Unbricking a $2k bike with a $10 Raspberry Pi

https://ptx2.net/posts/unbricking-a-bike-with-a-raspberry-pi/

by ptx2 • 6 years ago

967 228 6 years ago

mikece• 6 years ago

Awesome project. I wish more smart devices offered a “run it locally on a Pi if you’re paranoid or a control freak.” I avoid IoT devices in general because I have no idea where the data is being stored, if it’s stored securely, or if it’s being sold. I prefer to manage this all myself.

foxrob92• 6 years ago

I wish more smart devices offered a “run it locally on a Pi if you’re paranoid or a control freak.”

Wouldn't that defeat the purpose of the "smart device" (from the manufacturer's point of view)? The business model often seems to be locking you in to a subscription (rent seeking) or selling your personal information (surveillance capitalism).

Johnny5553• 6 years ago

This is the reason I bought a Keiser bike instead of a Peloton, it has a simple display that works with Bluetooth sensors (I use my watch to record my sessions). I use the Peloton app in an iPad (I could pair the bike with the iPad app, but don't).

The bikes are about the same price, but the Keiser screen is a simple LCD display that's much cheaper to replace if it gets broken and is fully usuable without a subscription.

Plus, I think the bike looks better.

https://www.keiser.com

troydavis2• 6 years ago

I did the same and my Keiser M3i has been fantastic. Their GitHub repos are current and their lead developer actually answers implementation questions: https://github.com/KeiserCorp

When I'm considering buying a smart device that I'd be uncomfortable throwing away if/when the company ceases support, I ask them beforehand: Is there an open API and/or SDK? Does code or protocol escrow exist? This saved me from buying a smart watch and a smart ring. The manufacturers seemed healthy at the time but were bankrupt or acqui-hired and shut down within a year.

mttjj2• 6 years ago

Hmmm. Both of you are getting me very close to pulling the trigger on the M3i. Just so I’m clear, you have to buy the “M Series Converter” bluetooth device as well so it can connect to 3rd party apps, correct? Or I could just record an Indoor Cycling workout manually on my Apple Watch, right?

emb-fit3• 6 years ago

Mentioned some of this in another comment:

"It's a $2k training bike. You could spend $1k and get a really nice brand new road bike and a smart trainer that controls resistance like a Wahoo Kickr Snap (or several others) for ~$500."

That being said the M3i seems to be one of the more flexible options if you are gonna go the stationary bike route.

Johnny5553• 6 years ago

I had to get the converter to sync with my (Garmin) watch, so I imagine that you'll need it to pair with apps. It wasn't really clear whether I'd need the converter or not, but turns out that I did -- I figured I'd return it if I didn't need it.

I haven't actually tried pairing it to my iPad or other devices.

troydavis2• 6 years ago

Someone else answered your question, but I’d add that I previously owned a Sunny SF-B1002 “dumb” belt drive spin bike for about $350 and it worked great. It’s 90% as good for much less money. I only upgraded because I use it a lot and wanted a couple M3 features (infinite frame geometry adjustment and numbered/repeatable resistance control), or I’d still use the Sunny.

TaylorAlexander• 6 years ago

Just wanted to plug repair.org who is working to protect actions like this (I have no connection to the org). You can join as an individual member to support their mission financially:

https://repair.org/individual-supporter-membership

noodlesUK• 6 years ago

It’s a shame that more exercise bikes don’t have open APIs. Zwift is an absolutely awesome way of keeping in shape if you like cycling, but the barrier to entry is that you need to own a bike and a bike trainer that are both pretty expensive. Maker projects like this one always make me happy, because it’s repurposing an old piece of equipment to function just as well as a new one. Next step would be adding smart controls to the resistance ;)

fortran77• 6 years ago

It may have been possible or the company to post the API publicly after Peloton shut them down without incurring any further legal liability. That would have been a responsible thing to do...and a way of getting back at Peloton.

soared• 6 years ago

Open apis pretty much ruin honest competition, leaderboards, live races, etc. People already game metrics on their pelotons to get top 10 in races, and I don’t think companies want to deal with that on a larger scale.

It’s a great idea, but I don’t think it’s always the right idea.

newsclues• 6 years ago

Closed systems are unhackable or cheat proof?

I don’t think so

deadbunny• 6 years ago

Not sure I follow your argument, if people are already cheating how would an open API be any different/worse?

xoa3• 6 years ago

The issue of cheating is genuinely valid one, but so is being able to use the hardware with a variety of software. And in this case, are you sure open APIs are actually in conflict? "Open" doesn't have to mean "forgeable", wouldn't it be possible to have a fully open and documented bike API that also cryptographicly signed output? Software could choose to not care about the signature and just run off the API directly, or to require a signature from a specific set of manufacturer keys, or for that matter both (why not support both casual groups and competitive ones depending on what users want?). Obviously for hardcore competitive types it'd still come down to the security and gameability of the hardware itself, and even if it was fairly solid it'd still mostly be about discouraging lazy cheaters, since as far as home use goes nothing stops someone from attaching an electric motor or something if they really want to screw with things.

But I don't think full open APIs any software can use in this case precludes getting as much security as is possible to get out of the software/electronics side of things. And full open APIs would be super useful for longevity, variety of use, etc.

djmips• 6 years ago

This whole article showed how to hack a closed system. Closed APIs clearly don't prevent cheating and that's not why they exist.

sukilot5• 6 years ago

Who cares? It's an exercise bike.

