Google rolls out “If This Then That” support for its $200 OnHub router
arstechnica.com
arstechnica.com
I'm seriously impressed with it.
Also: the OnHub management app for mobile is AMAZING. It is so cool.
Awesome product. Really great to see them put more effort into it and support integrations with IFTTT :D
My router has all WAN-side management features etc. turned off, WPS is turned off and it has a long random WPA passphrase. Unless someone breaks into my apartment, there just isn't a significant potential for security risks that I'm aware of.
Having security updates pushed to your phone is never a bad thing.
It's the reason why enterprise Linux distro updates promise security patches (but possibly not bug fixes) for such a long period - because people do care about these things. Security patches are a good thing.
And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn't have such vulnerabilities on its HTTP interface that can be accessed without auth, see https://www.cvedetails.com/vulnerability-list/vendor_id-9341... for some real examples, including "getting root by sending an HTTP query that doesn't require any authentication".
In fact, for that remote root exploit, disabling Javascript execution wouldn't even help that much, because it can be triggered through e.g. <img src="..."/> on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).
You should still apply security fixes for (relevant) kernel and sshd issues, of course.
The only downside is lack of auto-updates, but for my setup I'm not too concerned about that (WAN-side management features are disabled, and is behind another router anyway; occasional manual updates mostly mitigate LAN-side attacks [and web UI is usually disabled which prevents most of them anyway])
Please pass along kudos to the Android / onHub teams!
<33
I have an Apple Airport thing and had a similar experience - years of buying cheap routers then suddenly I had one that "just works". To the point that I haven't had to open/use the administration panel in an absolute age.
And we're constantly improving it.
IMHO that's the real win with the OnHub; the router itself is constantly upgraded with up to date firmware with security updates and new features. And the mobile app that administrates it is constantly getting new features.
Maybe I should transfer to marketing.
What kind of firmware / security updates do you get with OnHub? Aren't firmware updates dangerous if everything is working perfectly (the possibility to introduce issues)?
Yes, updating any software adds some risk of something breaking. This is not unique to OnHub. This is still a pretty nice feature for most people.
I do know that my current Ubiquiti and Apple network infrastructure devices will still work if I plug them in in 10 years. I can't say the same for this. $200 seems reasonable for what it does, but less so if it's knocked down to dumb router mode if Google pulls the plug some day.
I think it's great what they're doing with OnHub, and hope we can have iOS/Android apps for managing OpenWRT installs too. I wouldn't personally recommend buying one unless you can at least install ddWRT, but I haven't even bothered to learn what CPU they are using.
If you are also tired of this drumbeat, please ask Google to stop beating the marching-products-to-their-doom drum.
Huh? Nest is still a Google property.
Google has just created a hardware division that will handle most of its efforts in that area :
Nexus, Pixel, OnHub, ATAP, Chromecast, consumer hardware, ... they are all going to be integrated in this division instead of being scattered throughout the company.
Glass will also become a part of that division (Nest has been handling it since the end of the explorer program).
Nest will continue to operate independently.
Nest bought out Revolv - and then immediately ceased all sales.
They then kept the servers running for another 18 months, before announcing they were going to shut them down.
Revolv was an also-ran in the home automation stakes - speculation on my part, but there was probably a reason they got bought out instead of raking in the big bucks.
Let's say they sold a few thousand units - do you really think it's worth keeping it running indefinitely? A lot of those people have probably moved on.
I don't have hard data to back this up - but I have a growing suspicion most of the people shrilly screaming the loudest on HN don't actually even own a Revolv - the chances of them being one of those few thousand of couple is pretty small.
At some point, I think it becomes less about "worth" and more about doing the right thing. Is it fair that everyone who bought that device is left holding a worthless chunk of plastic because of the inscrutable whims of various SV tech giants?
If not for reams of legalese nobody reads and yet has to agree to in order to even hook the thing up, it would probably already be illegal in some way.
Don't forget - the "tech giants" you refer to are comprised of people, most of whom have jobs and families
This isn't about whims of tech giants - more about whims of the market.
If the pitchfork-waving masses on HN screaming about Revolv had all actually, well, bought a Revolv, I suspect the company wouldn't have gone bust. The fact of the matter is - the market (or we) spoke - we didn't like Revolv, and that was the reason they failed in the marketplace.
