supergeek133

I have first hand view of traffic Home Assistant creates.. there is an upside down usage model.

Infrastructure (servers, bandwidth, etc) costs money.

For better or worse, most devices don't have local interfaces. Some matter devices exist in the past year or two, but not all data/functions are available via matter. Older devices likely won't ever be updated to support matter.

Also lump in the fact that HA is a locally run/focused application, it isn't super compatible with a cloud based API/data delivery system without some additional development from the OEM end.

Last I did the math for an internal system.. in 24 hours HA traffic was ~20% of total, for less than 1% of users. That's wild. Mostly because each instance is pinging the API directly every X or less minutes.

If an executive here heard that math, they'd likely ask to block it as well. Right or wrong that's how people react.

Volkswagen has an EU Data Act site:

https://drivesomethinggreater.com/eu-data-act

No, it isn't. It literally created a second class of phone users in America.

Specific example: When on dating apps you see "green bubbles" as a red flag/un-dateable trait, it has done considerable harm.

So many people are overengineering this... I have a wireless Jabra headset. Works great. At home I use one of those usb speakerphone pucks, works great. Not these super special desktop mics that streamers or radio broadcasters use.

The people who try to use their webcam mic or the built in mic are the ones causing most of the problem (yes I'm also looking at you Macbook users).

I always thought it'd be a great idea if in your internal Teams or Zoom instance you had a "send this person a new headset" button to fix the problem.

Whenever you see one of these "it's product" or "it's engineers" all I can think of is "someone has more business context or knowledge than the others"

The best teams I've ever worked on as a product manager/owner is where we have shared context. These problems described here are minimal. In those teams I could provide technical input to engineers, and engineers gave me "consumer facing" suggestions on features.

I've believed for a long time that lack of business/use context drives a lot of these issues.

Take for instance I currently work at an IoT company, and if I'm working with engineers who have no idea what a thermostat does/how it works other than "makes it hotter or colder" then we have much more difficulty building shared understanding of a feature request.

I also know this because 10 years ago that was my simple understanding of a thermostat... so it was much harder for me to understand why we were doing certain things.

The friends I have that work there that love it are absolute workaholics.

Amazon takes every minute they're willing to give, they're successful and consistently promoted/paid more.

This is also why I'll never work at Amazon. Haha.

One frivolous lawsuit destroys the revenue from multiple happy customers. Unfortunately.

The State of MN stopped accepting certain credit cards for many DMV type activities, and now only accept ones that allow an explicit surcharge (Visa, Mastercard, Discover, Amex).

That's the interesting bit for me.

I DO believe people are calling the police less for crime, even violent crime.

However, how do you have an official source of "I decided not to call the cops".

How does one have an official source of "A crime was done to me but I just decided to not call the police"

But this cultural issue is literally quoted in the DOJ complaint against Apple.

Apple, by overlaying iMessage features over SMS and only accessible to iPhone users have created a virtual second class of phone users.

I'm not saying I run into these people, and I agree with your take.

Not at all. A few of my friends are techies and they use Android/iPhone about 50/50. Family is mixed as well. No one in family uses iMessage.

I would bet money this is the opposite of the majority experience.

Your average iphone user has no idea what this is.

All the know is "android makes the bubbles green and iMessage doesn't work as well with them, or at all".

Are your various friends/family all tech-y people?

My "normal" friends and family are majority iPhone users. I'm Android.

I "literally ruin" their group texts. I've seen people actually reject relationships because they don't date people with "green bubbles".

Don't even get me started about work group texts.

I know restaurants where some of the servers have group iMessage chats with customers for early notification about nightly specials, Android users literally can't be added.

Likely not maliciously, but this has created almost a "second/lower class" of phone users that encompasses ~50% of the country.

And yet here I am with my 10+ years of experience, without a degree. I've met people better than me with less experience and no degree, and people who aren't very good that have MANY degrees.

Yet we've gone through many iterations of the interview process (and testing, things like leetcode) to avoid having to basically accept a gut check of "do I think this person will perform well".

It's more of an art versus science than I think people give it credit for.

So is interviewing itself.

