> The fan downloads its root CA cert over plain HTTP. It was always MitM-able.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
"The fan downloads its root CA cert over plain HTTP"
Would love to understand the decision-making behind this at Coway (or their firmware contractor). Anyone care to guess why someone would make this choice?
Hardware companies by and large don't get software. They just don't understand it. Their world is sourcing parts and assembly and packaging. They look at software like any other line item in the BOM: Like a screw or gasket. You source it from the cheapest supplier, and spoon it onto the product somewhere on the assembly line. These companies simply don't care about their software, and their requirements to their supplier amount to "make something work." The quality bar is literally "customer should not return the product."
> Anyone care to guess why someone would make this choice?
My guess: At some point in the past, a firmware was developed without plans to include firmware update functionality. The team that did this was later burned when the client tried to use a new certificate that the hardcoded, unchangeable system didn't recognize.
Angry meetings occurred, developers were chastised, and someone realized they could avoid that problem by fetching an updated root CA on demand. They did it over HTTP to avoid a chicken and egg problem.
In hardware manufacturing, everything is about crossing items off the list of problems. A problem was raised, someone came up with an idea to solve that problem, and it was implemented. The practice might have spread to other products because it became institutional knowledge about how to avoid a problem that made a customer angry once.
This is from my experience in the consumer hardware industry. If you're not watching the outsourced development closely, they will take the easiest route to solve the problem in front of them and nobody will consider any other consequences.
Everyone (including the author) is as per usual focused on the wrong thing.
There is nothing wrong with downloading a certificate over HTTP. In fact, that's how PKI is designed and if you look at the AIA field of this very site you will see the certificate chain is meant to be served over HTTP.
What IS wrong is implicitly trusting an untrusted certificate. Whether it came over HTTPS or HTTP is irrelevant. But no one is talking about that.
I'm more puzzled why someone would buy a complicated IoT purifier for a drafty Bay Area house that probably has knob and tube wiring.
My most reliable air purifiers have a dumb, physical on/off switch. I bought them deliberately for that feature.
People don’t understand things and act shocked when they learn apt and Steam packages are downloaded over HTTP. You only need encryption for private information. CA public keys are not that. But you do need verifiable signatures.
It kind of makes sense opsec wise when you are on a network with adversaries though.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.
The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.
I partly blame Google and Mozilla for the HTTP hysteria.
You publicly demonize something long enough and otherwise intelligent people start believing HTTPS is a magic invisibility cloak or the Good Housekeeping seal of approval for the web.
It is a tool in the toolbox and nothing more. Wearing safety goggles while making spaghetti is equally stupid.
3rd party SDK requires TLS and it's not easy to bypass. Development contract doesn't allow long-term support where they can push updates if/when proper CA bundle changes.
Solution: ignore security in 1st party code outside 3rd party library that tries to prevent ignoring security.
As far as I know, most of this cheap crap is basically supply chain management companies that contract a factory to manufacturer and contract a software development/IoT/chip company to write software. Everything is waterfall-style locked in with no ongoing support or funding after the production run is done. The software company doesn't care insomuch as it "works" and working to the SCM company is "powers on and functions", not "is secure". As such, there's not much accountability. If the endeavour gets bad publicity, they just close up shop and spin up a new brand.
Similarly, how easy things are for more people to do. I'm certainly not advocating for pulling in a root CA over HTTP, but before LLMs could make this knowledge trivial, how many people would even think to look at that angle. It's democratizing in an interesting way.
It is an interesting thought experiment: what things happen once the inertia cost to seeing how something works collapses to 0 for even a small number of your user base. Smart companies might give in now and open up their app even if only as a read-only repo. Dumb ones won’t even know to consider it. And the huge middle will wind up getting new UX ideas for free.
As a data point here, the people from Ting electrical monitors should really contact me. I used their app for a few days and then built something way cooler off of it and managed to run down what was causing our high electrical usage (the well pump serving an out of control ice maker). You can’t do this at any fine-grained level, but the well pump’s electrical draw was very recognizable by just having the data logged to SQLite in real time from the Ting api and then telling Claude when the pump went on and off.
I remember when people were like LLMs write insecure code. Well, so does literally everyone apparently, Maybe that's where it learned it. I feel like that group has gotten a lot quieter lately.
Don't go hepa because it slows down the filtering too much. I use this technique in my house and it cuts down on pollen, smoke and mold. You'll feel a lot better than a tiny expensive hepa that has proprietary filters.
We've been doing the $9 Amazon Basics fan with a good filter since wildfire smoke started really getting bad in the bay area, quite a few years ago now. We had a couple of big, expensive filter tower things, and they helped, but just a couple of the boxfans with filters duct taped on quickly and consistently annihilated PM2.5 and PM10 in our apartments.
Most surprising thing: all but one of those original Amazon fans is still running. They've had years of run time, at quite a bit higher stress than normal.
True, but the MacGyver looking thing in the middle (or side,whatever) of your living room doesn't sit right with everyone. People pay money for aesthetics and take the hit on efficiency.
I'm seeing some 3d printed projects popping up that look to be filling this gap though.
That rules! Looks like you can do it with like 3 filters so it's more triangle shaped which makes sense. That's so stupidly simple too. Also aesthetically pretty cool - would look great in a workshop where it's like function first/don't hide the mechanism. And I feel like there's gotta be clever ways to incorporate something as simple as "box fan but the box is made of air filter" into like a coffee table or stand or something else clever? Probably you'd want to hide the filters inside if they look grimy before you actually need to replace them so you don't feel obligated to waste money by replacing too soon but sounds like a fun time to figure out how to integrate that in a hidden way into whatever's your vibe without looking jank
In my bachelor days I put an air filter behind a box fan; women have higher aesthetic standards. mirv 8 works fine for me and I can pick them up grocery shopping, but my primary contaminant is a sheprador.
I’m not dedicating 1600 cubic inches of my living space to an ugly homemade piece of furniture that I have to rebuild whenever I change a HEPA filter. I suspect I am not alone in this.
I was wondering when one of the low-end 20" box fan vendors would add a slot for a 20"x20" filter... and it turns out Lasko finally did, creating an "AirFlex 2-in-1" product that's often knocked for price/noise but resolves the homemade look, for those that care.
I just liberated my Haier AC units. The WIFI modules it came with but that I never used turned out to be ESP32's, with solder pads for rx/tx etc. I soldered on some wires, plugged into a USB ot UART dongle and Claude had ESPHome running in no time. I now can not only control the AC units, but I have a lot more visibility into wat it is doing: coil temps, gas temp, valve positions: all is available and all is logged now.
I also liberated my air purifier long ago by soldering a wire to the various buttons, so i can trigger a press the physical buttons from an esp32. And I soldered a wire to the PWM of the fan, so I can bypass whatever the onboard logic is doing. Liberating your own electronics is fun, and now with AI easier than ever. I also ditched the WIFI unit of my solar inverter and hooked up the tiniest ESP32 nanoC6 and now I get all the data at 1Hz. Still working on taking over the EcoFlow batteries and their charging/unloading logic.
It is great to see another cloud mandatory device set free. I noticed lately several such entries in HN and personally it is a good trend.
I am wondering how the big corporate will respond sooner or later. Because it is clear and they know that as well with the every rising capability of LLM more people will find ways to liberate their hardware from such unnecessary dependency and accept less the money drain.
I took a Vornado TRANSOM, a Broadlink RM4, and a Shelly Smart Plug, a Qingping Air Quality Monitor Gen 2 + claude and HASS, and now I have a fan that turns itself on when the CO2 level gets too high.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Nice! I have a similar setup. You might like the custom visualization or temperature and humidity offsets I’ve made for that air monitor. Its screen and battery cause excess heat to throw off readings and the calibration is rough from the factory, I used a cheap bluetooth govee thermo-hygrometer as reference to build a better cal curve.
Jeez. I've had a Coway for about eight years, such a good device that my whole perception was “good product == good company”. If I had known their IOT offering was such a POS I would think very differently.
That said, the non-wifi model works perfectly with a simple HomeKit compatible on/off plug, so all this work — despite being very, very cool — seems a little pointless?
Your central HVAC system is by far the best way to keep the air in your house clean. You can run the blower without heat/cool 24/7 without spending too much money. Most modern furnaces have variable speed ECM fan programs that slow down when no heating or cooling demand is present.
You can't install a true HEPA filter directly in a typical residential system, but you can have an HVAC tech install a bypass system in the air handler that would allow part of the air stream to be filtered via HEPA continuously. If you build the system (or house) from scratch and express your intentions to the HVAC contractor you could plausibly use direct HEPA filtration for 100% of airflow.
Based on personal experience, HEPA isn't even necessary when you're filtering that much air.
My house downwind of a freeway and a wilderness area, lots of nasty black tire dust mixed with allergens. It did not come with A/C. I had HEPA air purifiers around the house that I would leave in auto mode and they would run for a few hours a day based on the air quality.