I don't think Nest made any secret of it - as soon as they bought out Revolv, they announced it quite publicly on their blog - we are stopping all sales of this product, immediately - but we will continue to support it for some time.
This was no deep conspiracy - it was, well, the product's a wash, we're buying out the company, and keeping the team.
Think about it - they probably still had stock of the product lying around at the time - they would rather just destroy those than sell them - what does that tell you about the product?
http://www.theverge.com/2014/10/24/7061557/nest-acquires-rev.... http://www.cepro.com/article/theories_on_home_automation_hub....
There were heaps of pundits at the time who speculated on why Revolv failed.
I think that's a far more worthy topic of discussion (i.e lessons learned on why it didn't gain traction), than going on about why we're not supporting a failed product from 2 years ago.
Isn't that what we as consumers want?
However, I do think that there's a valid discussion to be had over the fate of a device that's integrated to the point a "home automation hub" is. The normal expectation is that these devices continue to work for the life of the device, not when some company throws a switch somewhere.
The problem here is that there's no alternative. No graceful degradation. If Ecobee dies tomorrow, I still have a working thermostat.
This? None. Your device is now literally and figuratively worthless, the money you spent on it literally wasted. Were I a purchaser of one of these things, I'd be feeling damn scandalized, ripped off, and rightly so.
This isn't a unique problem just to Revolv, or home automation.
What happens when any company that provides a SaaS or cloud service goes bust?
Say you host your app on AWS, or DigitalOcean - if the company shuts down, will you claim that it's not "fair" for them to shutdown on you, and they must keep your application running?
Tech companies shut down all the time - sure, it sucks both for the people that work at that company, and for their customers (but I suspect more for the employees - you may have just lost some expensive tech toy - they've potentially lost their livelihoods.)
Let's take a step back, and look objectively at the facts - there was a small hardware startup, that created a cloud-based home automation product.
A few thousand people probably bought it - not enough to keep the company going. They were acqui-hired, all remaining stock destroyed, but the company that acquired the team decided to keep the servers up for a couple more years. After that, they announced they were pulling the plug.
Sure, it sucks - but they bought a cloud-managed product from a new hardware startup. I don't think any of these people were stupid - they knew exactly what they were buying.
If they didn't want to have this risk, then they would have bought from either 1. a larger company that was less likely to go bust or 2. a non-cloud managed product.
However, many of the advantages of the product are probably from it being cloud-managed. I see no issue with buying a cloud-managed device, as long as you know what you're getting into.
And look - let's be honest - home automation - I don't exactly want to be opening up my home network to the world, just so I can access it from my phone. Having a hosted service to do this is pretty cool.
Likewise, I don't have the compute power to do any cool ML at home - but if it was all done on the cloud, and there was a company behind it with the infrastructure and engineering effort, that's a good thing.
I have two Dropcams - they're pretty cool devices. Very easy to setup - but cloud managed. This is tradeoff I knew when I bought them. If the company disappeared, I understand my cameras would fail to work.
I would be upset - but I don't think it would be "unfair". I'd just hope that the people who worked at the company were doing alright.
Why am I reminded of a scene from Airplane! here?
The average person probably doesn't even know what "the cloud" is beyond the name of a product or two. They know that they can push a button their phone and turn the lights off.
You imply a level of knowing and care that most people do not have, and so one that is not realistic, or reasonable to expect.
They'd have no chance of ever recouping their investment, or gaining any kind of critical mass.
An acquirhire was probaby a good thing, at that stage - the founders/employees get a new job, and the customer base get an extension on the shutdown, at least for a couple years.
That's not the only option. Some alternatives would have been to make it not a SASS reliant brick. Or to open source enough that people could do that work themselves, at least in theory. Or to offer buybacks. I did read:
> Nest is working with customers on a case-by-case basis on compensation, according Burnett. The company would not disclose exactly how Revolv users would be compensated or whether their Revolv devices could be replaced by Nest devices.
( Edit: http://www.cnbc.com/2016/04/06/nest-to-disable-revolv-hub-mu... )
Any former Revolv users want to disclose how they did/didn't get screwed over, actually?