If the high score is what you want you can play a video game.

emb-fit3• 6 years ago

It's a $2k training bike. You could spend $1k and get a really nice brand new road bike and a smart trainer that controls resistance like a Wahoo Kickr Snap (or several others) for ~$500.

I just don't get why the Peloton thing is so popular when you can get a smart trainer and a bike you can actually take outside for sooo much cheaper. You could even sign up for Zwift and a Trainer Road subscription and come out waaay ahead of $50/month.

The protocols coming out of these things have become pretty much a standard as well. Get an ANT dongle for your computer and the data can be consumed from so many apps, even an open source project like Golden Cheetah. Or just read the data from a head unit that already supports it.

aesclepius• 6 years ago

I just don't get why the Peloton thing is so popular when you can get a smart trainer and a bike you can actually take outside for sooo much cheaper. You could even sign up for Zwift and a Trainer Road subscription and come out waaay ahead of $50/month.

You'd be surprised how much twiddling and research you need to do to find a correctly sized bike and which smart trainer (elevation? resistance? etc?) to get something that will work for the average person. It's the same reason people go for iPhones or Macs or anything else that 'just works', the time cost for getting to where one can actually use it vs. just unpacking a box w/ a 'good enough' smart bike means that a shiny package like a Peloton will always be preferred for a large chunk of the population.

stefan_2• 6 years ago

I have a ton of road bikes and a high-end smart trainer but I'm under no illusion that for someone not looking to ride outside ever, a purpose-made exercise bike is a vastly superior option. Even the smart trainer companies have figured this out and are making fully integrated exercise bikes.

One obvious reason is that no one cares what the exercise bike weighs and it will never be exposed to dirt or rain. That allows you to make a drivetrain that can trivially last past the useful life of the equipment without any maintenance ever. Meanwhile on the road bike you strapped to the trainer you have a chain, cassette and chainrings for no good reason - all of it ends up feeding into a variable resistance unit anyway!

Similarly putting a road bike you have used extensively on the trainer back on the street generally means doing a complete overhaul - you sweat salt water all over it and don't want your alloy handlebars to break in half because it corroded underneath the bar tape.

Ceterum censeo: we should focus on fixing the reasons that many people, particularly women, feel unsafe riding a real bike outside that they would rather stare at this screen going nowhere inside. Most of them without the mandatory two box fans blasting a hurricane their way, it makes me die inside just seeing that.

dehrmann• 6 years ago

I just don't get why the Peloton thing is so popular when you can get a smart trainer...

You're missing the point. It's not indoor cycling, it's more like at home spin class or soul cycle. The customer base is pretty different, and the experience is a lot of what they're looking and paying for.

walrus012• 6 years ago

'really nice' road bikes don't start at $1k. More like $3k. $1000 doesn't buy much these days, from the perspective of a serious road cyclist it'll be some barely usable thing with Shimano sora or worse level components on it. And will weigh over 20 pounds.

Someone who knows what they're doing with road bike mechanic stuff can probably piece together a decent dedicated indoor trainer bike for $1000. Using a combination of used and new components.

solumos• 6 years ago

The one thing that bothers me with ANT is that it's supposed to be an "open" protocol, but in reality it's this proprietary thing that Garmin has locked down. In my experience, there are a lot of hoops to jump through just to get a basic app set up (all of their example code appears to be ~5 years old).

It makes me wish there were an open, real-time, fitness data project that had more easily usable SDKs for these kinds of things (along the same lines as Golden Cheetah).

diiaann• 6 years ago

Road biker here. I used to go to Flywheel classes and have done some Peloton IRL in NYC. I also own a Wahoo Kickr and have a Zwift subscription.

I get the appeal of Peloton. First, Peloton is fun. Zwift is so freaking boring. I listen to murder mysteries while on Zwift because I think it's so darn boring. I only do it because I feel like it's a more effective workout. And cost wise, I already have a bike. Second, I know tons of people who don't ever want to bike outside. It's too dangerous or too much logistics.

monocularvision• 6 years ago

Because it was 111 degrees today.

faet• 6 years ago

I bought a $300 magnetic resistance bike, cadence monitor ($20), and a heart rate monitor ($40). The Peloton subscription is $12/mo for the app which I use on my phone. The only thing I'm missing is 'resistance' and 'output', but for roughly $1600 in savings I'm fine with it.

The classes are fun and they also include other things like strength, yoga, running, etc. There is no way to get classes around me for $12/mo or even $12/session.

rconti4• 6 years ago

I'm a frequent road and (less frequent) mountain cyclist, and I've got a Peloton (just did my 500th ride on it on Friday AM, in fact).

I've attempted to answer this question before for others, but honestly, I've only ridden zwift once, on someone else's setup, so I can't compare how "good" the experience is.

That said, despite my involvement in the cycling world, I still have no idea how to Zwift. I know I need a bike, a trainer, some kind of device to play the 'game' part, a display, and sensors. Presumably the smart trainer has power built in, but I don't know if I would want BT, or if I'd want ANT and then an ant dongle for my computer/tablet. I know the words Zwift, Watopia, Sufferfest, TrainerRoad, and about 37 others, but don't know the relationship between them. I don't how how the whole ecosystem fits together, what I download, who I pay, and from watching others struggle with it, it's pretty clear there's a non-0 learning curve.

