News: 1705933808

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

White goods giant fires legal threats to unplug open source plugin

(2024/01/22)


A plugin and library to permit the control of Haier, Candy, and Hoover appliances recently received takedown requests from Haier Europe's Security and Governance department.

The repositories, owned by Andre Basche, consist of a Python library to retrieve information and execute commands on appliances – for example, a smart washing machine – and an integration plug-in for the [1]Home Assistant app.

The plugin supports anything from air conditioners to tumble dryers to wine cellars. It is also not something produced by Haier itself, and the repository for the library proclaims: "This python package is unofficial and is not related in any way to Haier. It was developed by reversed [sic] engineered requests and can stop working at anytime!"

[2]

Judging by the takedown notices, it could well stop working sooner rather than later. According to a notification in both repositories – [3]https://github.com/Andre0512/pyhOn and [4]https://github.com/Andre0512/hon – Haier has taken exception to the project and claimed: "The plug-ins are using our services in an unauthorized manner which is causing significant economic harm to our Company." Hence a cease and desist, coupled with legal threats.

[5]

[6]

A Register reader got in touch regarding the situation, saying: "Given that the DMCA and EU both specifically allow for interoperability work, this seems like quite a reach and Haier's threats will have a significant chilling effect on developers."

Our reader is correct, to a certain extent. Reverse engineering is a tricky area, but various [7]court decisions have shown that it is mostly permissible, particularly when one is only using it to decode an interface. Similarly, it's risky for companies to erect interoperability barriers in the EU, especially considering the challenges faced by companies [8]like Google and Microsoft .

[9]

Basche [10]shared an email he received over the weekend, in which a Haier representative explained that the frequency of his plugin pinging the company's services was the main issue. The "substantial increase in AWS calls attributed to your plugin" triggered the takedown notices.

All those calls cost money, you see, and cost control is mentioned several times in Haier's email.

[11]Microsoft applies coat of Rust to Azure Sphere IoT platform

[12]Singapore branches out onto internet of trees

[13]IBM to fire Watson IoT Platform from its cloud

[14]Hive to pull the plug on smart home gadgets by 2025

According to an [15]FAQ posted by Basche, a request is sent once every five seconds to fetch the current state of each appliance. If a user were to trigger an action – for example, start some washing or switch air conditioning mode – more data would need to be posted.

Basche said: "Requesting every five seconds is a bit much (even if the app makes more requests more [frequently], but only in use). With a poorly implemented application, this could perhaps provide some load. The default interval for most integrations is 10 seconds.

"I would totally understand if Haier wanted a higher value here and would increase it, I have already asked them to suggest a poll interval."

[16]

Haier has yet to respond to a request for comment from The Register . On January 19, the company [17]posted on its blog: "As we aim to provide the best experience for our connected users and improve the performance and reliability of the hOn app, we are committed to enhancing the smart home scenarios in line with authorized usages and intellectual property rights of Haier Europe."

It also stated that user privacy was a priority before saying: "As part of our IoT and ecosystem mission, we are keen to assess all opportunities and solutions able to expand and open our ecosystem and IoT platform integration."

The email Basche received over the weekend indicates a softening in Haier's stance. It is, however, a shame it wasn't sent before the alarming legal letters were fired off, which are somewhat at odds with the company's professed desire to open its ecosystem. ®

Get our [18]Tech Resources



[1] https://www.home-assistant.io/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Za6fPakj@KBlRikOhxIAFQAAAQ0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://github.com/Andre0512/pyhOn

[4] https://github.com/Andre0512/hon

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Za6fPakj@KBlRikOhxIAFQAAAQ0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Za6fPakj@KBlRikOhxIAFQAAAQ0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.eff.org/issues/coders/reverse-engineering-faq#faq6

[8] https://www.theregister.com/2024/01/18/google_search_update_dma/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Za6fPakj@KBlRikOhxIAFQAAAQ0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://github.com/Andre0512/hon/blob/main/assets/haier_response.png

[11] https://www.theregister.com/2023/01/13/microsoft_rust_azure_sphere/

[12] https://www.theregister.com/2022/11/28/automating_tree_management/

[13] https://www.theregister.com/2022/11/15/ibm_set_to_retire_watson/

[14] https://www.theregister.com/2022/07/12/hive_camera_support_end/

[15] https://github.com/Andre0512/hon/blob/main/takedown_faq.md

[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Za6fPakj@KBlRikOhxIAFQAAAQ0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[17] https://corporate.haier-europe.com/press-release/hon-app-a-message-about-our-iot-and-ecosystem-vision/

[18] https://whitepapers.theregister.com/



So the washing machine connects to AWS

alain williams

would it not be cheaper for them to enable the machines to connect to an address on the local network - ie somewhere reachable by the house holder's WIFI ? Then there would be zero cost to Haier.

