have to disassemble to pwn.
Yeah, I have a couple cheap Tuya devices you can't necessarily re-assemble easily once disassembled (IoT light bulbs, outlets that are plastic welded/glued). Pretty sure they use mqtt over tls
I have a light with a controller on the cord: brightness up/down, power. I can't use a smart plug with it because it always defaults to off. Any ideas?
Cut the controller off and use the smart plug to control brightness. You might need to open it up and replace the power supply.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
Coway are some of the best, and there are many dumb models without internet access at all
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts
Sometimes manufacturers bake in the expected revenue from snooping into the price of the device. That can lead to better hardware at cheaper prices, that then you can liberate and use offline.
I used to have a small counter-top dishwasher that relied on proprietary soap cartridges. The dishwasher itself was fairly good and effective, and after hacking the cartridges to allow them to be refilled the overall price was quite acceptable!
I really can't understand why the hell these manufacturers don't just provide open source firmware. Nobody is buying a Conway purifier for the software and there are no trade secrets there.
I (with heavy LLM help) recently R.E. a golf cart motor controller which had a USB interface for programming, but only a crappy proprietary windows application, and it was super satisfying to see it hum attached to Linux.
What would be even more satisfying to see would be companies that were chill about this kind of work, instead of sending[1] legal threats[2] to people doing the work that they should be doing in the first place.
> The fan downloads its root CA cert over plain HTTP. It was always MitM-able.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
Similarly, how easy things are for more people to do. I'm certainly not advocating for pulling in a root CA over HTTP, but before LLMs could make this knowledge trivial, how many people would even think to look at that angle. It's democratizing in an interesting way.
Hardware companies by and large don't get software. They just don't understand it. Their world is sourcing parts and assembly and packaging. They look at software like any other line item in the BOM: Like a screw or gasket. You source it from the cheapest supplier, and spoon it onto the product somewhere on the assembly line. These companies simply don't care about their software, and their requirements to their supplier amount to "make something work." The quality bar is literally "customer should not return the product."
> Anyone care to guess why someone would make this choice?
My guess: At some point in the past, a firmware was developed without plans to include firmware update functionality. The team that did this was later burned when the client tried to use a new certificate that the hardcoded, unchangeable system didn't recognize.
Angry meetings occurred, developers were chastised, and someone realized they could avoid that problem by fetching an updated root CA on demand. They did it over HTTP to avoid a chicken and egg problem.
In hardware manufacturing, everything is about crossing items off the list of problems. A problem was raised, someone came up with an idea to solve that problem, and it was implemented. The practice might have spread to other products because it became institutional knowledge about how to avoid a problem that made a customer angry once.
This is from my experience in the consumer hardware industry. If you're not watching the outsourced development closely, they will take the easiest route to solve the problem in front of them and nobody will consider any other consequences.
Everyone (including the author) is as per usual focused on the wrong thing.
There is nothing wrong with downloading a certificate over HTTP. In fact, that's how PKI is designed and if you look at the AIA field of this very site you will see the certificate chain is meant to be served over HTTP.
What IS wrong is implicitly trusting an untrusted certificate. Whether it came over HTTPS or HTTP is irrelevant. But no one is talking about that.
I'm more puzzled why someone would buy a complicated IoT purifier for a drafty Bay Area house that probably has knob and tube wiring.
My most reliable air purifiers have a dumb, physical on/off switch. I bought them deliberately for that feature.
People don’t understand things and act shocked when they learn apt and Steam packages are downloaded over HTTP. You only need encryption for private information. CA public keys are not that. But you do need verifiable signatures.
I partly blame Google and Mozilla for the HTTP hysteria.
You publicly demonize something long enough and otherwise intelligent people start believing HTTPS is a magic invisibility cloak or the Good Housekeeping seal of approval for the web.
It is a tool in the toolbox and nothing more. Wearing safety goggles while making spaghetti is equally stupid.
It kind of makes sense opsec wise when you are on a network with adversaries though.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.
The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.
While that is true in principle, there are loads of examples of update protocols where staunchly using HTTP led to security issues. Since you mentioned APT, CVE-2026-109518 was discovered recently but a similarly bad issue was discovered a decade ago with CVE-2014-6273 (which caused a lot of people to switch to apt-transport-https). Being able to modify HTTP response headers being parsed by a privileged process is a much more powerful tool than you might expect.