I know for a fact that I COULD figure it out, but that doesn't mean it's for everyone, or all cyclists, or all cardio enthusiasts, or all people into spinning. From the cycling groups I'm in, whenever Zwift comes up, it seems like people are always discussing what components to get to work best together. I'm sure once you get the 'right' components it just works, but it sounds fairly fiddly for newbies.

I also hate riding a real bike indoors. When we had a mag trainer, my wife and I NEVER swapped the bikes out; she wanted me to do it, and so the 'wrong' bike was always on the trainer, and it always felt so damn fragile to me. I'd definitely want to use a dedicated bike for a smart trainer, not one I try to ride outside.

Another (admittedly minor) factor is size. I actually realized that I physically cannot fit a bike+smart trainer in the space our Peloton bike goes in our workout area (with a Peloton treadmill and Precor elliptical).

I'm pretty active in a handful of Peloton FB groups, and it definitely feels like there's a tendency for folks who use Peloton and ride outside to head towards Zwift for their indoor training, but there's also a significant percentage of people who went the other direction, or tried Zwift and didn't like it/found it boring/etc. The video game competition aspect of it looks like a lot of fun to me, but not enough to bother investing in a setup.

So, that's my 2 cents. While I didn't personally make the purchasing decision, I've made a lot of similar ones -- pay a bit extra for something that just works, where someone already did the research and made the decisions for you, and you don't need a new hobby or project to make it work. The same reason I use Apple devices, the same reason I bought a Synology instead of building my own NAS.

pc86• 6 years ago

Because people don't want to ride in poor weather? Because the terrain is inhospitable to their current fitness level? Because the terrain is inhospitable to any fitness level? Because they may only have 45 minutes to ride and want to spend the full time riding? Because they live in an area with a lot of pollution? Because they have medical issues where they worry about getting stuck away from their home? Because they just like tech or just don't like being outside?

There are plenty of completely legitimate reasons.

gkoberger2• 6 years ago

That's horrible that Peloton was able to do this. Maybe there's more to the story, but it seems like the court allowed them to shut down a competitor for simply building a similar (relatively obvious) product?

In fact, the CEO of Peloton had the idea for Peloton... IN A FLYWHEEL CLASS. That's insane.

xsmasher• 6 years ago

Clicking through the Verge links it sounds like Peloton had a patent that Flywheel infringed on.

We'd need to do a lot more reading to have on opinion on that case.

gkoberger2• 6 years ago

Here's the best article I could find on it: https://www.vice.com/en_us/article/qjdz7v/project-magnum-fly...

I agree that Peloton had a patent. My argument isn't a legal one (clearly, legally speaking, Peloton was in the right). I just think it sucks.

stefan_2• 6 years ago

These are the patents I assume:

https://patents.google.com/?inventor=john+foley&assignee=pel...

They are as absurdly simple as you would expect, so I assume Flywheel simply didn't want to/had the money to fight this. Like, here is the ultra-obscure "KETTLER World Tours" in 2018 having you race online against others on archived footage retrieved over the internet:

https://www.youtube.com/watch?v=7YfhyDrp5Yg

maxerickson• 6 years ago

A person can have an opinion on patents that isn't specific to a particular patent or claim.

zucker42• 6 years ago

I think there's a solid argument that patents are generally harmful, especially patents of software or non-revolutionary product features, so I think you can form an opinion.

If we embraced copying a little more I think our society would be better off.

gojomo2• 6 years ago

I've heard from a Flywheel customer who's been following the case closely that the discovery phase was very damning for Flywheel – blatant theft of Peloton's corporate documents, including things like proprietary operating details, internal financials, projections, & future plans, with direction & understanding of Flywheel management/investors, feeding directly into Flywheel's plans.

So it was bigger than just a patent case, and Flywheel, caught red-handed, had no choice but to settle to Peloton's satisfaction.

sneak• 6 years ago

Peloton also engage in all manner of shady marketing, heavily astroturfing all purportedly “community” forums, and silencing criticism or negative comments.

I had one of their bikes, and sold it because the service was crap. I encourage people not to do business with this shady company.

syshum2• 6 years ago

It is a classic example of "on the internet" patent,

The problem is not Peloton persay, the problem is the Patent office allowing these obvious "Thing in the real world -> On the internet" patents to pass right on through

jdechko2• 6 years ago

Some interesting info here. I have a Garmin speed sensor and a “dumb” mag trainer (CycleOps Mag). Given the trainers known resistance curve, I was thinking about trying to come up with a script to approximate power based on speed.

Basically I want a home brew alternative for Zwift and TrainerRoad virtual power.

rconti4• 6 years ago

That would be a cool project. Do you already know the resistance curve, or you're just saying SOMEONE knows it? I'd worry that it would be impacted by heat, but perhaps not significantly.

I've got a Peloton, have a Stages power crank on my road bike, and previously had Favero Assioma power meter pedals (highly recommended product BTW). I ran the pedals on the Peloton for a few rides to get a feeling for how close the calibration was. (surprisingly close, in my case).

jdechko2• 6 years ago

Saris (now owner of cycle ops) has an approximate graph on their blog. It’s probably not very accurate, but I could probably get close enough by taking some “known” points, some approximations and applying some math to the problem.