"If you're a current Revolv customer, please email us at help@revolv.com so we can help you out during this transition and provide you with a refund of the purchase price of your Revolv hub." - http://revolv.com/
There is no explicit foolproof assurance from either Apple or Google, but in Apple's case they haven't been known for introducing products and then dropping all support for it when it fails to live up to sales/strategic expectations.
In fact Apple's modern track record is pretty impressive - the latest iOS runs on a phone introduced in 2011.
Google's "throw everything at the wall and keep the stuff that sticks" approach is IMO one that only makes sense when you discount brand value completely and assume nobody will remember the stuff that didn't stick, and their unceremonial shutdowns. It's a theoretically appealing approach but IMO impractical because people remember.
Even when Google compensates people for the shutdowns - see the Nexus Q - it still leaves a bad taste, and makes people wonder if they're buying a real honest product in a particular space or an experiment to be cut lose at a moment's notice.
The "let's see what sticks" approach might work well for software, especially the Google kind: ad-supported "free" cloud-based software services. Complaints trigger the knee-jerk reaction of "you never paid." It doesn't work for hardware, and I don't know why Google would risk its reputation for what must barely move the needle on their income statements.
Apple's approach of providing SDKs that work with their existing devices, thereby testing the waters and seeing what products get built, what consumers like, etc. before entering it themselves seems like a much more sensible move.
I had to use Wine on Linux to use an older Windows application to do the initialization.
Edit: misread the specs, point still stands.
Automatic Security Updates is a contradiction in terms.
Eight months later, the OnHub still doesn't support IPv6, and the USB port still can't be used for network storage. Bluetooth, Thread, and Weave support are all still dormant.
IFTTT support is great, but shouldn't the priority for a $200 router be in delivering features that were promised from the get-go?
I'll be interested to see the kernel patches because in my experience the kernel-side of IPv6 has been stable for over a decade, including the past seven years with a native IPv6 Internet connection through Linux routers.
Google itself enabled public IPv6 connectivity in 2009 so I am surprised that a Google-affiliated team is having issues with IPv6.
> This is what I want from a piece of infrastructure.
I want infrastructure to support current networking standards.
Other than that I've found it useful for testing WiFi signal strength - in old brick buildings you can get unintuitive dead spots, and the app lets you put your phone somewhere and test signal quality.
Apps to configure routers are an anti-feature IMO
I also use it to monitor my connection: do speed tests directly from the router (even remotely!).
And finally: monitoring network usage, stats, etc. It's a beautifully designed, fluid, fast, and just all around amazing app!
I've been using IPFire/pfSense on a little passively cooled Celeron box for a couple years. It reliably hits the theoretical gigabit limit ~800Mb/s and has never once failed even while running intrusion detection. Coupled with a ~$150 wireless router-turned-access point, I have never had a single reliability issue.
I don't have an analog phone anymore, so I don't know how true that still is, post recent network upgrades.
I have coworkers who used VOIP phones, and who kept their routers and wireless base stations on UPS. I'm not sure if that setup was ever tested in anger.
Power cuts for me are typically short lived (often due to a RCD in the house rather than an actual outage). My networking gear is on my UPS, so that local transfers (e.g. to my NAS) can continue, or so I can shutdown my NAS manually if I'm not using it to get a little more time out of the UPS (I can probably do that via the hardware switch, rather than the WebUI, so not a huge concern).
Now I have an Ubiquiti Edgerouter Lite as my "core" router, and the OnHub acting as just-an-AP in bridge mode. It Just Works, and works better than any piece of wireless gear I've had before.
My only "complaint" would be that I'm forced to use a mobile app for configuration - although in the OnHub subreddit, it was said a while back that a basic web UI was in development.
The Unifi-AC runs about $269, more than the OnHub.
Looks like they now have a Unifi-AC-LITE, which is sub-$100, but it wasn't available when I got the OnHub that I know of.
Power usage on the P4 sucked (>100w idle). The eBay thin clients did much better, usually around 20-40w, and the ERLite is lowest (and it's fanless). I ran a Cisco 2651XM for a while before any of this, but it maxed out doing NAT slower than my home connection was. Honestly though, I was just super excited to get something off-the-shelf for $100 that was stable, supported, low-power, and didn't require much administration. Messing with this stuff was a fun hobby and I learned a lot, but now I don't have as much time and it just needs to work.