Then I got central A/C installed with a standard 1" MERV 10 rated filter on the intake. Just running the blower for 10 minutes every hour is enough to keep the air quality in every room below the level where the air purifiers would kick on. I've given most of them away.
100%. Understanding your air quality is important, since it can vary greatly based on so many factors, some other ones can be location, home type (condo, house), occupant types (seniors, small humans), health conditions (allergies, etc), homes don't always share the same kind of air circulation.
HEPA is less important in most scenarios than "something that on a few passes will catch everything", which MERV-13 will do. Not all systems can handle the pressure drop of a MERV-13 but many can, and there are some pretty low-drop options out there if you search for them.
13 is better obv, but merv-8 is a great drop in for most systems, and it makes a huge difference. my system runs the fan for an hour every evening, and that also has been an improvement.
i have to do a major upgrade next month (30 year old gas furnace!) and i will need to do some research, but i would like to even ascend to true HEPA if it's feasible
Mismatched merv levels between some heating systems (ie., forced air) and what they were designed for can also create strain on the system and premature failures.
Also, in new homes, beware of undersized heating systems that will fail prematurely.
At least in summer/cooling mode, I think the fan blows some of the condensed water back in the air off the coil (instead of it dripping down the drain). I think it still dehumidifies, just not as efficiently. Not sure if that's what op meant
This is not a good choice for everyone. Before greatly increasing the load on you HVAC blower motor, make sure you first understand where it is, how old it is, and how inconvenienced you would be if it burned out.
Annoyingly, both Ecobee and (at least historically) Nest make controlling the fan independent of the heating and cooling hard. You have to enable either heating or cooling before being allowed to enable the fan. And you can't specify how long you want to run it for, but have to select one of a few options.
Could just bypass with esp32 and relay. I think you just need to close a 24v AC switch/relay unless you have a newer/more expensive communicating system (although then I don't think you'd have an Ecobee)
i have an ecobee and it was pretty simple to hit fan on even when system is off. this may be a limitation of your hvac system being exposed awkwardly through to ecobee. some systems have a "fan only" wire, which mine does. but my guest house is a much older system, and it is like yours.
I’m quite happy with my MedifyAir MA-125. Just mentioning it and the brand since I don’t see it often mentioned. I’ve had mine running for around 4 years continuously at this point. It feels good quality too and marked/sold as commercial, and since it’s quite large with a large fan, it’s quiet.
I have 2 Coway air purifiers, they have no cloud stuff. They work really well.
While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
It’s just a remote control. Why did the tv started coming with a remote control. It’s convenient.
Setting up almost never takes more than a few seconds for me. I have Apple home, it’s almost always scan a QR code, wait a few seconds for wifi and done.
What I like about IoT is the idea of hacking them :-). Of course I don't want connected devices running proprietary firmwares anywhere near my LAN.
Also one thing is that when a company sells an IoT device, maybe they mass produce it and it's cheap. Whereas if you wanted to build it yourself, it would be harder. Getting relatively good and cheap hardware and putting your own software on it is nice!
The article explains why: the author’s wife cranks it up for white noise while they sleep, and the author wanted to tie that into their existing “go to sleep” home automation.
>> Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
I just occasionally move them. I know it is working because the pre-filter needs cleaning often enough. Does it really need "monitoring"?
One of the nice things about air purifiers, unlike owning a boat or leaving a stove on, is that its never going to surprise you in a bad way. You don't need to really monitor anything, it will just purify some air. Do you really want to be bringing that under the umbrella of the stuff you monitor? Maybe this is an irreconcilable difference and we cannot see it the other person's way.
I wanted to do the same with Phillips air purifier that uses AWS IoT. Unfortunately, it seems the engineers did their job: an eMudhra-signed certificate was not accepted and the AWS endpoint also uses mTLS, so I wasn't able to MITM the connection.
Their ESP also uses Secure Boot... I don't know that there isn't a way to break in, but I wasn't able to find one short of hardware notification :/
I love how it has become a trend now to take some device that required a cloud subscription, reverse engineer it, then connect it to your own server you control.
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
Enjoy it while you can. You can see the AI companies have already started the process of locking us out of this, with Opus 5.5.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
Just use abliterated/uncensored self-hosted models. This is why we need them and the hardware to run them. Yes, the API models which will further close the walled gardens will evolve faster than the open-weights ones, but I'm hopeful about the community as a hole rejecting this status quo.
An RTX4090 or a 128gb macbook can generate a pretty reasonable number of tok/sec. Those are not cheap, but within the realm of serious hobbyist. I really hope the AI bubble deflates a bit so consumers can get more powerful hardware at the low thousand $ range.
The other problem is that the manufacturers can also use AI to improve their DRM and do red-teaming to fix "vulnerabilities" before release. Right now they're not because it actually takes some effort but eventually they'll be able to just tell their agents "make sure no unauthorized clients can connect". I expect that several years from now there will be a sizeable market for pre-2027 hackable devices.
Coway sells tons of devices with no smart/connected features. Their best-reviewed ones for home air purification are not connected. Everyone will be better served by supporting such product lines or pressuring companies to create them more than they will be by reverse engineering "connected" features no one ever needed.
Opus 5.5 will absolutely refuse to touch anti-cheat systems in video games, even when the end game isn't to cheat but to work on Linux compatibility or to bypass/spoof the checks to enable gameplay.
OpenAI and Anthropic models seem to be the most affected by these barriers, from my own experience.
Mistral, QWEN, and other models (read non-American) tend to have little to no restrictions. There were some tasks where I was actively trying to sabotage my own local network and Mistral had no issue helping. Anthropic and OpenAI refused outright or had to be "convinced" but would often hit further barricades along the way.
> So this only works on products that was developed before ~now.
You're under the assumption that the companies producing these give a shit about security. It'll probably increase a bit but I doubt it will be by much. If they have shipped devices that leave the doors wide open for almost any intrusion, they won't invest engineering/AI time and money to make these better than before and certainly won't review the code that the model spit out beyond a quick check if the promised base functionality still works.
Has anyone managed to pull this off with the Levoit air purifiers. I've isolated mine on a seperate VLAN at home but it requires internet connection to control.
For anyone considering getting an air purifier, please do not get a Coway (or similar brands).
The air purifier market is full of garbage because consumers don't understand how these products work or what their tradeoffs are.
The root problem is that these products are designed the wrong way around. They almost all use custom-fit HEPA filters. That sounds great, HEPA is good, right? Except HEPA is really not good for household air filtering. HEPA is so fine that even air struggles to move through it. It's also far more fine than the common contaminants (dust and pollen) need. Because it's so fine, you need a VERY powerful fan to move any air through it, which means the purifier will be very loud.
Finer filters are not better. There are two things you want to optimize for:
1: CADR - clean air delivery rate. This is essentially how much air you can move through the filter per hour, multiplied by how much of the contaminant you can catch each time that air passes through the filter.
2: Volume - It doesn't matter how amazing your air purifier is if it sounds like a tornado. If you only run it for a few minutes before getting annoyed, the purifier is not doing its job. Every moment it is OFF it is not doing its job. Many purifiers try to use sensors to determine when to run the filter, but this fundamentally a flawed approach and just means you have low quality air 99% of the time.
The solution to these problem is a less-fine filter. For dust and pollen, something like MERV13/14 is absolutely fine. It will catch most of those on each pass, and because air moves through it so much easier - you can run the same air through it many times more in the same period of time. This results in an air purifier that is whisper quiet, keeps the air far cleaner, and can use off-the-shelf furnace air filters that are VERY cheap compared to custom-fit HEPAs which may stop being made the moment that purifier product line inevitably ceases to exist. (Note: This is mainly true in the US, said filters are harder to find elsewhere)
Combine MERV13/14 with off-the-shelf PC case fans (which have been optimized for decades to be as quiet and long-lasting as possible) and the result is an easily-maintainable, quiet, highly-effective purifier.
NOTE: People dealing with VOCs/odors need an entirely different approach that HEPA won't really solve either, for that you need activated charcoal which will run out almost instantly in the amounts common purifiers come with. You need a gigantic block of the stuff to last more than a month or two.
Any resources you could share here? I bought a Rabbit air filter years ago and it seems like it does fine. But since I did something similar to the OP here and started tracking my Awair air quality monitor in real time, I’ve noticed we have wild VOC levels in our roomy house and I can’t sort out what causes spikes, especially overnight. Some of it is probably due to the insulating and weather stripping mania I went through a while back and I’ve looked into getting an exhaust fan (whatever those things are called) to alleviate it but would like to know the source(s).
It doesn't matter how amazing your air purifier is if it
sounds like a tornado. If you only run it for a few minutes
before getting annoyed, the purifier is not doing its job.
Top speed is about 53dB. The other speeds range from "barely noticeable" to "is this thing on?"
Combine MERV13/14 with off-the-shelf PC case fans (which
have been optimized for decades to be as quiet and long-lasting
as possible) and the result is an easily-maintainable, quiet,
highly-effective purifier.