The other option is to see if I can dig into the zwift or trainer road code. Both of those applications support “virtual power” for this specific trainer. Which is another way of saying that SOMEONE knows it. I’m sure that Saris actually shared the exact curve with Zwift and Trainer Road, but I’m not sure they’d share it with me.

ChuckMcM• 6 years ago

This is a great reverse engineering project.

What it points out to me, painfully, yet again, is that cool stuff can actually do everything its bought to do without a "monthly service fee." And yet here we are.

arkanciscan• 6 years ago

An escalator can never break: it can only become stairs. You should never see an Escalator Temporarily Out Of Order sign, just Escalator Temporarily Stairs. Sorry for the convenience.

Mitch Hedberg

mschuetz• 6 years ago

They can fail quite spectacularly: https://www.youtube.com/watch?v=o1SjQfwLieU

xkde• 6 years ago

Somebody has no sense of humor...

saagarjha• 6 years ago

Sometimes they eat people too :(

anticensor• 6 years ago

We have a much shorter expression in my mother tongue, Turkish: we call stairs "merdiven" and escalators "yürüyen merdiven", so "Escalator Temporarily Stairs" becomes "yürümeyen merdiven".

anonymousiam• 6 years ago

You left out step 3 on your ToDo list: 3) Spoof the data to the social media apps and make yourself into a super-human athlete!

(Probably best done with a different account.)

flak48• 6 years ago

A simple fix is to just use the previous power value if ever: the cadence is non-zero and the previous power is non-zero and the current power is zero. A slight improvement is to keep track of the slope and factor it in when calculating the predicted value.

Looks like somebody rediscovered the Kalman filter without realising it :)

I recall implementing one for an IoT device, to de-noise gas sensor readings a few years ago.

Pretty fun read. Makes me wish I could gather the courage and patience to get back into hacking on embedded stuff

ohazi3• 6 years ago

Products like this make me furious.

Selling a product whose interface/API/whatever is deliberately obfuscated so that the manufacturer also has a monopoly on a subscription service or an app for said product is blatantly anti-consumer, anti-competitive, anti-environment, and should be illegal.

Fuck Peloton. Fuck Flywheel. Fuck all the proprietary IoT companies.

And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway.

Nobody should ever feel like they have to throw out an otherwise functional refrigerator-sized appliance because of software obsolescence.

I am absolutely willing to die on this hill. We need a GDPR-sized hammer to fix this.

DebtDeflation• 6 years ago

GE app #12 that's going to be abandoned in two years anyway

Not merely abandoned, but abandoned with gaping security flaws, no other way to update the device, and an always-on internet connection. We really have not thought this IOT stuff through.

lstamour• 6 years ago

Inevitably the long-term solution is going to be more layers of abstraction. Web application firewalls for every wifi device in your router, for example, or operating systems maintained by cloud vendors (for “edge devices”). If always transmitting connectivity isn’t required, maybe HomeKit-style app-based (offline or app-based updating) devices that use other devices as repeaters which can then be reverse engineered from their apps (largely illegally in many countries). I don’t think we’ll see open specs unless Apple or Google or government make a significant push, or a future large-scale chipset manufacturer uses open source as a way to both get customers and maintain long-term support for their chips. But we know how well GPL works with most hardware (poorly, unusably, etc.)

dcow3• 6 years ago

Or, maybe the whole impetus behind the free software movement isn't wacko bullshit after all...

We had a solution and everyone pissed on it because the misinformed and perhaps intellectually lazy lawyers and leaders and yes even engineers convinced everyone that the GPL was unfit for a capitalist society.

“Was” is admittedly unfair because free software is not actually dead. It’s just popularly dead. If this type of crap actually outrages you, it’s not GDPR that we need (it makes no sense if you think about it, too), it’s smarter consumers and more courageous engineers/leaders. Go speak with your feet and use free software products. And help breath life into a culture that has been wounded by greed.

thereisnospork2• 6 years ago

Its a pretty good hill to die on. Everything IOT should be forced to communicate over transparent and self-documenting protocols so a. anyone can write an app to control said device and b.[0] Alexa/Cortana/Siri can query to set up a voice control interface.

[0] Maybe in the future when their capabilities get a bit better, but the gist is every device should respond to a 'hello' ping with a list of commands and NLP'able descriptions such that for an air conditioner 'alexa set temp 67 degrees F' just works.

crooked-v• 6 years ago

HomeKit is probably the closest thing at the moment as, while it's a proprietary protocol, it's already been mostly-reverse-engineered enough to have open-source HomeKit controllers for most devices, as well as open-source bridges from non-HomeKit devices to HomeKit protocols.

flir• 6 years ago

Years ago, there was Jini (Apache River now). It never gained much traction. But I always liked the idea of interoprable home devices announcing themselves on my network. "Hi, I'm a mass storage device. If anyone's got data they need storing, send it my way!"

btashton3• 6 years ago

This kind of response is a big part of why I have given up building commercial IoT products for now. It's great to want to have some super abstract high level self discovering protocol, but when you actually start to build on it it really hampers the product.