Fact of life right there. When I was younger I assembled my own PCs, researching the best CPU, case, etc. etc... these days I have a Macbook that I can't even open. Makes me a little sad, but I need something that I can rely on - and I don't really have the time to research and construct my own machine.
I miss it a little, though. While is why it's really fun to play around with Arduino stuff. Reduces it down to harmless hobby level.
You need to be rather technical to use it IMO, but they're such a step above the rest you'd be mad not to buy one.
e.g. model to get at the moment for home use: hAP ac. it's a 5 gigabit port router with ac wifi.
Too many ways for this Google gadget to be made a brick because they don't care about their customers.
If you are referring to Revolv, Nest/Revolv stopped selling the device the day Nest acquired them (Oct 2014), and they are also issuing refunds to anyone that contacts them[0]. The other major hardware cancel I know about was the Nexus Q which Google also provided a full refund for anyone that contacts them.
Sure, Google could cancel it, but they seem to only do that with something if it was a total flop, and they then do what they can to fully refund whoever was effected.
That's an image thing, and I'm sure you can come up with all kinds of historical facts on why that image is not right, or not right anymore, but that hardly helps fix the image.
I think that if Google really wanted to fix that image, they could do revolutionary stuff like promise long term support, or publish a phone number.
EDIT! westernmostcoy pointed out that actually they do, clearly, publish a phone number, which is pretty decent of them. I got the HN points anyway so it's too late now, but still, good to see! Maybe I should read a site before I criticize it.
The examples of refunds provided for Neus Q and Revolv are a good example of the company trying to do what's right, and I'm sure that helps the image a little bit.
Plus at least for the onHub they do provide email and phone support. https://support.google.com/onhub/answer/6270180
Bottom right: https://on.google.com/hub/support/#ready "Contact Us" on: https://support.google.com/onhub#topic=6243113
I think the best possible outcome would involve them leaving the existing functionality intact.
I'm happy that routers are finally getting the UX treatment they deserve, and their target market isn't for people who know the difference between the two, but OnHub should keep the nitty-gritty details accessible to power users if they so wish. I eventually had to return the router and go back to forcing 5Ghz on my old one.
My iPhone can't prioritize 5Ghz unfortunately. There was some BSSID trickery I could do, but having guests over was a pain since the broadcasted SSID would always result in a horrible connection. By turning off 2.4Ghz entirely on my old router there's no such problem (though the range is reduced quite a bit).
While this is strictly true, an AP can encourage clients to prefer 5Ghz over 2.4Ghz. How do I know? The enterprise APs from the big players do this and do it well. Recent versions of the software that drives UBNT's UniFi APs also do a good job of this. (Every client I've connected to my UniFi APs at home has always been steered to the 5Ghz band. [0])
Like IPv6 support (which the OnHub reportedly still lacks!), sometimes it's best to try and accept the occasional suboptimal result. :)
[0] And yes, without band steering these clients would always connect at 2.4Ghz because of its stronger signal. So, I know that band steering is working. :)
We have a version of hostapd that will do this for you: https://gfiber.googlesource.com/vendor/opensource/hostap/
We call it "bandsteering".
Unfortunately all of the neat IFTTT style stuff is all on their servers. They don't have nearly as many inputs and ouputs as IFTTT yet, but it is still enough to do some pretty neat stuff. They have also made it really easy to do reasonably secure stuff with your own electronics.
[1] Kind of difficult to find, because the just changed their name. http://losant.com
It ended up working, but because the comms had to go through IFTTT servers, the lag was something like 10-15 seconds, which is awful when you want to just turn on a light.
... But they do free you from the company. And these days, ball-and-chaining you to their servers is the big "In" thing to do.
Now for me, I'm a big fan of Node-Red. It's best described as a IFTTT for your machine/network. Runs locally, and just works. I also use PageNodes, a client-only modification of Node-Red. You can use it here:
http://ipfs.io/ipfs/QmSCrZUPkqH4gsncsD7tGXPiFpymsbwmywsHXLDh...
(It's an IPFS link, and is on the permanent web. That link will always work as long as machines are hosting it.)