When building update systems, while you shouldn't root your trust in PKI you should still use HTTPS to make attacks harder because even if your updates are signed there is still a lot of parsing going on before you get to the update payload. (Even better, you should use TUF to avoid reinventing insecure designs.)
3rd party SDK requires TLS and it's not easy to bypass. Development contract doesn't allow long-term support where they can push updates if/when proper CA bundle changes.
Solution: ignore security in 1st party code outside 3rd party library that tries to prevent ignoring security.
As far as I know, most of this cheap crap is basically supply chain management companies that contract a factory to manufacturer and contract a software development/IoT/chip company to write software. Everything is waterfall-style locked in with no ongoing support or funding after the production run is done. The software company doesn't care insomuch as it "works" and working to the SCM company is "powers on and functions", not "is secure". As such, there's not much accountability. If the endeavour gets bad publicity, they just close up shop and spin up a new brand.
did firmware a long time. had two PIs try to force this on me for an IoT device. i pushed back and we missed a deadline. but it uses aws iot certs correctly in a secure element. the customer knew better and thanked me later, lead to 1099 work
It is an interesting thought experiment: what things happen once the inertia cost to seeing how something works collapses to 0 for even a small number of your user base. Smart companies might give in now and open up their app even if only as a read-only repo. Dumb ones won’t even know to consider it. And the huge middle will wind up getting new UX ideas for free.
I remember when people were like LLMs write insecure code. Well, so does literally everyone apparently, Maybe that's where it learned it. I feel like that group has gotten a lot quieter lately.
> The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
I think what's interesting is that for decades one group of devs has been pushing for higher quality and security while other groups have been pushing for "good enough" or "MVP"[0]. Clearly the group that rushed won.
But in some weird way we're coming to the day of reckoning. I'm sure we'll always have missed bugs but with a lot of what we're seeing it more seems like these were avoidable problems. Code issues I can easily imagine at least one person on the team said "this isn't acceptable, we need to correct it" and them getting overruled. I'm sure each and every one of you has seen, if not experienced, this.
It'll be interesting to see if that continues. I suspect companies will still rush but from my experience even the best models happily produce shoddy code. And there's a feedback loop, the model's performance is influenced by the code's quality. So it's easy to degrade and get into a bad feedback loop. But I think people still value speed over quality, even in this world where Microsoft shit the bed
[0] in quotes because the entire conversation is essentially about what is actually good enough and what actually is the minimum viable product.
I don't think it's fair to say that those who didn't push for more security pushed against it or just for good enough. They didn't care enough to push back, sure, they were coerced - maybe, they did wrong - probably. But there is a good enough in security too. If you want near-perfect security, keep if off the web.
Don't get me wrong, I wish all products had minimal care for good practices, but I won't expect it the random Chinese made product.
The disagreements usually arise from what exactly is considered "good enough". Your air purifier probably doesn't need quantum-proof cryptography and end-to-end encryption in case the transport layer security is compromised (e.g. emudhra).
The problem is that people will frequently argue that approaches like the one in the article (fetching root certs in an insecure manner) are "good enough" because they don't understand that the whole dance is worthless and connections might as well be unencrypted - at least that's honest.
This is has been the case since I started developing software in the 90's. As far as I, and likely many others, are concerned it might as well be a Software Aphorism.
I think it will be very interesting as we continue to reverse engineer such things to find out just how poorly "glued together" the Paper Tigers really are....
I have experienced that quite a few people who are otherwise decent (if not amazing) engineers just have huge blindspots in their knowledge sometimes.
I am sure I am one of them. Known unknowns, and unknown unknowns etc.
You might be shit hot at low-level kernel programming but know nothing about networking for example. Or amazing distributed system design and architecture but missing fundamentals about POSIX process handling etc. And so on and so on. I've seen this even in BigCos where hiring bar is high and they try to recruit "generalists". Not everyone can know everything.
I have 2 Coway air purifiers, they have no cloud stuff. They work really well.
While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
>> Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
It’s just a remote control. Why did the tv started coming with a remote control. It’s convenient.
Setting up almost never takes more than a few seconds for me. I have Apple home, it’s almost always scan a QR code, wait a few seconds for wifi and done.
The article explains why: the author’s wife cranks it up for white noise while they sleep, and the author wanted to tie that into their existing “go to sleep” home automation.