If you want to build a smart light switch you are trying to get the response time very low and worry about things like syncing behavior around the network. Doing these things ends up being very domain specific and you do creative engineering to make it happen. These are very different than the requirements for say a vacuum cleaner.

Then we have standards that come out like Bluetooth mesh or HomeKit that say this is exactly how a light switch should work. Great, except your light switch has this cool feature that Philips did not think of in the committee meeting and now you are forcing it in and your product once again suffers.

These standards all suck, some small percentage of your customers want custom access (rightfully so), and a large percentage are comparing you on price and experience. The outcome is a closed off product. With maybe a cloud API.

Like I said this is why I don't want to work on these products anymore. You cannot win.

Pxtl• 6 years ago

Web. A self documenting protocol is it runs a webserver that accepts simple form requests.

"But web tech is insecure!"

If they can't secure a form post, what hope do they have of securing a proprietary api?

Yes, home appliances running webservers would have downsides for management, but that's where routers could add value. It would be trivial for a router to scan port 80 of every device on your network and present a page to pick your devices. That's something I'd even use an app for.

"Port 80? But what about encryption you complete monster!"

How the hell is that cert going to work? Even if they had some magical way to store a cert on the device securely, surely they're going to screw up keeping it up-to-date, or do you want your "it's MY device! Mine!" to depend on an external provider for security?

Just make sure the devices can run on some kind of VPN.

Router can keep them on a VPN and run a proxy with proper SSL for outsiders. Then you only need one device in your network secured to modern standards, all your IoT run in the router's IoT sandbox and all access to them is through a proper SSL-encrypted proxy portal.

There. It would be possible to make that layman-friendly infrastructure. Router detects you connecting to LAN device over port 80 and says "hey, this looks insecure, do you want to move this device to the secure sandbox? You can access all IoT devices securely through my app! Y/N/OMG this is awful never ask me again!"

bigmattystyles• 6 years ago

Just like the wink hub. They recently switched from free always to we now need 60 bucks a year from you. Talk about bait and switch.

lostlogin8• 6 years ago

app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway.

It was a revelation putting a Pihole on the network and making a firewall rule that forced any non-Pihole port 53 traffic back to the Pihole. Samsung and Google make a lot of connections to home.

twicetwice• 6 years ago

HTTPS is great for users, but I'm annoyed that it will let companies get around this sort of thing. I want to control the traffic on my network.

sokoloff• 6 years ago

Is it really that different than the razors-and-blades, inkjet printers, games consoles, or electric toothbrush business model? Or even the new cars and service model [wherein more money is made in the service bays than on the showroom floor].

TeMPOraL7• 6 years ago

I wasn't around on this planet when razors-and-blades model was first invented, but it wouldn't surprise me if people raised objections back then.

To me, the general model of selling/giving away a device that serves only to lock the customers into buying overpriced consumables is ethically questionable. I find it exploitative, dishonest, wasteful and anti-competitive. Such business model requires the corrupting the law to create completely artificial constraints, to make it illegal for competitors to offer said consumables, in order to prevent competitive pressure from pushing the price of consumables down to where it should be[0].

I can't give a detailed and coherent argument for why I feel that way, not just yet - part of the reason I comment in IoT/DRM/another-product-turned-into-bullshit-service threads is to try and discover that argument through discussion. But it really feels wrong, compared to a hypothetical reality where both the devices and their consumables were properly priced closer to the marginal cost of production, which can happen only if people can freely build on top of platforms.

[0] - And if I'm listing negative adjectives, I might add parasitic - in the sense that if you imagine business models as organisms, this one took over host society's legal system to ensure it could to outcompete more straightforward (honest) ones.

dfox• 6 years ago

One issue with open interfaces for these kinds of applications is BT-LE itself. It is nominally designed as open standard for transferring exactly this kind of data, but it cannot do anything else than SNMP-like get/put/trap on some attribute, so everybody ends up designing their own proprietary L4 TCP-like protocol on top of attribute writes and reads to accomplish anything interesting.

floatboth• 6 years ago

Most "smart" devices don't need anything beyond attributes, heck, some of them (thermometers and the like) could just fit all the data into a beacon advertisement!

Manufacturers often do really silly things like encoding all the data into one custom attribute:

https://github.com/open-homeautomation/miflora/blob/31e59bdb...

All of this easily could've been done with standardized attributes but fuck interoperability lol.

it cannot do anything else than SNMP-like get/put/trap on some attribute

It can do whatever you want. Nobody is forcing you to use ATT, you can speak anything over L2CAP.

squarefoot• 6 years ago

Fuck Peloton. Fuck Flywheel. Fuck all the proprietary IoT companies.

And not just in the IoT field. Pretty much every company that could use their closed software/firmware/designs plus lawyers to enforce their right to render a product useless or obsolete, or simply becoming the only authorized to repair it then refuse the repair, so the user must buy a newer one, will eventually do that if allowed by the law.

John Deere has been really hostile to their customers, for example. https://www.vice.com/en_us/article/xykkkd/why-american-farme...

notimetorelax• 6 years ago

The legislation will probably originate somewhere there. At some point world should realize that software sales are not different from hardware sales.

fiftyacorn• 6 years ago

John deere only made sense to me when I found out bill gates as it's largest shareholder

encom• 6 years ago

Don't forget Apple. They absolutely hate customers servicing the hardware they bought and paid for, and they fight it with both technology and lawyers.