More nonsense. My oldest Coways's been in service for ~10 years including ~5 years of services running 24/7/365 near my cat's litterbox.
For a given CFM, with all other things being equal, larger fans (like the ones in Coways) are going to be easier than a bunch of smaller fans. Though, if using an array of Noctuas or similar, I'm sure it could be done.
Many purifiers try to use sensors to determine when to
run the filter, but this fundamentally a flawed approach
and just means you have low quality air 99% of the time.
If you put the Coway on "Auto" and fart next to it, it will spin up to a higher speed for a few minutes. That seems like pretty good detection to me. You do get false positives though, sometimes it spins up for apparently no reason, so I usually just leave it on low.
The solution to these problem is a less-fine filter. For dust and
pollen, something like MERV13/14 is absolutely fine.
This is certainly true, though a lot of people buy these to help with pet allergies and want/need HEPA.
off-the-shelf furnace air filters that are VERY cheap compared to
custom-fit HEPAs which may stop being made the moment that purifier
product line inevitably ceases to exist.
Once again, you're making this stuff up. Now, it's a good point in general -- nobody should buy a rando air purifier without looking into this aspect. But have you actually taken 30 seconds to look on Amazon and noticed the dozens of third-party filters made to fit the Coways, which have been popular models sold essentially unchanged for 10+ years?
Admittedly, standard furnace air filters do have the edge here of course. Corsi-Rosenthal style boxes are going to give you guaranteed filter availability from now until the collapse of civilization. And if you're filtering air in a large or dirty space, then yes, Corsi-Rosenthal boxes are the winners in CADR-per-dollar. I'm building one for my garage workshop before pollen season....
I have a light with a controller on the cord: brightness up/down, power. I can't use a smart plug with it because it always defaults to off. Any ideas?
Cut the controller off and use the smart plug to control brightness. You might need to open it up and replace the power supply.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
All that to control one of 3 fan speeds. An extra slap in the face when it seems the motor used (at least in a similar model) appears to be continuously variable.
Unironically a gift. On your own home network, the one most likely to MITM you is yourself. And eMudhra's fuckup allows for a nice attack on a few devices you'd otherwise have to disassemble to pwn.
Yeah, I have a couple cheap Tuya devices you can't necessarily re-assemble easily once disassembled (IoT light bulbs, outlets that are plastic welded/glued). Pretty sure they use mqtt over tls
We need an Orthodox Union for IOT devices. Parev Kosher would be unlocked bootloader. Meat Kosher would be open source firmware . One level could be an escrow service for skittish companies, where escrow shares the firmware when the company terminates support.
It works in many other industries like UL for electronics, Intertek, NSF for foods etc.
Coway are some of the best, and there are many dumb models without internet access at all
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts
I am a simple man. When I see people buy devices with Zigbee, Z-Wave, or other fully local protocols, I nod. When I see people reward vendors that lock in with their money, I shake.
> Counterpoint: many vendors with lock-in use the price of the subscription and ads they show you to subsidize the device itself.
Vendors want to have their cake and eat it. They are no longer happy with a one-time sale, they want a continuous revenue stream. I have absolutely no qualms about buying "subsidized" devices and liberating them. I am not going to pay five times the price of a "smart TV" for a commercial display with worse specs when I can buy the consumer version and not connect it to the Internet or root it.
This isn't quite true. They are nearly always using subscriptions and ads to increase their profit margin. Enabling them to go from a low-margin hardware business into a high margin software service business. Even high-end brands like Wolf/ Sub-zero are low margin compared to a software services company. That is why every company is shifting their portfolio to this subscription/ ad model and not leaving any "unconnected" device models available in their line ups.
I think this is bad for customers. If every vendor does this, and regulators don't set regulations that balance the interests of companies with the interests of customers, than the only option people have are things like this.
> Counterpoint: many vendors with lock-in use the price of the subscription and ads they show you to subsidize the device itself.
What exactly is the subsidy here?
Is it that they plan to meet a bulk of their profit target after the sale, instead of frontloading the profit. The subsidy can be considered a 1000 dollars on a 200 dollar device if their target price is 1200 dollars.
It is only really subsidized if the device is actually sold below cost of BOM & essential software needed minus bloat. I'm skeptical that they are giving away hardware below cost based on potential profits.
They're not giving away the hardware. They're giving away a couple points of margin and making up for that after.
And with Amazon and other online shopping, consumer price sensitivity, and the ability to act on it, pressure is at an all-time high. There's a huge race to the bottom for all sorts of consumer goods.
Let's say total cost of manufacturing and distribution and service for the manufacturer is $50. Given two functionally identical products: if you were a layperson consumer, would you buy the product that costs 80 or would you buy the product that costs 100?
If the manufacturer can extract $20 of ad revenue from you, and you make the cheaper purchase up front, then it's win/win for the consumer (spent less), and the manufacturer (able to offer a lower price option and thus hopefully higher sales).
But what if the desire is not to harm some obnoxious company, but instead to reduce their influence in the market? But I agree generally, free any locked down device you happen to find yourself possessing.
I was challenging the assertion that buying and freeing is better than not engaging at all. I think the better comment would have been to indicate there is not likely a general rule. Devils and details and all that.
I want everyone, everywhere, to do this to TV manufacturers. Root them. Destroy their “smart” software.
There is no competition in the space anymore. Not on that. You either get crudded-up devices or a panel that doesn’t have the fundamental AV capabilities required of a living room TV.
Subsidizing products does not mean the consumer spends less.
Who pays for those ads/tracking/etc... companies that want to sell stuff to the consumer. Congratulations, subsidization just introduced more middlemen which extract more profit from the consumer.
The simpler things can be, the cheaper things can be.
The goal isn't to pay minimal money. If that was the goal, you strap an air filter to a box fan and use an esp32 to turn the power on and off. Or a solid state relay if you want to get fancy with different power levels.
The goal is to do harm to anti-consumer companies. Buying their (subsidized) hardware, and then breaking their lock-in so you and others aren't shown ads or forced to pay useless subscriptions, harms the company.
I don't believe that they subsidize hardware anymore.
Years ago, this was true. But today, selling your personal information isn't a loss leader. It's additional profit on top of the profit from the product.
It's not always that simple. I have a bunch of devices in my home that have WiFi IoT: bedroom AC, dehumidifier, refrigerator, and washer/dryer. I bought all of them regardless because they work fine without WiFi and I've never connected them. I'd love it if I could connect them to Home Assistant without data leaving my network. Reverse engineering them is on my list of future projects.
In the meantime they continue to function as "dumb" devices just fine.
I'm not sure that this ability to be firewalled is what keeps Homekit down. Inexpensive Matter devices abound that can also be firewalled from the internet, and never connected to it even once[1].
[1]: Yes, I know. There exists Matter-upgradeable widgets that must be connected to the Internet before becoming usable as Matter devices; send those back. I'm also aware that there's Matter devices that require Internet in order to be useful[2], but every instance I've seen of that is just something that was designed by a moron, imbecile, or idiot; send those back, too. Returns cost these companies money.
You want a router that will not let those wifi devices reach the internet or contact any other device on your network except allowed devices.
For any device that needs to connect to the internet, you want to be able to use dns and ip block lists at the very least.
These changes are on my todo list. Tvs especially need to be quarantined. They scan your network to datamine and try to report your conversations to the tv manufacturer.
The next step is root the tvs and clean off as much junk as possible.
Unfortunately some classes of devices have only those pesky proprietary and closed firmwares. I'm generally with you but nowadays with LLMs it's probably less effort to free up that specific IoT WiFi only device that finding a ZigBee version of it.
How do you feel about Matter [1]? Asking as someone all in on Home Assistant, open local protocols, and ready to reverse engineer and spend whatever is needed for digital sovereignty, for both myself and the community.
In my experience, Matter is okay except that it’s built over IP and manufacturers seem to be unable to resist using that juicy IP connection to talk to the Internet.
Thread should not have allowed Internet connectivity by default.
(Not the OP, but want to spread awareness, sorry.) The Wikipedia page already lists the greatest disadvantage:
> (..) the ability to commission a finished product into a Matter network in the field mandates certification and membership fees, entailing both one-time, recurring, and per-product costs. This is enforced using a public key infrastructure (PKI) and so-called device attestation certificates.
Matter is designed to necessitate phoning into the internet for certification, which allows all manufacturers to just easily add-in phoning into the internet for telemetry. Furthermore, it does not define exactly which functionality must remain if a device is disconnected from the internet for a long time (assuming the user is trying to avoid sending out telemetry, not even bypassing certification).
> The Matter devices (a smart bulb or a sensor) have no Internet access required by the spec, and no way to send telemetry to the Internet.
That's a little disingenuous... All Matter-over-WiFi devices inherently have Internet access unless you're blocking it through router policy, and most Matter-over-Thread border routers commercially available today give Thread devices Internet access by default if they want it (to avoid this you need to self-host your own OTBR instance).