What I like about IoT is the idea of hacking them :-). Of course I don't want connected devices running proprietary firmwares anywhere near my LAN.
Also one thing is that when a company sells an IoT device, maybe they mass produce it and it's cheap. Whereas if you wanted to build it yourself, it would be harder. Getting relatively good and cheap hardware and putting your own software on it is nice!
Not sure about air purifier, but I have a Midea dehumidifier and it publishes runtime and setpoint info I pull into Home Assistant along with power draw from a smart plug. I can see how often it's running at different times of the year and how much it costs. Ended up saving some money tweaking it from 50 to 55 after seeing runtime and A/B testing both.
Also auto on/off. If you put Home Assistant app on your phone, you can wire up automations that turn things on and off depending on whether or not you're home. Could also have Home Assistant pull in air quality/pollution info for auto on/off. High pollen count today? Keep it running so I sleep well. Low pollen count? Turn it off.
Maintenance is minimal. I set the dehumidifer up 2 years ago and haven't touched it since or had a single issue. Main thing is a) get it working, b) get it isolated from internet, c) never touch or patch it.
Once the data is in Home Assistant, I can also look for correlation with wearable health info. Does purifier running improve sleep? Does changing thermostat set point improve sleep?
I wanted to do the same with Phillips air purifier that uses AWS IoT. Unfortunately, it seems the engineers did their job: an eMudhra-signed certificate was not accepted and the AWS endpoint also uses mTLS, so I wasn't able to MITM the connection.
Their ESP also uses Secure Boot... I don't know that there isn't a way to break in, but I wasn't able to find one short of hardware notification :/
Jeez. I've had a Coway for about eight years, such a good device that my whole perception was “good product == good company”. If I had known their IOT offering was such a POS I would think very differently.
That said, the non-wifi model works perfectly with a simple HomeKit compatible on/off plug, so all this work — despite being very, very cool — seems a little pointless?
It is great to see another cloud mandatory device set free. I noticed lately several such entries in HN and personally it is a good trend.
I am wondering how the big corporate will respond sooner or later. Because it is clear and they know that as well with the every rising capability of LLM more people will find ways to liberate their hardware from such unnecessary dependency and accept less the money drain.
All that to control one of 3 fan speeds. An extra slap in the face when it seems the motor used (at least in a similar model) appears to be continuously variable.
Don't go hepa because it slows down the filtering too much. I use this technique in my house and it cuts down on pollen, smoke and mold. You'll feel a lot better than a tiny expensive hepa that has proprietary filters.
I’m not dedicating 1600 cubic inches of my living space to an ugly homemade piece of furniture that I have to rebuild whenever I change a HEPA filter. I suspect I am not alone in this.
True, but the MacGyver looking thing in the middle (or side,whatever) of your living room doesn't sit right with everyone. People pay money for aesthetics and take the hit on efficiency.
I'm seeing some 3d printed projects popping up that look to be filling this gap though.
I'm guessing there are a lot of single folks on this site and would wonder the opposite... if you've never been married you think of things WAY different.
All you need for aesthetics is to put the whole thing in any nice-looking piece of box-shaped furniture with some kind of breathable, obscuring fabric, grille, or louvre on two sides (or even just one side, if you're okay with an open back).
Find a free-standing cabinet at the thrift store or something. Will look way nicer than any minimalist-modern plastic thing from Temu (or anything 3D printed, not that I have anything against 3D printers in general).
In my bachelor days I put an air filter behind a box fan; women have higher aesthetic standards. mirv 8 works fine for me and I can pick them up grocery shopping, but my primary contaminant is a sheprador.
That rules! Looks like you can do it with like 3 filters so it's more triangle shaped which makes sense. That's so stupidly simple too. Also aesthetically pretty cool - would look great in a workshop where it's like function first/don't hide the mechanism. And I feel like there's gotta be clever ways to incorporate something as simple as "box fan but the box is made of air filter" into like a coffee table or stand or something else clever? Probably you'd want to hide the filters inside if they look grimy before you actually need to replace them so you don't feel obligated to waste money by replacing too soon but sounds like a fun time to figure out how to integrate that in a hidden way into whatever's your vibe without looking jank
For me, it just doesn’t remove the particulates fast enough when they’re quite dense outside or the house is porous.
Better sealed homes might have better luck - it should work ok - but the best way to breathe filtered air quickly is to stick your head right above a filter.
