Hacker News Reader

Comment by ttytty | Hacker News Reader

It's so important to have a dedicated VLAN (or 2.4g SSID) for IoT devices and block access to your regular VLAN/SSID or enforce some more granular rules on what devices can communicate with each other.

Most non-ancient routers/gateways support this. There are way too many IoT devices running code that's _worse_ than what older LLMs produce.

View on HN

This is good advice but a simpler solution is to just not buy these things? Coffee machines don't need internet. Your thermostat doesn't either.

> Coffee machines don't need internet. Your thermostat doesn't either. reply

Yours may not, but that's just your personal preference. A lot of folks enjoy these products. An argument could be made that no one needs a coffee machine or thermostat to begin with.

I can definitely see the case for an internet connected thermostat. A coffee machine, much less so.

You're about 35 years behind the times about people networking their coffee machines [0]. People might want to know the status of the pot (the OG example), how their ground/bean coffee supply is, or the ability to trigger a coffee or water boiling before they walk to the machine. My coffee making process is entirely manual, and I like it that way, but I can at least see how there are some features that could be nice.

[0] https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot

I agree on the coffee machine. On the thermostat, not so much. We keep pretty irregular hours so being able to control the thermostat remotely, so the house isn’t being heated unnecessarily but is warm on our return, is useful.

That said, getting a Zigbee or Z-Wave thermostat and have Home Assistant or similar control it is a better option that buying a surveillance-ready WiFi-enabled one.

Honeywell Home T6 Pro Z-Wave.

It's smart and supports only Z-Wave, not WiFi. So something like a machine running Home Assistant must sit between it and the Internet. And then its up to you to decide how you want to do remote access, but WireGuard overlay networks (e.g. Netbird, Tailscale) basically solve that problem at home-user scale.

This. We should buy Z-Wave or Zigbee as much as possible (Matter over WiFi/Thread can access the internet, so are out) to grow that market. Both are completely disconnected from the internet and you decide how such devices can be accessed.

Reject all the WiFi-connected stuff, unless it's very user-centered and worst case you can upload your own firmware (e.g. a bunch of Shelly devices).

If the house is well insulated, keeping it at a constant temperature might be more efficient than running irregular cooling/warming cycles.

Plenty of houses are not well insulated though...

It's not enough to simply have a IoT VLAN that you put all your IoT devices on. Because those devices can see one another. In this case, if the coffee machine can see what type of smart fridge and smart toaster you're using, they can sell that data.

I default to adding IoT devices to a 2.4g "Guest" network where they can't see each other. Exceptions are IoT devices that need to see their friends to do what I bought them for, or devices I want to integrate with HomeAssistant. In those cases I create a separate IoT device per IoT brand. Excessive but necessary.

In those cases I create a separate IoT device per IoT brand.

That requires a lot of SSIDs though and AFAIK it reduces airtime for each SSID on the same router (which may be bad if you also use 2.4GHz for your regular devices).

So far two separate VLAN + SSID (IoT-Good and IoT-Bad) with client isolation on IoT-Bad has worked pretty well for me. In some cases mDNS advertisements have to travel at least from the IoT VLAN to the VLAN HA is on for the devices to be discovered.

SSIDs are indeed expensive in airtime.

There's ways to reduce the expense like changing DTIM interval (for less-frequent broadcasts) and increasing base data rate. Few folks in 2026 have anything at home that requires the 1Mbps base rate of 1999's 802.11b anyway, and slower DTIM can have other advantages, so these tend to work well at increasing available airtime for more SSIDs.

There's an additional trick that can also be used, though: Wifi client isolation. This lets the IoT widgets share an SSID and VLAN with which to talk to the HA machine and/or their cloud-based mothership(s) or whatever, but without being able to see eachother on the SSID.

It still needs set up right lest stuff walk right by it, but it's an available feature.

A smart coffee machine may need to talk to some kind of controlling endpoint (whether local or afar) in order to do whatever it does. It does not need to be able to enjoin in a conversation with my light bulb in order to get there. But that doesn't mean that they can't share an SSID. :)

Indeed, this is what I do on our home network. I have two IoT SSIDs. One with devices I generally trust, where mDNS proxying is enabled and another that is excluded. I've found that the worst devices are generally not locally controllable anyway and always want to go through the cloud, even when you control them through HA or your phone.

I think that's a sensibly-measured approach. :)

I hope to be able to find the time and motivation to re-do the wifi stuff at home this weekend. I'll try to adopt the good-and-bad model of having two IoT SSIDs.

My Bialetti Moka pot doesn't attempt to acquire an IP address.

I'm in Rome right now.

There's a Bialetti shop on the road between the flat I'm staying in, and the Metro station.

If I'm not careful this is going to seriously damage my wealth.

They're not expensive and last a lifetime, get one.

I don't recall when I bought mine. This century, but just barely. Needs new seals after some years of use and those are easily available.

It is objectively bad since the water is way too hot, but I still like it. And now I'm tempted to make more coffee.

Takes some getting used to: Only fill to the escape valve (3/4 of the way up, you can see it from the inside), fill with boiling water from the kettle, put it on a low heat, turn off the heat as soon as it starts to gurgle.

Now I want another too.

I have a few already. I just don't know if I need a selection of sizes in multiple locations ;-)

I have a firewall that tells me how much data each device is uploading and downloading. One particular device pulled down 6GB a week and uploaded 1.5GB doing absolutely nothing. I mean literally nothing, I use the local API to communicate with it. Blocking the one domain it was doing this to dropped traffic to essentially zero with no loss in functionality.

Of course by VLAN, I presume you mean one that doesn't have access to the Internet.

FWIW preventing the harm that happened here would seem to require a second set of APs (radios) on a different channel.

Reply on news.ycombinator.com