I am a simple man. I don't buy smart devices, mostly. Offline only is completely acceptable.
The connected home was an idealistic dream that has been made perverse by the Zucks and Elons of the world. It is not accessible for normal people and it might never be - at least, not without the blood sacrifice of your privacy.
What I don’t like about Zigbee though is that it is on the Wifi band so every device with wifi antenna can snoop on it. Even assuming the protocol is secure, anyone can infer patterns and devices based on traffic shape. For example, a motion sensor that sends data whenever someone walks by. In the end, nothing beats physical wires in terms of privacy and reliability if I understand correctly.
The other fun thing about them is because they talk Wi-Fi frequencies, if you break into them they can also be reprogrammed to act like a hotspot, or start commanding _other_ devices.
So if you send a drone up the side of an office building to the executives floor, and can break into one lightbulb wirelessly, you can then make that lightbulb break into all the other lightbulbs, until you reach the secluded inner rooms, and you can make that lightbulb listen for Wi-Fi traffic and can pretend to be a hotspot for the targetted executive's laptop. Like in the movies!
I (with heavy LLM help) recently R.E. a golf cart motor controller which had a USB interface for programming, but only a crappy proprietary windows application, and it was super satisfying to see it hum attached to Linux.
What would be even more satisfying to see would be companies that were chill about this kind of work, instead of sending[1] legal threats[2] to people doing the work that they should be doing in the first place.
In the larger picture, it's because the tech industry started packaging every imaginable piece of hardware as a loss leader for subscription services. That's a big reason why it's really hard to get a high quality dumb TV.
Hopefully, hopefully this new trend can break the cycle of using software to turn things into subscription services that should never be subscription services. I'm terrified that manufactures will respond with hardware encryption and legal maneuvering, but perhaps by then there will be an even larger and thriving ecosystem of open hardware as the ease of setting it up and integrating it with AI accelerates its adoption.
Sometimes manufacturers bake in the expected revenue from snooping into the price of the device. That can lead to better hardware at cheaper prices, that then you can liberate and use offline.
I used to have a small counter-top dishwasher that relied on proprietary soap cartridges. The dishwasher itself was fairly good and effective, and after hacking the cartridges to allow them to be refilled the overall price was quite acceptable!
I don't mind the app functionality of my air purifier. I get a push notification when air quality degrades, and I can see data and charts of air quality over time. I can change the settings remotely, which is nice because I have a small child and keep the "lock" function set for the actual controls.
It's easier to setup and maintain schedules, routines, or more complex functionality.
It's certainly not critical functionality, but it's nice. Same with my laundry machine and dryer sending a push notification when the cycle ends. Unnecessary, but nice.
> It's easier to setup and maintain schedules, routines, or more complex functionality.
Complex like wanting to hit the "Good night" button in Apple Home and have it turn the purifier to full blast for white noise, the workflow in TFA that wasn't possible with the app experience?
It's one of those things quite interesting to see the difference in response from one consumer to another. I can't stand the washer/dryer notifications and finally turned them off a few weeks ago. Especially when I'm on the road half the time, why should I care my wife did 8 loads of laundry in a day? When I'm home, the chime is enough to hear from the other room anyway and the notification on the phone usually just backlogs and gives me a load of red badges I need to clear at the end and beginning of every day for notifications I didn't even get because the phone wasn't with me and I changed the laundry anyway.
For an air purifier, I feel like I'd probably want to see outcome-level statistics convincing me it actually matters to lifespan, healthspan, quality of life, something, anything at all, to know and adjust minute-by-minute the exact air quality going through a purifier, or for that matter what the purifier is able to detect even reflects the quality of air elsewhere in a house with a whole lot of air volume not going through that purifier very regularly.
I really can't understand why the hell these manufacturers don't just provide open source firmware. Nobody is buying a Conway purifier for the software and there are no trade secrets there.
> The fan downloads its root CA cert over plain HTTP. It was always MitM-able.
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
"The fan downloads its root CA cert over plain HTTP"
Would love to understand the decision-making behind this at Coway (or their firmware contractor). Anyone care to guess why someone would make this choice?
Hardware companies by and large don't get software. They just don't understand it. Their world is sourcing parts and assembly and packaging. They look at software like any other line item in the BOM: Like a screw or gasket. You source it from the cheapest supplier, and spoon it onto the product somewhere on the assembly line. These companies simply don't care about their software, and their requirements to their supplier amount to "make something work." The quality bar is literally "customer should not return the product."
> Anyone care to guess why someone would make this choice?
My guess: At some point in the past, a firmware was developed without plans to include firmware update functionality. The team that did this was later burned when the client tried to use a new certificate that the hardcoded, unchangeable system didn't recognize.
Angry meetings occurred, developers were chastised, and someone realized they could avoid that problem by fetching an updated root CA on demand. They did it over HTTP to avoid a chicken and egg problem.
In hardware manufacturing, everything is about crossing items off the list of problems. A problem was raised, someone came up with an idea to solve that problem, and it was implemented. The practice might have spread to other products because it became institutional knowledge about how to avoid a problem that made a customer angry once.
This is from my experience in the consumer hardware industry. If you're not watching the outsourced development closely, they will take the easiest route to solve the problem in front of them and nobody will consider any other consequences.
Everyone (including the author) is as per usual focused on the wrong thing.
There is nothing wrong with downloading a certificate over HTTP. In fact, that's how PKI is designed and if you look at the AIA field of this very site you will see the certificate chain is meant to be served over HTTP.
What IS wrong is implicitly trusting an untrusted certificate. Whether it came over HTTPS or HTTP is irrelevant. But no one is talking about that.
I'm more puzzled why someone would buy a complicated IoT purifier for a drafty Bay Area house that probably has knob and tube wiring.
My most reliable air purifiers have a dumb, physical on/off switch. I bought them deliberately for that feature.
People don’t understand things and act shocked when they learn apt and Steam packages are downloaded over HTTP. You only need encryption for private information. CA public keys are not that. But you do need verifiable signatures.
It kind of makes sense opsec wise when you are on a network with adversaries though.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.
But we're talking about an air filter, not a production server.
I'm all for Air Filters using HTTP!
The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.
> fingerprint and target services
Or they could connect to the service.
> Server validation would have prevented that
No it wouldn't have. HTTPS does not ensure a server's contents are trustworthy.
> And before you come at me with I should be using a VPN to protect against these scenarios, I do that already
So you protect yourself from unlikely, irrelevant threats by... deliberately paying strangers to MiTM your traffic?
I partly blame Google and Mozilla for the HTTP hysteria.
You publicly demonize something long enough and otherwise intelligent people start believing HTTPS is a magic invisibility cloak or the Good Housekeeping seal of approval for the web.
It is a tool in the toolbox and nothing more. Wearing safety goggles while making spaghetti is equally stupid.
Probably something like “What if the cert expires?”
3rd party SDK requires TLS and it's not easy to bypass. Development contract doesn't allow long-term support where they can push updates if/when proper CA bundle changes.
Solution: ignore security in 1st party code outside 3rd party library that tries to prevent ignoring security.
As far as I know, most of this cheap crap is basically supply chain management companies that contract a factory to manufacturer and contract a software development/IoT/chip company to write software. Everything is waterfall-style locked in with no ongoing support or funding after the production run is done. The software company doesn't care insomuch as it "works" and working to the SCM company is "powers on and functions", not "is secure". As such, there's not much accountability. If the endeavour gets bad publicity, they just close up shop and spin up a new brand.
Control and $
Similarly, how easy things are for more people to do. I'm certainly not advocating for pulling in a root CA over HTTP, but before LLMs could make this knowledge trivial, how many people would even think to look at that angle. It's democratizing in an interesting way.
It is an interesting thought experiment: what things happen once the inertia cost to seeing how something works collapses to 0 for even a small number of your user base. Smart companies might give in now and open up their app even if only as a read-only repo. Dumb ones won’t even know to consider it. And the huge middle will wind up getting new UX ideas for free.
As a data point here, the people from Ting electrical monitors should really contact me. I used their app for a few days and then built something way cooler off of it and managed to run down what was causing our high electrical usage (the well pump serving an out of control ice maker). You can’t do this at any fine-grained level, but the well pump’s electrical draw was very recognizable by just having the data logged to SQLite in real time from the Ting api and then telling Claude when the pump went on and off.
EtA: I built a skill for it https://github.com/tclancy/ai-tooling/blob/main/skills/diagn...
I remember when people were like LLMs write insecure code. Well, so does literally everyone apparently, Maybe that's where it learned it. I feel like that group has gotten a lot quieter lately.
This works better than all of the hepa purifiers on the market:
This is still expensive but the amount of air processing per hour is incredible.More info Search "Corsi-Rosenthal Box" or click https://filterbuy.com/resources/air-filter-basics/how-to-bui...
Don't go hepa because it slows down the filtering too much. I use this technique in my house and it cuts down on pollen, smoke and mold. You'll feel a lot better than a tiny expensive hepa that has proprietary filters.