Typical flow rates for HVAC systems are ~1 air change per hour, but to effectively filter the air faster than the dirty air is leaking in, you need about 5 air changes per hour (AHAM recommendations).
If using your HVAC, run the fan continuously, and ideally use the 1" 3M 1900 filter. Other brands or models (including the supposedly 'better' 4" 3M 1900 filters) have fewer pleats, which calculates to smaller surface area and worse airflow resistance. Check BJs website, usually $10/filter in a 4-pack.
Typically these need replacement every 3 months. Pretty much the only way to really mess this up is to completely forget to replace the filters (easier than it sounds), so I try to set redundant phone alerts with different family members.
We've been doing the $9 Amazon Basics fan with a good filter since wildfire smoke started really getting bad in the bay area, quite a few years ago now. We had a couple of big, expensive filter tower things, and they helped, but just a couple of the boxfans with filters duct taped on quickly and consistently annihilated PM2.5 and PM10 in our apartments.
Most surprising thing: all but one of those original Amazon fans is still running. They've had years of run time, at quite a bit higher stress than normal.
I never get this take. Yes, you'd make this in a pinch but that thing is hideous to have around the house.
It's like telling someone they bought a car and pointing out that golf dimples with increase your mileage. No reasonable adult would have that thing in the middle of their living room!
Filtering out the fines and ultrafines – the stuff that HEPA filters capture – makes a biiiiiiig difference in air quality.
A smaller supplementary unit made out of PC fans and N95s can do that. A 120mm Noctua fan's flow and pressure fits well for about three 3M Aura masks in parallel.
It's unhinged how good the air quality is in a room with a device like this.
This is exactly what I have done, but with 12" fans instead. It works exceptionally well and you are not locked into any ecosystem. For aesthetics, as everyone is crying about it, maybe one can 3D print a case for it.
Has anyone managed to pull this off with the Levoit air purifiers. I've isolated mine on a seperate VLAN at home but it requires internet connection to control.
179 comments
[ 4.1 ms ] story [ 76.8 ms ] threadAnd I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Need to try to get Sonoff bridge rigged up next but have been busy messing with Hatch alarm
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
I hear this a lot but I've never hit this.
For weeks now I've been working on a shared recompilation project of Switch 1 and 2 games, and Opus 5.5 has handled that with no issue.
Over 10 supported Switch 1 games, and 3 supported Switch 2 games, and never once has Opus 5.5 denied anything
So this only works on products that was developed before ~now.
The solution is to not buy crap regardless if you can make it work or not.
You're under the assumption that the companies producing these give a shit about security. It'll probably increase a bit but I doubt it will be by much. If they have shipped devices that leave the doors wide open for almost any intrusion, they won't invest engineering/AI time and money to make these better than before and certainly won't review the code that the model spit out beyond a quick check if the promised base functionality still works.
The Home Assistant hackers are some of the most persistent reverse engineers that I have seen. Almost as much as game crackers and cheat developers.
Mistral, QWEN, and other models (read non-American) tend to have little to no restrictions. There were some tasks where I was actively trying to sabotage my own local network and Mistral had no issue helping. Anthropic and OpenAI refused outright or had to be "convinced" but would often hit further barricades along the way.
Opus 5.5 will absolutely refuse to touch anti-cheat systems in video games, even when the end game isn't to cheat but to work on Linux compatibility or to bypass/spoof the checks to enable gameplay.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
The relay clicking is a feature so you can tell the brightness audibly :)
I am tired of having dust everywhere.
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts
I used to have a small counter-top dishwasher that relied on proprietary soap cartridges. The dishwasher itself was fairly good and effective, and after hacking the cartridges to allow them to be refilled the overall price was quite acceptable!
My god, this is straight out of a Douglas Adams book.
I (with heavy LLM help) recently R.E. a golf cart motor controller which had a USB interface for programming, but only a crappy proprietary windows application, and it was super satisfying to see it hum attached to Linux.
What would be even more satisfying to see would be companies that were chill about this kind of work, instead of sending[1] legal threats[2] to people doing the work that they should be doing in the first place.
1: https://news.ycombinator.com/item?id=50443824
2: https://news.ycombinator.com/item?id=50363968
Basically a git repo with instructions that would maybe pull in rea and set all this up.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
My guess: At some point in the past, a firmware was developed without plans to include firmware update functionality. The team that did this was later burned when the client tried to use a new certificate that the hardcoded, unchangeable system didn't recognize.