The downside to Haier would be loss of all that lovely data as to how often I wash my sox and underwear.

Re: So the washing machine connects to AWS

Jellied Eel

The downside to Haier would be loss of all that lovely data as to how often I wash my sox and underwear.

When I was looking for washing machines a few months ago, I was somewhat boggled by the "Features". One even had a scanner to read lables, so presumably it could what underwear you were washing. Then perhaps combine that data to figure out whos. Apparently this was a useful (ie +£200) feature because people are just that dumb to not know how to sort their washing any more. Or they just chuck it in on a 40C cycle and hope for the best. Or if you want to keep your privates private, go commando. But then they'd know.

But..

Basche said: "Requesting every five seconds is a bit much (even if the app makes more requests more [frequently], but only in use). With a poorly implemented application, this could perhaps provide some load. The default interval for most integrations is 10 seconds.

FFS, ITS A WASHING MACHINE!

For roughly 9,900s a week, it's sitting in my kitchen, switched off. So that would still be 990 unneccesary pings. Maybe they do this so they can inform me that my washing machine has eloped with the fridge, and is currently on it's way to Scotland? But why poll? The '90s called and want their telemetry back after people realised just how much traffic those generated, and figured alerting based on state changes was far more efficient. It's an appliance, why not send a trap instead of polling?

Re: So the washing machine connects to AWS

claimed

It’s the 3rd part library that’s polling the companies services, presumably so something like an ITTT android app can integrate it.

Also, if you put a device in someone’s home, it’s tricky to do a callback. Potentially a web socket from machine to server would allow a callback, but as it would need to be over HTTPS there is no easy way for the user to get in on this action without an API spec.

The issue (in this case) isn’t the company API, it’s the companies response to someone trying to help their customers fulfill a need. The company API can surely be improved (can’t everything), and the validity of having a callout in the first place is also interesting, but neither of these are the reason for the article. If you choose to allow polling and want to pay for it, that’s not a bad decision, but the decision to go after the developer of the library was.

Even if using a web socket/callback the same situation would apply, if you budget resources for the number of washing machines sold and now there’s 3x as many connections, there is still a conflict

Re: So the washing machine connects to AWS

DJO

...For roughly 9,900s a week, it's sitting in my kitchen, switched off...

Given that there are 604,800 seconds in a week, you must do a hell of a lot of washing.

[I think I know where you went wrong, there are 10,080 minutes in a week]

Re: So the washing machine connects to AWS

Jellied Eel

[I think I know where you went wrong, there are 10,080 minutes in a week]

I blame the Monday time dilation effect! Or a caffeine deficiency. Either way, an excessive amount of polling for an appliance, or a demonstration of just how evil Amazon's billing engine can be.

Re: So the washing machine connects to AWS

The Oncoming Scorn

Or they just chuck it in on a 40C cycle and hope for the best.

Works for me.

Icon - Except when I leave my truck keys in it & destroy yet another remote start fob.

abend0c4

It would seem very unlikely that an experimental Python library would have the number of users to cause Haier to even notice in the normal course of events.

It would also seem unlikely that a well-designed interface would have to poll constantly for status. Presumably there is somewhere a means to subscribe to status-change events, even if it's yet to be reverse-engineered.

Maybe the solution would be for Haier to document it, and then everyone would be happy?

Sorry, got to dash, there are pigs hovering over my balcony...

If anyone should be taken down, it's Haier

Anonymous Coward

If Haier don't want to pay AWS costs, don't use AWS.

Why the shuddering hell do I need to go all the way out to AWS in order to control a local appliance? It should be directly accessible over the LAN and dealt with that way. It should not need any Internet access.

Heck, it should probably be on a seperate VLAN where Internet access is denied! The only reason Haier want this external connection is to aggregate data and sell it to marketers. This is why various companies get bent out of shape when people manage everything locally.

Anecdote: Haier are not worth the money (new fridgefreezer was DOA) and Curry's have abysmal customer support (it's simply a redirect to the OEM which is no use when you are rejecting goods under the SoGA).

Re: If anyone should be taken down, it's Haier

Andy The Hat

You miss the (network) point - LAN is not enough! It is essential for you to be able to view to the real time washing status of your underpants whilst at work ... apparently.