Remember that awesome time when Apple disabled phones, because they had a 3rd party home button installed? Absolute scumbags.

userbinator3• 6 years ago

I agree with your points, but in this case it was not obfuscated at all and as the article shows, not really difficult to figure out. Furthermore, this knowledge can now be shared with others.

As long as RE is legal (and even when it isn't...), people will figure things out.

We need a GDPR-sized hammer to fix this.

AFAIK, RE for interoperability (which this is absolutely an instance of) has always been and is likely to remain legal in the EU.

danielheath• 6 years ago

As pointed out upthread, we’re increasingly seeing devices that never get reversed.

Even many of the really popular ones take years to hack these days, because the mitigations keep getting stronger.

FpUser• 6 years ago

Generally yeah, fuck'em all. There are however cases when playing with the device using 3rd party software could lead to bypassing safety features and if people got hurt who is to answer?

userbinator3• 6 years ago

"Freedom is not worth having if it doesn't include the freedom to make mistakes."

sukilot5• 6 years ago

The person who bypassed safety features, or insurance coverage.

aiisjustanif• 6 years ago

Just wait until you here about this company called Tesla that is paving the way for “your car is an IoT subscription”. Oh yeah and this company called John Deere with their subscription model for their DMCA protected tractor that you “own”.

aranibatta• 6 years ago

trying to dig into the root of this frustration, i think it mostly stems from the misalignment for how we expect the internet to behave (open, accessible, all the other fun Tim BL stuff, etc). it’s extremely unfortunate that companies like peloton, john deere, skydio, on some level DJI, and others as we cross software into the real world haven’t kept up with those expectations. huge loss, and concerning behavior as the internet starts to expand further IRL.

Balgair• 6 years ago

This twitter account is well aligned to this sentiment, proof included: https://twitter.com/internetofshit

rubber_duck• 6 years ago

And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway.

Do you have IR controller for your AC ? If so you could get one of those smart plugs that you can control remotely (zigbee, wifi service, whatever) and it will communicate with your AC via IR, you plug it in to the AC socket and then plug AC into it.

flingo• 6 years ago

I am absolutely willing to die on this hill. We need a GDPR-sized hammer to fix this.

Any thoughts on a labelling system? Like, "re-flashable open source firmware", "cannot be remotely bricked", "API-spec and code examples included" stuck on the side of the box.

I'm surprised some hardware hacker supply company, like adafruit/sparkfun hasn't gotten on this yet.

RangerScience• 6 years ago

Relevant to your interests: https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-...

lsllc• 6 years ago

Agreed. Right to repair, which I believe includes software should become law. I have a pile of bricked stuff, mostly electronics that I can't use (hello Pebble Watch). I hesitate to buy "connected" products unless they are open (e.g. Z-wave switches), never proprietary stuff!

twodave• 6 years ago

I might even take it a step further and say no product should be rendered unusable without an Internet connection unless the Internet is an absolute requirement of the product’s basic function. I.e even IoT devices ought to be able to be air-gapped and on their own closed network (unless, for instance, it’s a clock or something and relies specifically on things like weather/traffic APIs). And even in cases where there is a legitimate product feature that requires an internet connection, not having one should NOT render the other parts of that product unusable.

pabs33• 6 years ago

What does the GDPR-sized solution look like?

Maybe "every IoT vendor must put their source code in escrow and when they go out of business the source code becomes GPL"? Of course they could just escrow incomplete software with parts just being sourceless blobs and no-one would have verified it is complete by the time they go out of business. It also doesn't work when they buy proprietary software bits from other companies.

pabs33• 6 years ago

I would like to see a "Right to Repair" for software.

Drdrdrq• 6 years ago

Any FOSS or Commons Clause software fits the bill.

Or are you saying you would like to see Right to repair legislation for software? Me too, but it won't happen.

thedanbob• 6 years ago

I'm looking into mini splits for an apartment and project room I'm building in my shop. I really like the Mitsubishi ones partly because they have a documented port to connect to them and people have already written code and schematics. Unfortunately, they are twice the price of the cheap ones that only have a proprietary wifi dongle that I'd have to reverse engineer myself.

gog• 6 years ago

Get the Mitsubishi Super Inverter. Not because of the wifi (mine does not have that option), but because it's a really good product.

I have one running for the last 6 years and I always say that it was the best purchase of an electrical appliance I ever made.

Super quiet also, my model is around 19dB inside and the outside unit is also quiet.

dvcrn• 6 years ago

And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway.

My aircon is infrared based so I bought a $20 infrared emitter, recorded all the button signals from the remote control and plugged it into HomeKit. Now I can voicecontrol/Remote control my antique aircon better than current models that still don’t support HomeKit

Bonus points: I put the emitter in line with both aircon and TV and use the same device to control both

1vuio0pswjnm7• 6 years ago

The scariest thing IMO is that this strategy seems to work for the seller. (Besides John Deere oweners and the HN crowd) How many consumers are protesting this kind of nonsense? I would bet most are dazzled by the prospect of some "futuristic" product feature.