We've been doing the $9 Amazon Basics fan with a good filter since wildfire smoke started really getting bad in the bay area, quite a few years ago now. We had a couple of big, expensive filter tower things, and they helped, but just a couple of the boxfans with filters duct taped on quickly and consistently annihilated PM2.5 and PM10 in our apartments.
Most surprising thing: all but one of those original Amazon fans is still running. They've had years of run time, at quite a bit higher stress than normal.
True, but the MacGyver looking thing in the middle (or side,whatever) of your living room doesn't sit right with everyone. People pay money for aesthetics and take the hit on efficiency.
I'm seeing some 3d printed projects popping up that look to be filling this gap though.
I agree on principle. There are iterations on this concept that are much quieter, are visually more palatable, and still have high airflow.
Example: https://www.cleanairkits.com/products/luggable-ultra-air-pur...
But that one costs $400, for that money you can buy a commercial / professional / design filter too. The Corsi-Rosenthal one is <$100.
If volume is a problem, I'm sure one can lower the fan speed below the lowest setting with some electronics knowledge.
That rules! Looks like you can do it with like 3 filters so it's more triangle shaped which makes sense. That's so stupidly simple too. Also aesthetically pretty cool - would look great in a workshop where it's like function first/don't hide the mechanism. And I feel like there's gotta be clever ways to incorporate something as simple as "box fan but the box is made of air filter" into like a coffee table or stand or something else clever? Probably you'd want to hide the filters inside if they look grimy before you actually need to replace them so you don't feel obligated to waste money by replacing too soon but sounds like a fun time to figure out how to integrate that in a hidden way into whatever's your vibe without looking jank
In my bachelor days I put an air filter behind a box fan; women have higher aesthetic standards. mirv 8 works fine for me and I can pick them up grocery shopping, but my primary contaminant is a sheprador.
What is the advantage of this over just sticking a merv13 in your HVAC and running the fan for 15minutes every hour? (assuming it's rated for merv13)
You can drop a boxfan-filter combo anywhere, even where there's no forced-air HVAC.
I’m not dedicating 1600 cubic inches of my living space to an ugly homemade piece of furniture that I have to rebuild whenever I change a HEPA filter. I suspect I am not alone in this.
I was wondering when one of the low-end 20" box fan vendors would add a slot for a 20"x20" filter... and it turns out Lasko finally did, creating an "AirFlex 2-in-1" product that's often knocked for price/noise but resolves the homemade look, for those that care.
I would build one but I live in Argentina and I have no idea where to get any of the components.
Everyone wants the sound of a box fan and the looks of duct taped cardboard sitting in their living room...
My brother in law did this. It is boxy and ugly, but damn does it work.
You can take it with you when your wife kicks you out of the house for making something so stupidly ugly even if its functional.
I just liberated my Haier AC units. The WIFI modules it came with but that I never used turned out to be ESP32's, with solder pads for rx/tx etc. I soldered on some wires, plugged into a USB ot UART dongle and Claude had ESPHome running in no time. I now can not only control the AC units, but I have a lot more visibility into wat it is doing: coil temps, gas temp, valve positions: all is available and all is logged now. I also liberated my air purifier long ago by soldering a wire to the various buttons, so i can trigger a press the physical buttons from an esp32. And I soldered a wire to the PWM of the fan, so I can bypass whatever the onboard logic is doing. Liberating your own electronics is fun, and now with AI easier than ever. I also ditched the WIFI unit of my solar inverter and hooked up the tiniest ESP32 nanoC6 and now I get all the data at 1Hz. Still working on taking over the EcoFlow batteries and their charging/unloading logic.
Related, don't know if it would have worked with your system https://cloudfree.shop/products/ductless-hvac-wi-fi-module
It is great to see another cloud mandatory device set free. I noticed lately several such entries in HN and personally it is a good trend.
I am wondering how the big corporate will respond sooner or later. Because it is clear and they know that as well with the every rising capability of LLM more people will find ways to liberate their hardware from such unnecessary dependency and accept less the money drain.
It's so few hobbyists doing this that I doubt they care. Awesome for us though!
I took a Vornado TRANSOM, a Broadlink RM4, and a Shelly Smart Plug, a Qingping Air Quality Monitor Gen 2 + claude and HASS, and now I have a fan that turns itself on when the CO2 level gets too high.
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Small world, just submitted PRs to add Vornado Strata 433mhz decoder to rtl_sdr :)
Need to try to get Sonoff bridge rigged up next but have been busy messing with Hatch alarm
Nice! I have a similar setup. You might like the custom visualization or temperature and humidity offsets I’ve made for that air monitor. Its screen and battery cause excess heat to throw off readings and the calibration is rough from the factory, I used a cheap bluetooth govee thermo-hygrometer as reference to build a better cal curve.
Jeez. I've had a Coway for about eight years, such a good device that my whole perception was “good product == good company”. If I had known their IOT offering was such a POS I would think very differently.
That said, the non-wifi model works perfectly with a simple HomeKit compatible on/off plug, so all this work — despite being very, very cool — seems a little pointless?
Can't crank up the fan with an on/off plug.
An honest question - is the privacy trade off for such a minor convenience worth it?
Your central HVAC system is by far the best way to keep the air in your house clean. You can run the blower without heat/cool 24/7 without spending too much money. Most modern furnaces have variable speed ECM fan programs that slow down when no heating or cooling demand is present.
You can't install a true HEPA filter directly in a typical residential system, but you can have an HVAC tech install a bypass system in the air handler that would allow part of the air stream to be filtered via HEPA continuously. If you build the system (or house) from scratch and express your intentions to the HVAC contractor you could plausibly use direct HEPA filtration for 100% of airflow.
https://www.lennoxpros.com/healthy-climate-hepa-60-bypass-ai...
Based on personal experience, HEPA isn't even necessary when you're filtering that much air.
My house downwind of a freeway and a wilderness area, lots of nasty black tire dust mixed with allergens. It did not come with A/C. I had HEPA air purifiers around the house that I would leave in auto mode and they would run for a few hours a day based on the air quality.
Then I got central A/C installed with a standard 1" MERV 10 rated filter on the intake. Just running the blower for 10 minutes every hour is enough to keep the air quality in every room below the level where the air purifiers would kick on. I've given most of them away.
100%. Understanding your air quality is important, since it can vary greatly based on so many factors, some other ones can be location, home type (condo, house), occupant types (seniors, small humans), health conditions (allergies, etc), homes don't always share the same kind of air circulation.
HEPA is less important in most scenarios than "something that on a few passes will catch everything", which MERV-13 will do. Not all systems can handle the pressure drop of a MERV-13 but many can, and there are some pretty low-drop options out there if you search for them.
13 is better obv, but merv-8 is a great drop in for most systems, and it makes a huge difference. my system runs the fan for an hour every evening, and that also has been an improvement.
i have to do a major upgrade next month (30 year old gas furnace!) and i will need to do some research, but i would like to even ascend to true HEPA if it's feasible
Mismatched merv levels between some heating systems (ie., forced air) and what they were designed for can also create strain on the system and premature failures.
Also, in new homes, beware of undersized heating systems that will fail prematurely.
There is at least one big downside to running the fan 24/7: you lose out on humidity control.
Why?
At least in summer/cooling mode, I think the fan blows some of the condensed water back in the air off the coil (instead of it dripping down the drain). I think it still dehumidifies, just not as efficiently. Not sure if that's what op meant
We don't have central air in our new home and man oh man does it get dustier. I did not appreciate the power of those cardboard filters.
This is not a good choice for everyone. Before greatly increasing the load on you HVAC blower motor, make sure you first understand where it is, how old it is, and how inconvenienced you would be if it burned out.
Annoyingly, both Ecobee and (at least historically) Nest make controlling the fan independent of the heating and cooling hard. You have to enable either heating or cooling before being allowed to enable the fan. And you can't specify how long you want to run it for, but have to select one of a few options.
Could just bypass with esp32 and relay. I think you just need to close a 24v AC switch/relay unless you have a newer/more expensive communicating system (although then I don't think you'd have an Ecobee)
i have an ecobee and it was pretty simple to hit fan on even when system is off. this may be a limitation of your hvac system being exposed awkwardly through to ecobee. some systems have a "fan only" wire, which mine does. but my guest house is a much older system, and it is like yours.
I’m quite happy with my MedifyAir MA-125. Just mentioning it and the brand since I don’t see it often mentioned. I’ve had mine running for around 4 years continuously at this point. It feels good quality too and marked/sold as commercial, and since it’s quite large with a large fan, it’s quiet.
I have 2 Coway air purifiers, they have no cloud stuff. They work really well.
While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
It’s just a remote control. Why did the tv started coming with a remote control. It’s convenient.
Setting up almost never takes more than a few seconds for me. I have Apple home, it’s almost always scan a QR code, wait a few seconds for wifi and done.
