Hacker News Reader

Comment by tga | Hacker News Reader

Philips Hue lights are sadly not on the same seriousness level as the Lutron hardware.

After a time away, I tried to turn on lights with my phone -- only to be greeted by a message like "There is a mandatory update available for your bridge. You can use your system again after 10 minutes". I found not being able to turn on the lights for 10 minutes because they were installing unprompted updates completely unacceptable, so that was my last day as a Hue user. I now use a mix of Zigbee bulbs controlled with a (stable, offline) zigbee2mqtt gateway.

View on HN

One of the challenges is this - on one hand, we have the "IoT is notoriously insecure and manufacturers have or should have liability" argument, which is valid, and when manufacturers do actually release security updates, that should be lauded.

And then on the other we have the usability pain like this. I'd rather pay a few dollars more for more storage or an A/B firmware system so the upgrade can run async and minimize interruption.

Mandatory software updates are not the problem. Having to restart devices to install any updates (plus the fact that it takes 10 minutes) is the problems. It's possible to engineer around that.

Just don't use wifi. When the only firmware you need to update is in the MQTT bridge, the whole problem becomes a non-issue.

Zigbee or Zwave devices can have firmware vulnerabilities.

The attack surface at least requires physical proximity, unlike devices addressable via IP.

I have two hue bridges ( because I have over 60 lights) that have been working for a long time now and I have never seen this problem. It’s worked flawlessly.

I also have another zigbee dongle with zigbee2mqtt and zigbee2mqtt is what gives me problems particularly if the power goes out over the house.

Hahaha, oh my gosh, the future is here and it's awful.

I'm going to stick with my regular old legacy light switches and bulbs as long as I possibly can.

Reply on news.ycombinator.com