Hacker News Reader

Comment by pnw_hazor | Hacker News Reader

I bought some name brand smart junk on Amazon day awhile back. Eventually I got around to trying to set it up. The first thing it asked me to do was to configure my router to expose the devices to open internet.

I immediately put it back in the box and haven't touched it since. I hesitate to resell it because part me feels it is my civic duty to destroy it rather than pass it along to another rube.

View on HN

I'm adding RGBW LED strip lighting to my home office, and I wanted the option to eventually control the lights programatically. This was my first foray into home automation, and I settled on using Z-Wave for the communications.

AFAIK, the typical design for Z-Wave systems is to route most/all control through a home-automation "hub" (IIRC the terminology correctly). I was alarmed at the number of hubs for sale that required connectivity to the outside Internet.

I've decided to use a Raspberry Pi (with a Z-Wave modem) with a home-automation distro for my hub, and one of my main motivations was to avoid this huge external dependency / attack surface.

I feel bad for people with less savvy or computer skills who don't realize the potential hell they're risking.

You'd be surprised how many hardware devices do this shit.

The next Mirai botnet will knock portions of the internet offline.

Wow, that's heinous. At worst they could use a VPN, and at best they would just download firmware updates or poll for config changes from the Internet the same way other clients on the network do. Out of curiosity, do you remember what brand(s) and or product(s)?

Reply on news.ycombinator.com