Also it’s fun to mess with.
> I'm against a lot of smart home things
What I like about IoT is the idea of hacking them :-). Of course I don't want connected devices running proprietary firmwares anywhere near my LAN.
Also one thing is that when a company sells an IoT device, maybe they mass produce it and it's cheap. Whereas if you wanted to build it yourself, it would be harder. Getting relatively good and cheap hardware and putting your own software on it is nice!
The article explains why: the author’s wife cranks it up for white noise while they sleep, and the author wanted to tie that into their existing “go to sleep” home automation.
>> Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
I just occasionally move them. I know it is working because the pre-filter needs cleaning often enough. Does it really need "monitoring"?
One of the nice things about air purifiers, unlike owning a boat or leaving a stove on, is that its never going to surprise you in a bad way. You don't need to really monitor anything, it will just purify some air. Do you really want to be bringing that under the umbrella of the stuff you monitor? Maybe this is an irreconcilable difference and we cannot see it the other person's way.
I misread this headline and now I want a Cowsay air purifier.
/ Your reasoning is excellent -- it's \
| only your basic assumptions that are |
\ wrong. /
--------------------------------------
I wanted to do the same with Phillips air purifier that uses AWS IoT. Unfortunately, it seems the engineers did their job: an eMudhra-signed certificate was not accepted and the AWS endpoint also uses mTLS, so I wasn't able to MITM the connection.
Their ESP also uses Secure Boot... I don't know that there isn't a way to break in, but I wasn't able to find one short of hardware notification :/
I love how it has become a trend now to take some device that required a cloud subscription, reverse engineer it, then connect it to your own server you control.
Suddenly there are so many products to play with that would have previously been undesirable! This is one of the good things AI has enabled.
Enjoy it while you can. You can see the AI companies have already started the process of locking us out of this, with Opus 5.5.
God forbid our fans, our fans of all things, might be broken of their dependencies on the internet. The plebians can't be allowed to do that. Every relay must be cloud-connected so it can be monetized and disabled for whatever dumb ass reasons someone might want to disable it.
Just use abliterated/uncensored self-hosted models. This is why we need them and the hardware to run them. Yes, the API models which will further close the walled gardens will evolve faster than the open-weights ones, but I'm hopeful about the community as a hole rejecting this status quo.
Is there hardware you would suggest that you can actually buy today? Pricing is out of control right now, if you can even find stock.
An RTX4090 or a 128gb macbook can generate a pretty reasonable number of tok/sec. Those are not cheap, but within the realm of serious hobbyist. I really hope the AI bubble deflates a bit so consumers can get more powerful hardware at the low thousand $ range.
The other problem is that the manufacturers can also use AI to improve their DRM and do red-teaming to fix "vulnerabilities" before release. Right now they're not because it actually takes some effort but eventually they'll be able to just tell their agents "make sure no unauthorized clients can connect". I expect that several years from now there will be a sizeable market for pre-2027 hackable devices.
Coway sells tons of devices with no smart/connected features. Their best-reviewed ones for home air purification are not connected. Everyone will be better served by supporting such product lines or pressuring companies to create them more than they will be by reverse engineering "connected" features no one ever needed.
> locking us out of this, with Opus 5.5
I hear this a lot but I've never hit this.
For weeks now I've been working on a shared recompilation project of Switch 1 and 2 games, and Opus 5.5 has handled that with no issue.
Over 10 supported Switch 1 games, and 3 supported Switch 2 games, and never once has Opus 5.5 denied anything
> I hear this a lot but I've never hit this.
Opus 5.5 will absolutely refuse to touch anti-cheat systems in video games, even when the end game isn't to cheat but to work on Linux compatibility or to bypass/spoof the checks to enable gameplay.
OpenAI and Anthropic models seem to be the most affected by these barriers, from my own experience.
Mistral, QWEN, and other models (read non-American) tend to have little to no restrictions. There were some tasks where I was actively trying to sabotage my own local network and Mistral had no issue helping. Anthropic and OpenAI refused outright or had to be "convinced" but would often hit further barricades along the way.
Sure but as easy it is to hack these devices as easy it is to harden it.
So this only works on products that was developed before ~now.
The solution is to not buy crap regardless if you can make it work or not.
> So this only works on products that was developed before ~now.
You're under the assumption that the companies producing these give a shit about security. It'll probably increase a bit but I doubt it will be by much. If they have shipped devices that leave the doors wide open for almost any intrusion, they won't invest engineering/AI time and money to make these better than before and certainly won't review the code that the model spit out beyond a quick check if the promised base functionality still works.
I'm not. But no AI will produce anything that is as bad as the state of current products.
> So this only works on products that was developed before ~now.
The Home Assistant hackers are some of the most persistent reverse engineers that I have seen. Almost as much as game crackers and cheat developers.
Apparently there's a website which already addresses your concerns about fans - nothing else - only fans.
at least current models are safe, glm is very capable in terms of RE
Has anyone managed to pull this off with the Levoit air purifiers. I've isolated mine on a seperate VLAN at home but it requires internet connection to control.
I'm guessing here that the Apple Home app and integration are all local, not using Apple's Home cloud?
Corsi-Rosenthal box is way cheaper and only connects to the 60hz.
A CR box certainly has its place, but for many people that place just isn't in their nicely decorated home.
This gauche air filter doesn't even have an app smh
For anyone considering getting an air purifier, please do not get a Coway (or similar brands).
The air purifier market is full of garbage because consumers don't understand how these products work or what their tradeoffs are.
The root problem is that these products are designed the wrong way around. They almost all use custom-fit HEPA filters. That sounds great, HEPA is good, right? Except HEPA is really not good for household air filtering. HEPA is so fine that even air struggles to move through it. It's also far more fine than the common contaminants (dust and pollen) need. Because it's so fine, you need a VERY powerful fan to move any air through it, which means the purifier will be very loud.
Finer filters are not better. There are two things you want to optimize for:
1: CADR - clean air delivery rate. This is essentially how much air you can move through the filter per hour, multiplied by how much of the contaminant you can catch each time that air passes through the filter.
2: Volume - It doesn't matter how amazing your air purifier is if it sounds like a tornado. If you only run it for a few minutes before getting annoyed, the purifier is not doing its job. Every moment it is OFF it is not doing its job. Many purifiers try to use sensors to determine when to run the filter, but this fundamentally a flawed approach and just means you have low quality air 99% of the time.
The solution to these problem is a less-fine filter. For dust and pollen, something like MERV13/14 is absolutely fine. It will catch most of those on each pass, and because air moves through it so much easier - you can run the same air through it many times more in the same period of time. This results in an air purifier that is whisper quiet, keeps the air far cleaner, and can use off-the-shelf furnace air filters that are VERY cheap compared to custom-fit HEPAs which may stop being made the moment that purifier product line inevitably ceases to exist. (Note: This is mainly true in the US, said filters are harder to find elsewhere)
Combine MERV13/14 with off-the-shelf PC case fans (which have been optimized for decades to be as quiet and long-lasting as possible) and the result is an easily-maintainable, quiet, highly-effective purifier.
NOTE: People dealing with VOCs/odors need an entirely different approach that HEPA won't really solve either, for that you need activated charcoal which will run out almost instantly in the amounts common purifiers come with. You need a gigantic block of the stuff to last more than a month or two.
Any resources you could share here? I bought a Rabbit air filter years ago and it seems like it does fine. But since I did something similar to the OP here and started tracking my Awair air quality monitor in real time, I’ve noticed we have wild VOC levels in our roomy house and I can’t sort out what causes spikes, especially overnight. Some of it is probably due to the insulating and weather stripping mania I went through a while back and I’ve looked into getting an exhaust fan (whatever those things are called) to alleviate it but would like to know the source(s).
Thank you for this. I've been looking into buying air filters and would have made this mistake. (HEPA sounds good!)
I'm confused by your dust and pollen comment. What about PM2.5, is this mostly dust or are you not that concerned about this vs dust?
This is very helpful. Thank you.
Are there any example builds you could point me towards?
I use CleanAirKits, but you could build your for far less if you prefer.
Corsi-Rosenthal Box is probably the premier DIY
https://en.wikipedia.org/wiki/Corsi%E2%80%93Rosenthal_Box
I don't think I've ever said this on HN, but: delete your post. It's nonsense.
You've never used one. These Coways are known for pleasant sound and quiet operation."For a purifier of its capabilities, the Mighty is notably quiet" - https://www.nytimes.com/wirecutter/reviews/best-air-purifier...
Alternatively, just take a glance at the ~30K reviews on Amazon. - https://www.amazon.com/dp/B01728NLRG
Top speed is about 53dB. The other speeds range from "barely noticeable" to "is this thing on?" More nonsense. My oldest Coways's been in service for ~10 years including ~5 years of services running 24/7/365 near my cat's litterbox.For a given CFM, with all other things being equal, larger fans (like the ones in Coways) are going to be easier than a bunch of smaller fans. Though, if using an array of Noctuas or similar, I'm sure it could be done.