Or the fact that many of the major "security bad press" or "S in IoT stands for security" stories are because such interfaces were made but not properly secured. (see bosch story)

Understood, and I've advocated for this at my company, but I like to talk about things I have sphere of influence over.

How do you know these are Haier's best customers?

By definition, they are using MORE platform/API traffic than the average user and not paying more.

That's what I don't get, why they didn't just start with pure math/data when reaching out to the developer.

The only thing I can think of is someone outside of the "knowledge chain" caught wind of it and just fired of the legal threat.

For instance, if I told some people inside my company how much traffic HA uses in terms of how many users are on it they'd probably freak out like this too.

But their reason (cost and traffic) is the biggest reason we don't like it either.

Yes, they are your users. They are likely the people who will gush about your product to their friends and result in more sales. If the plugin could be behaved better: Make a PR and improve it. People will love you if you do it under your company name, but if you don't want the potential internal drama just do it anonymously. Wins all around.

Which is why to this point, I let it go and don't actually tell anyone how much traffic it takes up. It isn't worth fighting over. Haha.

Power users are some of the best cheap marketing available to device manufacturers. They will post about your product online. They will tell their friends. They will make your product better for no charge to you.

If I had some way to quantify that, I'd accept it. But as it sits now the vast majority of our users don't interact with any integration models short of "share data with my installer". Alexa being the most popular aside from that.

I'd love to hear about how this could be considered a cybersecurity issue. It's typically far more secure than a cloud connected solution, but most companies don't like that line of reasoning because it doesn't allow them to track their users.

Go look at major IoT "security problem" news. It is either "cloud leaked data" or "OEM didn't lock down local interface correctly". See the recent Bosch Thermostat story.

Or the "horror years" of Chinese ODM cameras showing up on shodan with live feed video access.

Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund.

If 3k home assistant users take up as much traffic as say... 50% of my total population we're just supposed to accept that cost in perpetuity?

Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then

I advocate for local access internally (to be clear, I don't work for Haier). But I'm here to discuss things I have sphere of influence over as well.

Now also just design an official home assistant module and you've turned this drama into community goodwill.

That, again, costs money/people/time that can be spent doing things that keep us all getting paid.

All this said, we have lots of API keys in our systems issued that are used in HA, and they DO take up lots of traffic. I sort of let it go because of exactly this (it creates a lot of noise to shut it off for little benefit).

Again, I also agree we should all offer local interfaces, but that's an uphill cybersecurity battle (lots of reasons, some of them not great)

I have data to back this up (at least for our products), do you?

That's exactly what Haier is doing, just via legal means than technical ones.

We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me.

In this case, it appears they've taken the same access/creds as the mobile app maybe?

Another one of our platforms we cert-pinned the API to prevent this as well.

Yes there are ways, the other part we don't know is if they went straight to the legal route or not.

Haier (at least this product in the EU) doesn't have a published/public API.

The code in question scraped the API off of app/device traffic.

Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it.

Source: I run a developer program for a different IoT company

At this point? I'd push harder to avoid all this negative press that is pervasive in IoT journo when it REALLY impacts a percent of a percent.

When the Chamberlain story happened, I received questions from executives on why it was such a big story.

From a business perspective, it just isn't.

I agree with you.

Same reason we don't dedicate people to write HA integrations.

I'm guessing when they're saying "Assistant" they're talking about Google. Not HA.

It takes a lot more to deal with/manage these integrations than some on HN ever realize, especially when these stories come up.

Even though I advocate for a local interface, I also completely agree with your statement.

But, the alternative is we either accept this completely upside down API traffic ratio with locally focused integrations (bad, costs lots of money) or allow a local interface.

Another potential workaround I advocated for was a "cloud down" message that could enable the local interface for those that ONLY go looking for how to do it.

Security via obscurity and "closed loop" tends to be the answer, plus whatever doesn't show up on a scan tool.

Thankfully we have a (fairly) accessible API to the cloud side.

TBD on what (if anything) matter will change.

Don't ask me to explain the mindset of your average "tool runner" cybersecurity person.

I've long advocated a local HTTP interface for our products, but usually a losing battle.