Angry meetings occurred, developers were chastised, and someone realized they could avoid that problem by fetching an updated root CA on demand. They did it over HTTP to avoid a chicken and egg problem.
In hardware manufacturing, everything is about crossing items off the list of problems. A problem was raised, someone came up with an idea to solve that problem, and it was implemented. The practice might have spread to other products because it became institutional knowledge about how to avoid a problem that made a customer angry once.
This is from my experience in the consumer hardware industry. If you're not watching the outsourced development closely, they will take the easiest route to solve the problem in front of them and nobody will consider any other consequences.
There is nothing wrong with downloading a certificate over HTTP. In fact, that's how PKI is designed and if you look at the AIA field of this very site you will see the certificate chain is meant to be served over HTTP.
What IS wrong is implicitly trusting an untrusted certificate. Whether it came over HTTPS or HTTP is irrelevant. But no one is talking about that.
I'm more puzzled why someone would buy a complicated IoT purifier for a drafty Bay Area house that probably has knob and tube wiring.
My most reliable air purifiers have a dumb, physical on/off switch. I bought them deliberately for that feature.
You publicly demonize something long enough and otherwise intelligent people start believing HTTPS is a magic invisibility cloak or the Good Housekeeping seal of approval for the web.
It is a tool in the toolbox and nothing more. Wearing safety goggles while making spaghetti is equally stupid.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.
Or they could connect to the service.
> Server validation would have prevented that
No it wouldn't have. HTTPS does not ensure a server's contents are trustworthy.
> And before you come at me with I should be using a VPN to protect against these scenarios, I do that already
So you protect yourself from unlikely, irrelevant threats by... deliberately paying strangers to MiTM your traffic?
The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.
When building update systems, while you shouldn't root your trust in PKI you should still use HTTPS to make attacks harder because even if your updates are signed there is still a lot of parsing going on before you get to the update payload. (Even better, you should use TUF to avoid reinventing insecure designs.)
Solution: ignore security in 1st party code outside 3rd party library that tries to prevent ignoring security.
As far as I know, most of this cheap crap is basically supply chain management companies that contract a factory to manufacturer and contract a software development/IoT/chip company to write software. Everything is waterfall-style locked in with no ongoing support or funding after the production run is done. The software company doesn't care insomuch as it "works" and working to the SCM company is "powers on and functions", not "is secure". As such, there's not much accountability. If the endeavour gets bad publicity, they just close up shop and spin up a new brand.
But in some weird way we're coming to the day of reckoning. I'm sure we'll always have missed bugs but with a lot of what we're seeing it more seems like these were avoidable problems. Code issues I can easily imagine at least one person on the team said "this isn't acceptable, we need to correct it" and them getting overruled. I'm sure each and every one of you has seen, if not experienced, this.
It'll be interesting to see if that continues. I suspect companies will still rush but from my experience even the best models happily produce shoddy code. And there's a feedback loop, the model's performance is influenced by the code's quality. So it's easy to degrade and get into a bad feedback loop. But I think people still value speed over quality, even in this world where Microsoft shit the bed
[0] in quotes because the entire conversation is essentially about what is actually good enough and what actually is the minimum viable product.
The disagreements usually arise from what exactly is considered "good enough". Your air purifier probably doesn't need quantum-proof cryptography and end-to-end encryption in case the transport layer security is compromised (e.g. emudhra).
The problem is that people will frequently argue that approaches like the one in the article (fetching root certs in an insecure manner) are "good enough" because they don't understand that the whole dance is worthless and connections might as well be unencrypted - at least that's honest.
This is has been the case since I started developing software in the 90's. As far as I, and likely many others, are concerned it might as well be a Software Aphorism.
I think it will be very interesting as we continue to reverse engineer such things to find out just how poorly "glued together" the Paper Tigers really are....
I am sure I am one of them. Known unknowns, and unknown unknowns etc.
You might be shit hot at low-level kernel programming but know nothing about networking for example. Or amazing distributed system design and architecture but missing fundamentals about POSIX process handling etc. And so on and so on. I've seen this even in BigCos where hiring bar is high and they try to recruit "generalists". Not everyone can know everything.
"The S in IoT stands for security" has been a joke for 20 years now.