If you put the Coway on "Auto" and fart next to it, it will spin up to a higher speed for a few minutes. That seems like pretty good detection to me. You do get false positives though, sometimes it spins up for apparently no reason, so I usually just leave it on low. This is certainly true, though a lot of people buy these to help with pet allergies and want/need HEPA. Once again, you're making this stuff up. Now, it's a good point in general -- nobody should buy a rando air purifier without looking into this aspect. But have you actually taken 30 seconds to look on Amazon and noticed the dozens of third-party filters made to fit the Coways, which have been popular models sold essentially unchanged for 10+ years?Admittedly, standard furnace air filters do have the edge here of course. Corsi-Rosenthal style boxes are going to give you guaranteed filter availability from now until the collapse of civilization. And if you're filtering air in a large or dirty space, then yes, Corsi-Rosenthal boxes are the winners in CADR-per-dollar. I'm building one for my garage workshop before pollen season....
I have a light with a controller on the cord: brightness up/down, power. I can't use a smart plug with it because it always defaults to off. Any ideas?
Cut the controller off and use the smart plug to control brightness. You might need to open it up and replace the power supply.
I'm going to guess that you will spend more money on this than just buying a light that has smart features compatible with your smart home ecosystem. You can't mix two smart systems on one cord - this has never worked. Where to put the smart is a tricky question as there are pros and cons to every answer, but in general the smarts need to be in exactly one place or things won't work.
How would one control brightness via a smart plug?!
Smart outlets that support dimming. You also need a dimmable bulb, but these are generic and cheap compared to a smart bulb.
turn it on/off really fast
The relay clicking is a feature so you can tell the brightness audibly :)
I can't express how happy stuff like this makes me.
its a bummer how gimped claude models have become for research like this
All that to control one of 3 fan speeds. An extra slap in the face when it seems the motor used (at least in a similar model) appears to be continuously variable.
https://github.com/device-teardowns/coway-ap1512hh
This one yeets in a CA insecurely but eMudhra has been a gift for any that bake the CA--especially the abandonware unlikely to ever get patched.
Unironically a gift. On your own home network, the one most likely to MITM you is yourself. And eMudhra's fuckup allows for a nice attack on a few devices you'd otherwise have to disassemble to pwn.
Yeah, I have a couple cheap Tuya devices you can't necessarily re-assemble easily once disassembled (IoT light bulbs, outlets that are plastic welded/glued). Pretty sure they use mqtt over tls
If a company "banned" me from my ability to use the product I bought, that product would move swiftly to a skip-fire.
Air purifiers need an Internet connection in case someone invents a new kind of air.[1]
[1] https://xkcd.com/3109/
We need an Orthodox Union for IOT devices. Parev Kosher would be unlocked bootloader. Meat Kosher would be open source firmware . One level could be an escrow service for skittish companies, where escrow shares the firmware when the company terminates support.
It works in many other industries like UL for electronics, Intertek, NSF for foods etc.
Anyone know how to permanently disable the ionizer feature on these fans? I hate that it has this feature which is hazardous to health.
On topic, can you recommend a good air purifier to run in the office? 500 sq ft?
I am tired of having dust everywhere.
Coway are some of the best, and there are many dumb models without internet access at all
If you don't mind the hum of fans, it's hard to beat a Corsi-Rosenthal box... there are kits from cleanairkits.com or cybernightmarket.com to build quiet PC fan based boxes that in my experience work excellent and can use off-the shelf filters and parts
I have a dumb model (1512HH) and it’s excellent.
a box fan and a furnace filter.
It works really well and even more - it works better than any purifier even if you just duct-tape the filter you have to a box fan.
To people who think this is a joke, it isn't: https://en.wikipedia.org/wiki/Corsi%E2%80%93Rosenthal_Box
i truly wish these things were not smart in the first place
Will be interesting to see how things go in a few years when companies start rolling out devices where the software was built by LLMs
It will unfortunately be a lot harder to free those devices
ChatGPT will allow you to do this interactively then ban you a few days later. Good luck OP.
I've reverse engineered and jailbroken a few devices I own using OpenCode & an OpenAI subscription. No bans yet.
We need a frontier to explore and exploit. Without it we turn inward, trying to chisel another 0.1% off each other.
Some kind of final frontier, perhaps?
I'm a simple man. I see people freeing their devices from proprietary clouds and reclaiming ownership, I upvote.
I am a simple man. When I see people buy devices with Zigbee, Z-Wave, or other fully local protocols, I nod. When I see people reward vendors that lock in with their money, I shake.
Counterpoint: many vendors with lock-in use the price of the subscription and ads they show you to subsidize the device itself.
By buying the device and then breaking the lock-in, one does more harm to the anti-consumer device manufacturer than had they done nothing at all.
It's a fan, filter, and a case with a small PCB + sensors. They are absolutely selling these at a good profit margin.
> Counterpoint: many vendors with lock-in use the price of the subscription and ads they show you to subsidize the device itself.
Vendors want to have their cake and eat it. They are no longer happy with a one-time sale, they want a continuous revenue stream. I have absolutely no qualms about buying "subsidized" devices and liberating them. I am not going to pay five times the price of a "smart TV" for a commercial display with worse specs when I can buy the consumer version and not connect it to the Internet or root it.
This isn't quite true. They are nearly always using subscriptions and ads to increase their profit margin. Enabling them to go from a low-margin hardware business into a high margin software service business. Even high-end brands like Wolf/ Sub-zero are low margin compared to a software services company. That is why every company is shifting their portfolio to this subscription/ ad model and not leaving any "unconnected" device models available in their line ups.
I think this is bad for customers. If every vendor does this, and regulators don't set regulations that balance the interests of companies with the interests of customers, than the only option people have are things like this.
> Counterpoint: many vendors with lock-in use the price of the subscription and ads they show you to subsidize the device itself.
What exactly is the subsidy here?
Is it that they plan to meet a bulk of their profit target after the sale, instead of frontloading the profit. The subsidy can be considered a 1000 dollars on a 200 dollar device if their target price is 1200 dollars.
It is only really subsidized if the device is actually sold below cost of BOM & essential software needed minus bloat. I'm skeptical that they are giving away hardware below cost based on potential profits.
They're not giving away the hardware. They're giving away a couple points of margin and making up for that after.
And with Amazon and other online shopping, consumer price sensitivity, and the ability to act on it, pressure is at an all-time high. There's a huge race to the bottom for all sorts of consumer goods.
Let's say total cost of manufacturing and distribution and service for the manufacturer is $50. Given two functionally identical products: if you were a layperson consumer, would you buy the product that costs 80 or would you buy the product that costs 100?
If the manufacturer can extract $20 of ad revenue from you, and you make the cheaper purchase up front, then it's win/win for the consumer (spent less), and the manufacturer (able to offer a lower price option and thus hopefully higher sales).
Well, "win/win" in a sense, I suppose.
But what if the desire is not to harm some obnoxious company, but instead to reduce their influence in the market? But I agree generally, free any locked down device you happen to find yourself possessing.
> But what if the desire is not to harm some obnoxious company, but instead to reduce their influence in the market?
I don't see the difference. How would you reduce their influence without harming them?
I was challenging the assertion that buying and freeing is better than not engaging at all. I think the better comment would have been to indicate there is not likely a general rule. Devils and details and all that.
It depends on the degree to which the hardware is subsidized, if at all.
I suppose we should also account for the fact that it takes resources away from a less obnoxious competitor, assuming one exists.
I want everyone, everywhere, to do this to TV manufacturers. Root them. Destroy their “smart” software.
There is no competition in the space anymore. Not on that. You either get crudded-up devices or a panel that doesn’t have the fundamental AV capabilities required of a living room TV.
Subsidizing products does not mean the consumer spends less.
Who pays for those ads/tracking/etc... companies that want to sell stuff to the consumer. Congratulations, subsidization just introduced more middlemen which extract more profit from the consumer.
The simpler things can be, the cheaper things can be.
The goal isn't to pay minimal money. If that was the goal, you strap an air filter to a box fan and use an esp32 to turn the power on and off. Or a solid state relay if you want to get fancy with different power levels.
The goal is to do harm to anti-consumer companies. Buying their (subsidized) hardware, and then breaking their lock-in so you and others aren't shown ads or forced to pay useless subscriptions, harms the company.
By buying the device and then breaking the lock-in, one does more harm to the anti-consumer device manufacturer than had they done nothing at all.
Only if you can guarantee that the vendor is going to remain in business forever, and provide service and support for the product forever.
Neither of those things happen. Ever.
That doesn't make sense, I don't think you understand what I said.
If the manufacturer subsidizes the hardware purchase, that loss is realized at hardware purchase time.
I don't believe that they subsidize hardware anymore.
Years ago, this was true. But today, selling your personal information isn't a loss leader. It's additional profit on top of the profit from the product.
