6 ms·

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assist

Haier (at least this product in the EU) doesn't have a published/public API. The code in question scraped the API off of app/device traffic. Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Source: I run a developer program for a different IoT company

asylteltine 3y ago
So? If you don’t want people using your APIs there are ways to block them. If it’s public, don’t complain.
- supergeek133 3y ago
  That's exactly what Haier is doing, just via legal means than technical ones. We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me. In this case, it appears they've taken the same access/creds as the mobile app maybe? Another one of our platforms we cert-pinned the API to prevent this as well. Yes there are ways, the other part we don't know is if they went straight to the legal route or not.
  - asylteltine 3y ago
    Haier is abusing the threat of legal action that’s not the same thing
beeboobaa 3y ago
Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund. Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then! Now also just design an official home assistant module and you've turned this drama into community goodwill.
- supergeek133 3y ago
  > Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund. If 3k home assistant users take up as much traffic as say... 50% of my total population we're just supposed to accept that cost in perpetuity? > Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then I advocate for local access internally (to be clear, I don't work for Haier). But I'm here to discuss things I have sphere of influence over as well. > Now also just design an official home assistant module and you've turned this drama into community goodwill. That, again, costs money/people/time that can be spent doing things that keep us all getting paid. All this said, we have lots of API keys in our systems issued that are used in HA, and they DO take up lots of traffic. I sort of let it go because of exactly this (it creates a lot of noise to shut it off for little benefit). Again, I also agree we should all offer local interfaces, but that's an uphill cybersecurity battle (lots of reasons, some of them not great)
  - deleted 3y ago
    [deleted]
  - beeboobaa 3y ago
    > If 3k home assistant users take up as much traffic as say... 50% of my total population we're just supposed to accept that cost in perpetuity? Yes, they are your users. They are likely the people who will gush about your product to their friends and result in more sales. If the plugin could be behaved better: Make a PR and improve it. People will love you if you do it under your company name, but if you don't want the potential internal drama just do it anonymously. Wins all around. > That, again, costs money/people/time that can be spent doing things that keep us all getting paid. Power users are some of the best cheap marketing available to device manufacturers. They will post about your product online. They will tell their friends. They will make your product better for no charge to you. > I also agree we should all offer local interfaces, but that's an uphill cybersecurity battle (lots of reasons, some of them not great) I'd love to hear about how this could be considered a cybersecurity issue. It's typically far more secure than a cloud connected solution, but most companies don't like that line of reasoning because it doesn't allow them to track their users.
alexdns 3y ago
> Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Yeah right.
- supergeek133 3y ago
  I have data to back this up (at least for our products), do you?

asylteltine 3y ago

So? If you don’t want people using your APIs there are ways to block them. If it’s public, don’t complain.

supergeek133 3y ago
That's exactly what Haier is doing, just via legal means than technical ones. We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me. In this case, it appears they've taken the same access/creds as the mobile app maybe? Another one of our platforms we cert-pinned the API to prevent this as well. Yes there are ways, the other part we don't know is if they went straight to the legal route or not.
- asylteltine 3y ago
  Haier is abusing the threat of legal action that’s not the same thing

beeboobaa 3y ago

Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund. Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then! Now also just design an official home assistant module and you've turned this drama into community goodwill.

supergeek133 3y ago
> Design a better api, bud. If you can't deal with all of your users using the product you sold them, the product you made is trash and your users deserve a refund. If 3k home assistant users take up as much traffic as say... 50% of my total population we're just supposed to accept that cost in perpetuity? > Or, crazy idea, just let users use their devices locally. You won't even have to get your shit together and fix your api then I advocate for local access internally (to be clear, I don't work for Haier). But I'm here to discuss things I have sphere of influence over as well. > Now also just design an official home assistant module and you've turned this drama into community goodwill. That, again, costs money/people/time that can be spent doing things that keep us all getting paid. All this said, we have lots of API keys in our systems issued that are used in HA, and they DO take up lots of traffic. I sort of let it go because of exactly this (it creates a lot of noise to shut it off for little benefit). Again, I also agree we should all offer local interfaces, but that's an uphill cybersecurity battle (lots of reasons, some of them not great)
- deleted 3y ago
  [deleted]
- beeboobaa 3y ago
  > If 3k home assistant users take up as much traffic as say... 50% of my total population we're just supposed to accept that cost in perpetuity? Yes, they are your users. They are likely the people who will gush about your product to their friends and result in more sales. If the plugin could be behaved better: Make a PR and improve it. People will love you if you do it under your company name, but if you don't want the potential internal drama just do it anonymously. Wins all around. > That, again, costs money/people/time that can be spent doing things that keep us all getting paid. Power users are some of the best cheap marketing available to device manufacturers. They will post about your product online. They will tell their friends. They will make your product better for no charge to you. > I also agree we should all offer local interfaces, but that's an uphill cybersecurity battle (lots of reasons, some of them not great) I'd love to hear about how this could be considered a cybersecurity issue. It's typically far more secure than a cloud connected solution, but most companies don't like that line of reasoning because it doesn't allow them to track their users.

alexdns 3y ago

> Also, Home Assistant is a locally focused platform, and when it uses cloud APIs it creates HUGE amounts of traffic for the amount of users that use it. Yeah right.

supergeek133 3y ago
I have data to back this up (at least for our products), do you?