It's always been in plain sight. There's a whole search engine dedicated to it: https://www.shodan.io/ (since 2009)
I highly recommend this talk from 14 years ago: https://youtu.be/5cWck_xcH64?is=O4zCafVz-6eXRYES
While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
Setting up almost never takes more than a few seconds for me. I have Apple home, it’s almost always scan a QR code, wait a few seconds for wifi and done.
Also it’s fun to mess with.
What I like about IoT is the idea of hacking them :-). Of course I don't want connected devices running proprietary firmwares anywhere near my LAN.
Also one thing is that when a company sells an IoT device, maybe they mass produce it and it's cheap. Whereas if you wanted to build it yourself, it would be harder. Getting relatively good and cheap hardware and putting your own software on it is nice!
Also auto on/off. If you put Home Assistant app on your phone, you can wire up automations that turn things on and off depending on whether or not you're home. Could also have Home Assistant pull in air quality/pollution info for auto on/off. High pollen count today? Keep it running so I sleep well. Low pollen count? Turn it off.
Maintenance is minimal. I set the dehumidifer up 2 years ago and haven't touched it since or had a single issue. Main thing is a) get it working, b) get it isolated from internet, c) never touch or patch it.
Once the data is in Home Assistant, I can also look for correlation with wearable health info. Does purifier running improve sleep? Does changing thermostat set point improve sleep?
Their ESP also uses Secure Boot... I don't know that there isn't a way to break in, but I wasn't able to find one short of hardware notification :/
That said, the non-wifi model works perfectly with a simple HomeKit compatible on/off plug, so all this work — despite being very, very cool — seems a little pointless?
I am wondering how the big corporate will respond sooner or later. Because it is clear and they know that as well with the every rising capability of LLM more people will find ways to liberate their hardware from such unnecessary dependency and accept less the money drain.
https://github.com/device-teardowns/coway-ap1512hh
More info Search "Corsi-Rosenthal Box" or click https://filterbuy.com/resources/air-filter-basics/how-to-bui...
Don't go hepa because it slows down the filtering too much. I use this technique in my house and it cuts down on pollen, smoke and mold. You'll feel a lot better than a tiny expensive hepa that has proprietary filters.
I'm seeing some 3d printed projects popping up that look to be filling this gap though.
It's a cool hack, it doesn't pass the wife test.
Find a free-standing cabinet at the thrift store or something. Will look way nicer than any minimalist-modern plastic thing from Temu (or anything 3D printed, not that I have anything against 3D printers in general).
Example: https://www.cleanairkits.com/products/luggable-ultra-air-pur...
If volume is a problem, I'm sure one can lower the fan speed below the lowest setting with some electronics knowledge.
Better sealed homes might have better luck - it should work ok - but the best way to breathe filtered air quickly is to stick your head right above a filter.
Typical flow rates for HVAC systems are ~1 air change per hour, but to effectively filter the air faster than the dirty air is leaking in, you need about 5 air changes per hour (AHAM recommendations).
If using your HVAC, run the fan continuously, and ideally use the 1" 3M 1900 filter. Other brands or models (including the supposedly 'better' 4" 3M 1900 filters) have fewer pleats, which calculates to smaller surface area and worse airflow resistance. Check BJs website, usually $10/filter in a 4-pack.
Typically these need replacement every 3 months. Pretty much the only way to really mess this up is to completely forget to replace the filters (easier than it sounds), so I try to set redundant phone alerts with different family members.
Most surprising thing: all but one of those original Amazon fans is still running. They've had years of run time, at quite a bit higher stress than normal.
It's like telling someone they bought a car and pointing out that golf dimples with increase your mileage. No reasonable adult would have that thing in the middle of their living room!
A smaller supplementary unit made out of PC fans and N95s can do that. A 120mm Noctua fan's flow and pressure fits well for about three 3M Aura masks in parallel.
It's unhinged how good the air quality is in a room with a device like this.
Source for saying FilterBuy is a scam (they're actually MERV 7 not MERV 13): https://www.youtube.com/watch?v=FKAVEek1YaSQ
Filtrete 1900 filters perform best in these boxes (check Chewy/Target prices too): https://www.bjs.com/product/filtrete-20-x-25-x-1-premium-all...
Also MIRV = Multiple Independently-targetable Reentry Vehicles, MERV = Minimum Efficiency Reporting Value. ;)
| only your basic assumptions that are |
\ wrong. /
--------------------------------------
It will unfortunately be a lot harder to free those devices