Whatever happened to the start button and the finished light? The last time I checked not one of these machines had a "sort washing", "put washing into washing machine", "empty washing machine" or "hang out washing" option on either the dial or the unfathomably deep menu system, so what's the point? Am I a dinosaur or is the world becoming increasingly techno-pointless.

Re: If anyone should be taken down, it's Haier

blackcat

"Heck, it should probably be on a seperate VLAN where Internet access is denied!"

Every bit of connected kit that I allow to be connected is on a special VLAN. It can see the internet and NOTHING ELSE!

"The only reason Haier want this external connection is to aggregate data and sell it to marketers."

Bingo!

If a company is selling a 'smart' device they must expect it to be integrated into HA or some other such platform.

Many moons ago an ex colleague got into trouble for decoding the IR protocol from his B&O hifi and posting it online.

Confused

Dan 55

Given the amount of money involved because they decided to go with AWS so they can draw a little cloud symbol on the box and in the app, have they never heard of rejecting logins and IPs which spam the API?

Just bought both a washing machine and dishwasher

I ain't Spartacus

Sadly both died. In my searches, Cloud enabled options were available for both. Apparently Aritifical Intelligence could tell me how to save water / energy / have cleaner dishes on my WiFi enable dishwasher that only cost two and a half times the price of the cheapest model, or twice the price of the one I actually bought.

I'm presuming it had a camera inside it, to tell me I'd put my glasses too close together? Or perhaps it would tell me off for making shepherd's pie, when salad cleans up much quicker?

Or maybe the thing just launches global thermonuclear war if I'm unable to teach it how to play noughts and crosses quickly enough?

Re: Just bought both a washing machine and dishwasher

gryphon

Upvote for the oblique Wargames reference.

Shall we play a game?

Kev99

Why does anyone need to have their appliances connected to the internet?

Anonymous Coward

I don't have a wifi enabled dishwasher or washing machine, but if I did *and* it was home assistant compatible, I would have finer grained control over delayed timers, or I could trigger the dishwasher to start when my solar panels reach (say) 2/3rds of their generating capacity in the morning, after automatically checking that the weather is going to be sunny, or if the weather is going to be grey, just cut my losses and set the dishwasher off immediately.

Because of the above, I can't see the point in smart appliances that won't play nicely with open source software like home assistant, because for me app controlled != smart. For now, I just buy the cheaper dumb versions.

Jellied Eel

I don't have a wifi enabled dishwasher or washing machine, but if I did *and* it was home assistant compatible, I would have finer grained control over delayed timers, or I could trigger the dishwasher to start when my solar panels reach (say) 2/3rds of their generating capacity in the morning,

You don't need an app for that.. ish. Cheap alternative is a variation on a circuit like this-

https://itecnotes.com/electrical/electronic-threshold-switch/

and you can buy various modules of threshold switches that might not make your insurer go "Nope" at the first claim. Downside is lack of weather integration, and appliance behaviour. Like how well they can deal with passing clouds and resume whatever they were doing. Which is the challenge with a lot of home automation, ie it's simple to use a threshold switch to energise outlets or a spur at set points, but what can you use on that spur?

Brewster's Angle Grinder

I hope they can stand up those claims with numbers and it's not that AWS is costing more than they thought and somebody's gone, "Shit, what do we do?! Lets tell management it's this little guy and his handful of users!"

the frequency of his plugin pinging the company's services was the main issue

heyrick

Good.

At the very most they should be like those IP cameras and operate a dynamic DNS service to ping once to get the IP address of the device.

That you have to ping a cloud repeatedly to retrieve the status of an appliance in your own home is fucking ridiculous and they deserve the trouble that is unleashed when people actually want to do it.

Data fetishising cockwombles, the lot of them...

Service with a smile

Anonymous Coward

So if these IoT contraptions are any good, no one should ever be stuck with a broken washing machine again, because the device would have messaged the supplier "Serial # 123456 here, my reciprocating dolly posser is getting badly worn!" and an engineer would be at your door next morning, having bicycled round with all the requisite parts to hand.

Re: Service with a smile

DJO

Oh you naive thing.

More likely:

"Serial # 123456 here, my reciprocating dolly posser is very slightly worn - Send a salesman round to sell a new machine to these suckers."

Re: Service with a smile

I ain't Spartacus

DJO,

Cynical. But are you cynical enough?

Are you sure that the message doesn't go the other way? HQ to serial# 123456 - sales volumes have fallen too low. Stop working and report broken dolly posser to customers so they will call round service engineer salesdroid.

Sic transit gloria Monday!