I'm a simple man. I bought air purifier that can use cloud, but never bothered to connect it. I use touch control.
It's not always that simple. I have a bunch of devices in my home that have WiFi IoT: bedroom AC, dehumidifier, refrigerator, and washer/dryer. I bought all of them regardless because they work fine without WiFi and I've never connected them. I'd love it if I could connect them to Home Assistant without data leaving my network. Reverse engineering them is on my list of future projects.
In the meantime they continue to function as "dumb" devices just fine.
I've often though this is part the reason that the Apple IoT space has fewer products than the general market.
Apple's HomeKit allows you to firewall your IoT devices, if you have a Wifi router that supports it.
Since that kind of privacy cuts into the profits of shady IoT companies, they don't support HomeKit.
I'm not interested in trading my privacy for the pithy convenience of moving the dishwasher start button from the machine to my phone.
I'm not sure that this ability to be firewalled is what keeps Homekit down. Inexpensive Matter devices abound that can also be firewalled from the internet, and never connected to it even once[1].
[1]: Yes, I know. There exists Matter-upgradeable widgets that must be connected to the Internet before becoming usable as Matter devices; send those back. I'm also aware that there's Matter devices that require Internet in order to be useful[2], but every instance I've seen of that is just something that was designed by a moron, imbecile, or idiot; send those back, too. Returns cost these companies money.
[2]: https://www.reddit.com/r/TrySwitchBot/comments/1j8ogt8/matte...
You want a router that will not let those wifi devices reach the internet or contact any other device on your network except allowed devices.
For any device that needs to connect to the internet, you want to be able to use dns and ip block lists at the very least.
These changes are on my todo list. Tvs especially need to be quarantined. They scan your network to datamine and try to report your conversations to the tv manufacturer.
The next step is root the tvs and clean off as much junk as possible.
Take a look at OpnSense.
Unfortunately some classes of devices have only those pesky proprietary and closed firmwares. I'm generally with you but nowadays with LLMs it's probably less effort to free up that specific IoT WiFi only device that finding a ZigBee version of it.
How do you feel about Matter [1]? Asking as someone all in on Home Assistant, open local protocols, and ready to reverse engineer and spend whatever is needed for digital sovereignty, for both myself and the community.
[1] https://en.wikipedia.org/wiki/Matter_(standard)
In my experience, Matter is okay except that it’s built over IP and manufacturers seem to be unable to resist using that juicy IP connection to talk to the Internet.
Thread should not have allowed Internet connectivity by default.
My Brighter lamps don't connect to the internet. But, the smart features don't work properly, so maybe they're just shot in general.
(Not the OP, but want to spread awareness, sorry.) The Wikipedia page already lists the greatest disadvantage:
> (..) the ability to commission a finished product into a Matter network in the field mandates certification and membership fees, entailing both one-time, recurring, and per-product costs. This is enforced using a public key infrastructure (PKI) and so-called device attestation certificates.
Matter is designed to necessitate phoning into the internet for certification, which allows all manufacturers to just easily add-in phoning into the internet for telemetry. Furthermore, it does not define exactly which functionality must remain if a device is disconnected from the internet for a long time (assuming the user is trying to avoid sending out telemetry, not even bypassing certification).
The Matter devices (a smart bulb or a sensor) have no Internet access required by the spec, and no way to send telemetry to the Internet.
It’s the commissioners that check for the certification: your phone or an open source implementation.
And the commissioners can, explicitly by the specification, commission other devices while completely offline.
> The Matter devices (a smart bulb or a sensor) have no Internet access required by the spec, and no way to send telemetry to the Internet.
That's a little disingenuous... All Matter-over-WiFi devices inherently have Internet access unless you're blocking it through router policy, and most Matter-over-Thread border routers commercially available today give Thread devices Internet access by default if they want it (to avoid this you need to self-host your own OTBR instance).
Especially "security" cameras.. *shiver*...
I am a simple man. I don't buy smart devices, mostly. Offline only is completely acceptable.
The connected home was an idealistic dream that has been made perverse by the Zucks and Elons of the world. It is not accessible for normal people and it might never be - at least, not without the blood sacrifice of your privacy.
That's not true. Zigbee and Zwave are local only, private, and inexpensive. Home Assistant is great free open source software.
Home Assistant exist
What I don’t like about Zigbee though is that it is on the Wifi band so every device with wifi antenna can snoop on it. Even assuming the protocol is secure, anyone can infer patterns and devices based on traffic shape. For example, a motion sensor that sends data whenever someone walks by. In the end, nothing beats physical wires in terms of privacy and reliability if I understand correctly.
> Even assuming the protocol is secure
The other fun thing about them is because they talk Wi-Fi frequencies, if you break into them they can also be reprogrammed to act like a hotspot, or start commanding _other_ devices.
So if you send a drone up the side of an office building to the executives floor, and can break into one lightbulb wirelessly, you can then make that lightbulb break into all the other lightbulbs, until you reach the secluded inner rooms, and you can make that lightbulb listen for Wi-Fi traffic and can pretend to be a hotspot for the targetted executive's laptop. Like in the movies!
https://www.researchgate.net/publication/322969640_IoT_Goes_...
https://sci-hub.reatk.com/10.1109/MSP.2018.1331033
Deployed wiring is indeed best. I will say wireless devices are often deployed while their wired counterparts sit there on the to-do list.
You love to see it!
I (with heavy LLM help) recently R.E. a golf cart motor controller which had a USB interface for programming, but only a crappy proprietary windows application, and it was super satisfying to see it hum attached to Linux.
What would be even more satisfying to see would be companies that were chill about this kind of work, instead of sending[1] legal threats[2] to people doing the work that they should be doing in the first place.
1: https://news.ycombinator.com/item?id=50443824
2: https://news.ycombinator.com/item?id=50363968
I'm with you in theory but why on earth is anyone buying an air purifier that requires cloud connectivity at all?
In the larger picture, it's because the tech industry started packaging every imaginable piece of hardware as a loss leader for subscription services. That's a big reason why it's really hard to get a high quality dumb TV.
Hopefully, hopefully this new trend can break the cycle of using software to turn things into subscription services that should never be subscription services. I'm terrified that manufactures will respond with hardware encryption and legal maneuvering, but perhaps by then there will be an even larger and thriving ecosystem of open hardware as the ease of setting it up and integrating it with AI accelerates its adoption.
> That's a big reason why it's really hard to get a high quality dumb TV.
It's also partially the reason that a high quality smart TV is so cheap nowadays
And why ads appear without permission.
Sometimes manufacturers bake in the expected revenue from snooping into the price of the device. That can lead to better hardware at cheaper prices, that then you can liberate and use offline.
I used to have a small counter-top dishwasher that relied on proprietary soap cartridges. The dishwasher itself was fairly good and effective, and after hacking the cartridges to allow them to be refilled the overall price was quite acceptable!
The dishwashero!
Were soap cartridges were snooping on you, or the dishwasher itself?
> I used to have a small counter-top dishwasher that relied on proprietary soap cartridges
My god, this is straight out of a Douglas Adams book.
I don't mind the app functionality of my air purifier. I get a push notification when air quality degrades, and I can see data and charts of air quality over time. I can change the settings remotely, which is nice because I have a small child and keep the "lock" function set for the actual controls.
It's easier to setup and maintain schedules, routines, or more complex functionality.
It's certainly not critical functionality, but it's nice. Same with my laundry machine and dryer sending a push notification when the cycle ends. Unnecessary, but nice.
> It's easier to setup and maintain schedules, routines, or more complex functionality.
Complex like wanting to hit the "Good night" button in Apple Home and have it turn the purifier to full blast for white noise, the workflow in TFA that wasn't possible with the app experience?
It's one of those things quite interesting to see the difference in response from one consumer to another. I can't stand the washer/dryer notifications and finally turned them off a few weeks ago. Especially when I'm on the road half the time, why should I care my wife did 8 loads of laundry in a day? When I'm home, the chime is enough to hear from the other room anyway and the notification on the phone usually just backlogs and gives me a load of red badges I need to clear at the end and beginning of every day for notifications I didn't even get because the phone wasn't with me and I changed the laundry anyway.
For an air purifier, I feel like I'd probably want to see outcome-level statistics convincing me it actually matters to lifespan, healthspan, quality of life, something, anything at all, to know and adjust minute-by-minute the exact air quality going through a purifier, or for that matter what the purifier is able to detect even reflects the quality of air elsewhere in a house with a whole lot of air volume not going through that purifier very regularly.
Anyone want to help create a generic service to do this for any IOT device?
Basically a git repo with instructions that would maybe pull in rea and set all this up.
How realistic is this with the emuhdra and other certain vulnerabilities now exposed and will be locked down?
I really can't understand why the hell these manufacturers don't just provide open source firmware. Nobody is buying a Conway purifier for the software and there are no trade secrets there.
Hy I am a backend engineer .I built Kafka and Redis alternative .which is fully 100x fast .Now is open source in GitHub