EDIT: Really? Multiple -1's for a valid criticism of "companies want you locked in to their network"? We just got done with Google killing off a whole platform because of extensive tie-in to 'cloud servers'. I'm just giving a converse answer how to approach the problem.
I would much rather that a device integrate with IFTTT and thus gain connectivity with the hundreds of services which IFTTT supports than for it to attempt to hand-roll integrations with a much smaller subset of services.
In case anyone disputes my claim of gratuitous negativity:
> Some smart home features finally come to OnHub, but using a non-Google ecosystem.
> Its only real differentiators were the funky design, easy setup, and the promise of future updates.
> Now with the IFTTT update, the OnHub finally supports some smart home features—but it's using someone else's ecosystem.
> IFTTT is now the gateway for controlling other things in your house via the OnHub rather than using some kind of Google communication standard like we expected.
> This is all still happening over Wi-Fi, too, so the OnHub is still not using any of the smart-home antennas it shipped with.
Certainly, they could turn cloud based features such as this off, but the router itself?
EDIT: @sohailk, think you're missing the point, which is not if it's logical, but what literally would stop them from doing this?
(Hardware, legal, etc.)
Past experience - most recently with Revolv - suggests that your assumption is wrong and Google has no problem bricking the device instead of letting it function without cloud support.
In other words: When Google shuts down a product, it's 100% shut down. Hence, I cannot understand why anyone would buy non-throwaway hardware from them.
The only thing that probably relies on Google's service is their "Send Feedback" feature.
Guess what hardware startups might do once they end up on http://ourincrediblejourney.tumblr.com/?
$35 is about the right amount of money a smart TV enabler.
I really preferred my TVs to be as dumb and as responsive as possible, but I know that many people won't buy a dongle for the "smart" functionality of their TV has it built in, even if the experience is awful, upgrades are few and far between, support ends after a year, and the internals powering the smartness are non-upgradeable low-to-midrange smartphone boards on their new >$1000 set. Also, getting a >$10,000 TV doesn't get you much better software or much better smart guts, which surprised me at first, but I guess it makes sense; they're not going to spend millions in R&D for the products that sell in small numbers.
I have Rokus - don't need much else
Smart TVs are universally awful.
I do enjoy some of the app integration (hulu, netflix, amazon), but at this point, I'd rather have a stable tv and use a roku instead.
I'm in a 4-story town home with PoE between floors, which works great, but Apple's AirPort Extreme + Express CONSISTENTLY stops resolving DNS while the wired connections are fine.
Looks like I have another alternative if eero doesn't work...
The lack of remote updates for any router probably also means that it has a back door. There's a pretty extensive list of home router vulns out there already.
Being HIPAA compliant is not generally an indication of a well secured network.
I did see some mention of funding, and of very small fees (relative to operating a company) for having your integration on their platform.
So many of these sorts of products do, and it is infuriating. It makes them utterly inapplicable for many environments. I'm building a home in a school bus. There will most certainly be times when I don't have a good (or any) internet connection, but I still want local and customizable automation.
My plan is to just roll my own with Raspberry PIs.
A product can't do everything and be the solution for everyone, each product has a target market and since you're in a niche, most products won't solve your problems.
I'd be willing to wager that 98% of people who own one of these have a persistent internet connection.
If you live in a school bus, yeah, you're gonna have to make some compromises or roll your own sometimes.
Really, it's so much better.
Zapier = AWS Lambda with hundreds of pre-built integrations, webhooks for the rest, multi-step jobs, arbitrary code execution (JS and Python) ... all in a UI with monitoring that makes all the trouble go away.
Right now, I have 25 recipes on IFTTT, if I would have the same number on Zapier I would have to pay $49/month.
It seems pretty obvious to me and more useful than most recipes I've seen there.
And why this needs to be cloud service? Instead of locally running demon on a raspberry pi?
1. Home IoT controller
2. Public-facing webserver
3. At friend's house where my 3d printers are
Edit: There's 474 different Nodes that Node-Red can use. And one node is node-red-contrib-npm, which exposes any npm module as a node to Node-Red. Which sums that up to about 250,000 nodes. http://flows.nodered.org/
Even if this was the case, a solution for normal people doesn't necessarily mean cloud based.