To me, this stuff actually devalues the product. It has the potential to be useful but the way it is being used is to deny the buyer full ownership and reserve additional rights for the seller.

pentae• 6 years ago

My condo building has these fancy new Technogym "MyRun" cardio machines which are basically regular workout machines with giant iPads on them. So now instead of turning them on and starting a workout I must wait 3 1/2 minutes for the touchscreen to boot every morning and every other week theres a failed software update causing the machine to shut down mid workout to restart the software in an endless loop. Or it just won't turn on due to the software on/off switch not working and we have to call the technician. It's unbelievably bad. Unless you actually care about connecting your workout to an app (i dont) a prehistoric cheap workout machine from 20 years ago has a better experience and is actually maintainable

juskrey• 6 years ago

Hey, we both know the answer - you don't need fancy app to be fit on your bike. Neither for making sense from your aircon.

Too• 6 years ago

The bike is not even close to being bricked. You can use it without the app, there are multiple replacement apps; both a free version from the same vendor, a equvalent subscription from the new owner and some other third party apps.

Otherwise yes, agree that subscription dependent IoT needs regulation.

postit• 6 years ago

And to think I‘m used to make fun of RMS for complaining about how he wanted to run his own software on his microwave.

m463• 6 years ago

I just return stuff.

I bought a segway mini years ago, only to find out you had to download an app before you could ride it.

Same with with a DJI mavic quadcopter.. you could not just turn it on and fly it with the included RC remote controller - it would just say "see app" or some nonsense.

both got sent back. Seemed a little silly at the moment (I just got this cool new thing -- cave.. cave..) but I'm way better off.

(turns out the mavic sends details of EVERYTHING to lots of sites willy-nilly)

gorgoiler• 6 years ago

It has to be fixed through regulation. The free market does not support long term, expensive solutions, such as APIs.

If you provide the bike with a public API, it’s going to cost more. You now need to actually test the API works, instead of simply testing the bike works, end-to-end, with your own software.

A stable API with supported version changes and backwards compatibility is a much more challenging engineering prospect.

Forever ‘twas this. Maybe they can start by using something like an automotive CAN bus.

gojomo2• 6 years ago

Drat, I was hoping this would also have a recipe for unlocking/reinitializing the attached Android-based tablet, on some of these bikes. Then it could run other biking apps - or just provide reading/music while riding. (Maybe even: it could do the BLE translation?)

The community hasn't figured out how to root the tablet, yet, but there are some hints as to the manufacturer/boot-launch-software – https://www.reddit.com/r/FlywheelAnywhere/comments/gexqte/ha... – if anyone has any ideas or is interested in a challenge.

sagz• 6 years ago

I'm trying to create an Android recovery for a peloton, which is similar https://github.com/Goayandi/mediatek_mt8176_development/issu...

amluto• 6 years ago

First, the node binary needs permission to advertise Bluetooth services:
sudo setcap cap_net_raw+eip /usr/local/bin/node

Use AmbientCapabilities= in the unit file instead.

ptx2• 6 years ago

That's much better, thanks for the tip!

olliej• 6 years ago

Wow, I love expensive equipment that can’t work once the company goes out of business. If you want to have a subscription based hardware device the hardware should be free.

einpoklum• 6 years ago

a $2k bike

Maybe that's your problem right there. Get a simple bike, leave the house (ok, I know there's Corona, I didn't say congregate), find someplace planar, and cycle in the real world.

In Amsterdam, a decent used bike will cost you the equivalent of 80 USD, maybe less.

syshum2• 6 years ago

Amsterdam also has a large public cycling culture, with a public infrastructure to support public cycling

It also has a climate geared more towards outdoor cycling.

Not everyone has one or both of those factors, making indoor cycling more reliable, safer, and more enjoyable

jasonvorhe2• 6 years ago

If he's using such a training bike with the intent of using a service such as Zwift, I'd expect the author to already have a decent road bike and that the training bike is more of bad weather, winter and easy access to fitness workouts without having to deal with traffic.

But even if he doesn't have a bike yet, he most likely would ride a road bike and you don't that for bucks.

I agree though, riding bikes is extremely underrated, no matter where you live.

ggm2• 6 years ago

Was it really "bricked"

askvictor• 6 years ago

No; this is hyperbole, and cheapens the meaning of the word bricked. It's core function still worked perfectly. The app no longer works. The app was always a subscription service. There was an offer to swap (for free) with another bike, which continues to let you pay to another subscription service for similar or better functionality.

I'm all for hacking your gadgets, and open APIs, but let's get a sense of perspective.

ggm2• 6 years ago

"I reverse engineered the data feed protocol on my spinner" would have made me click.

userbinator3• 6 years ago

It's interesting to see the discussion here focusing mainly on "open from the producer/manufacturer" side, when what I think is the really important point here is that "opening from the consumer/user" side can be easy and empowering: companies and services will come and go, but your ability to take control effectively depends only on your willingness to discover and explore.

I avoid a lot of "smart" products in general, but feel comfortable with working on the equipment I do have --- whether it's maintenance, repair, or modification --- and I think that's the most important thing to keep in mind; to not be scared of treating things as anything other than mysterious black boxes. It seems that a lot of people treat "reverse engineering" as some equally mysterious and imposing idea, when it's really just about problem solving or figuring out how something works.

Also, I don't think the RPi is necessary here; the bike is a Bluetooth device, so any computer with a Bluetooth interface can receive its data and process it. I'm not an RF expert, but rebroadcasting BT seems like it would create more interference.

ohazi3• 6 years ago

your ability to take control effectively depends only on your willingness to discover and explore.

This should be the limiting factor, and this is often the case when a product was designed sensibly and the interface just wasn't documented. Reverse engineering a device like this is relatively straightforward.

But more often, companies deliberately obfuscate, encrypt, or booby-trap their interfaces in order to actively prevent reverse engineering, and this is the reason for the frustration you're seeing in the other comments.

usrusr2• 6 years ago

Also, I don't think the RPi is necessary here; the bike is a Bluetooth device, so any computer with a Bluetooth interface can receive its data and process it. I'm not an RF expert, but rebroadcasting BT seems like it would create more interference.

The rebroadcasting is done because the goal was to get the data into a proprietary piece of software that expects data to come in over Bluetooth.

And rebroadcasting will actually be just fine on the air medium because right after receiving is exactly the time when the bike won't send another message.

The RPi is complete overkill of course, a tiny $3 nRF52 module could do that job just fine.

noisy_boy• 6 years ago

your ability to take control effectively depends only on your willingness to discover and explore.

Lots of folks have additional constraints of time due to family/other responsibilities etc. I can afford to spend an hour or two if the API is open from the manufacturer's side to write a script or setup a simple service; I definitely cannot afford to spend time on packet sniffing or such low-level reverse-engineering.

Zigurd• 6 years ago

There are other machines, like rowing machines, for which an open solution is hard to incentivise, since the machine, the app, and the sensors will all come from a single vendor.

I'm a little surprised, however, that Peloton, and Peloton-alikes ever happened because cyclists have training devices with open interfaces: Bikes, mounted on smart trainers that have standardized wireless links and protocols, connected to a choice of apps.

All it takes is taking the rear wheel off a bike. Or not even that for the most basic trainers, which clamp the rear axle and provide resistance to the rear tire. A fascinating case of a market segmentation that is less susceptible to being breached than one might think.

jasonvorhe2• 6 years ago

I have one of those Tacx trainers where you just put your bike in. It's a hassle. You need to use their own quick release to hold the bike in place. The cord with the gear shifter (which sets the resistance) is always somewhere where it's annoying the rider and the shifting control itself doesn't fit on all handle bars. It's also really noisy.

I have been tempted very often to just buy one of these ready to use training bikes because of the frustration of: put some yoga mat cut-outs underneath the Tacx to suppress the vibration of the spinning weight, get the bike from the cellar, exchange the quick release, store the old one somewhere where it's not getting lost, put the bike in place by its rear wheel, place the front wheel in a fixed position, get a fan to put in front of the bike trainer, mount the gear shifter, which clumsily hangs on the handle bar because my handle bar is too big. (It's a standard road bike handlebar)

Did I mention this thing was really loud?

I'm also sometimes worried about the fixed pressure on my carbon frame but I think that's actually unreasonable.

kingosticks• 6 years ago

But they are quite cheap and they fold away. The next tier up 'wheel-off' trainers are much quieter. But you've still got all that faff (add chain oil to the mix when taking the rear wheel off) of getting the bike upstairs, the wheel off, mat down (for the sweat), positition the fan etc. But I don't have a load of space so a dedicated exercise bike is a complete no.

By the way, clip the resistance switcher on the top of your front wheel rather than your handle bars. Fits well there and is out of the way but still reachable.

p1esk• 6 years ago

Why would a bicycle need a subscription service?

vikramkr• 6 years ago

Reading into this - flywheel apparently stole patented ideas from peloton including streaming on demand exercise classes? And that's why their service is shutting down? How is that supposed to be a protectable/patentable concept? That sounds like some first class patent trolling at face value.

ponker• 6 years ago

It wasn’t just patent infringement — they stole corporate documents and assets from Peloton Levandowski-style. There are other companies doing exercise streaming like Mirror which haven’t had to shut down so I don’t think this is some kind of massive patent roadblock for the industry.

forgingahead• 6 years ago

Imagine inventing the wheel and expecting that in the distant future, the wheel itself would stop working because of a stupid reason like this.

Wolfenstein98k• 6 years ago

I'm fairly open-minded, but sometimes a product comes along and blows me away with how preposterous its central pitch is.

And then I discover there is actually a market for it, and I am further dismayed... And amazed at the robustness of Say's Law.

Anyway, this bike and the whole associated product is preposterous.

layoutIfNeeded• 6 years ago

There are standard BLE GATT attributes for reporting power output, cadence, etc. from indoor bikes (and tons of other standards for other fitness appliances, smart scales, blood sugar measurement devices, etc.). If the vendor had used these standard attributes there won’t be any need for reverse engineering their protocol.

Moral of the story: choose appliances that support standard protocols.

Maha-pudma• 6 years ago

The 2k exercise bike aside, this is a brilliant article. I love reading stuff like this and wish I had the smarts/knowledge to do this sort of thing.

Fricken• 6 years ago

If the bike doesn't take you anywhere when you pedal it, it's still a brick.

m00x• 6 years ago

This is the kind of article I love to see on HN. Someone had an issue with a product and solved it using clever technical skills and deep dives.

Unbricking a $2k bike with a $10 Raspberry Pi

Related Stories