Turn on the light, pwn your city.
June 23, 2017 7:09 AM   Subscribe

"Suppose you could build a worm that jumps directly from one lamp to another using their ZigBee wireless connectivity and their physical proximity. If the install base of lamps in a city is sufficiently dense, you could take them all over in no time, with the worm spreading like a physical virus."
- IoT goes nuclear: creating a ZigBee chain reaction
posted by jenkinsEar (71 comments total) 20 users marked this as a favorite
 
Throughout the write-up I had to keep reminding myself that the malicious code is injected through a program pretending to be a light-bulb.
posted by codacorolla at 7:27 AM on June 23, 2017 [11 favorites]


A more interesting end use for worm-propagated aftermarket smart bulb firmware, to my way of thinking, would be the creation of general-purpose citywide mesh networks completely independent of commercial ISP infrastructure. Such networks, if properly routed and encrypted, ought to be completely infeasible to monitor, intercept or shut down.

If the hardware has enough radio bandwidth to update its own firmware, it has enough bandwidth for quite useful amounts of general purpose covert communication.
posted by flabdablet at 7:29 AM on June 23, 2017 [10 favorites]


"Goes nuclear" is quite hyperbolic in this context. While the concept of a Zigbee chain reaction is possible in all devices that use Zigbee, this particular vulnerability only affects Philips Hue light bulbs. One would need to find other vulnerabilities in other Zigbee devices. As a commenter in the article points out, this vulnerability was found in 2016, and patched by Philips shortly thereafter. Also, their proof-of-concept worm can't, say, recruit the device into a botnet; it mostly allows the attacker to cause local mischief (which is still bad, but far from "nuclear").

A more level-headed article would say "a new attack vector was identified on some IoT devices last year."
posted by Hot Pastrami! at 7:31 AM on June 23, 2017 [5 favorites]


In other words, I can see this kind of thing evolving in much the way traditional malware has done. When worms and viruses first appeared they were flashy and obvious and destructive; now the best of them are designed to interoperate extremely politely with their hosts, in order to secure their longevity by remaining undetected.
posted by flabdablet at 7:33 AM on June 23, 2017 [3 favorites]


The author's depiction of the ubiquity of zigbee is a bit more optimistic than the reality. Zigbee's been the cool new thing for over a decade, and when it was designed, the types of threats it would have to guard against could barely be imagined. Philips and other streetlight vendors are already looking at other wireless comms protocols that are much more robust and timely than zigbee.
posted by armoir from antproof case at 7:39 AM on June 23, 2017 [3 favorites]


WE DON'T WANT THE SMOKING GUN TO BE A MUSHROOM CLOUD
posted by indubitable at 7:56 AM on June 23, 2017 [7 favorites]


Made me think of Gru: "Lightbulb!"

In other words, I can see this kind of thing evolving in much the way traditional malware has done. When worms and viruses first appeared they were flashy and obvious and destructive; now the best of them are designed to interoperate extremely politely with their hosts, in order to secure their longevity by remaining undetected.

Made me think of GRU.
posted by Kabanos at 8:01 AM on June 23, 2017 [1 favorite]


I suspect that "going nuclear" here is strictly a reference to the (1+epsilon)^n chain reaction of malware infection, which is analogous to a supercritical nuclear reaction. Other people call this "going viral", which is a reference to the same mathematical phenomenon in the exponential spread of infections.

I guess if you're from Australia you might even call this "going rabbits".
posted by heatherlogan at 8:08 AM on June 23, 2017 [8 favorites]


If you want a legitimate reason to feel alarmed about the state of Internet security, this is sobering.
posted by Hot Pastrami! at 8:08 AM on June 23, 2017 [2 favorites]


I remain confused as to why a lightbulb, whose entire purpose to me is only served when I am in close proximity to it, needs to be controllable and monitorable across the internet. One day I might figure it out.
posted by Jimbob at 8:33 AM on June 23, 2017 [11 favorites]


Jimbob: I remain confused as to why a lightbulb, whose entire purpose to me is only served when I am in close proximity to it, needs to be controllable and monitorable across the internet

In this case, software/firmware updates. The alternative would be to plug each individual bulb into one's computer and upload the firmware via cabling. It would be much more secure, but our species seems to have an unhealthy appetite for convenience, much like sugar, fat, and salt.
posted by Hot Pastrami! at 8:37 AM on June 23, 2017 [1 favorite]


I remain confused as to why a lightbulb, whose entire purpose to me is only served when I am in close proximity to it, needs to be controllable and monitorable across the internet. One day I might figure it out.

1a) "Alexa set bedroom lights soft white"
1b) "Alexa turn on tropical twilight in bedroom"
1c) "Alexa turn off the bedroom lights"

2a) Turn on outside lights one hour before sunset and off at 1am
2b) Turn on outside and inside foyer lights as I pull up the driveway
2c) Unlock the front door as I drive up the driveway
2d) Service worker arrives, let them in remotely

What's amusing is that two years ago people were bitching about the end-to-end encryption and mutual authentication of HomeKit. Doesn't look so stupid now, does it?
posted by Talez at 8:39 AM on June 23, 2017 [1 favorite]


Furthermore, this software was designed to only work when devices are quite close together, but these researchers found a workaround/bug that enabled long-distance communication.
posted by Hot Pastrami! at 8:39 AM on June 23, 2017 [1 favorite]


Byron, as he burns on, sees more and more of this pattern. He learns how to make contact with other kinds of electric appliances, in homes, in factories and out in the streets. Each has something to tell him. The pattern gathers in his soul (Seek, as the core of the earlier carbon filament was known in Germany), and the grander and clearer it grows, the more desperate Byron gets. Someday he will know everything, and still be as impotent as before. His youthful dreams of organizing all the bulbs in the world seem impossible now—the Grid is wide open, all messages can be overheard, and there are more than enough traitors out on the line. Prophets traditionally don't last long—they are either killed outright, or given an accident serious enough to make them stop and think, and most often they do pull back. But on Byron has been visited an even better fate. He is condemned to go on forever, knowing the truth and powerless to change anything. No longer will he seek to get off the wheel. His anger and frustration will grow without limit, and he will find himself, poor perverse bulb, enjoying it. ...

--Thomas Pynchon, Gravity's Rainbow ("The Story of Byron the Bulb")
posted by chavenet at 8:40 AM on June 23, 2017 [11 favorites]


Like I have Lutron Caseta switches where I don't require Hues (the bedroom and guest bedroom have Hues for colored mood lighting). For the Luddites they can act as regular switches. For people with some imagination you can do whatever you want with them.
posted by Talez at 8:41 AM on June 23, 2017


I think the larger question is why a lightbulb needs firmware, or why that firmware would need regular, or any, updates. Especially when you can find a ton of videos of people controlling their bulbs with the app and there is a perceptible delay. Light switches have no delay and do not require you to have anything on your person to operate them. You are paying a premium for worse performance.

"Alexa turn on tropical twilight in bedroom"

Some days I start to feel like I understand the primitivists just a little bit.
posted by enn at 8:42 AM on June 23, 2017 [16 favorites]


Pynchon was right all along. Witness Byron the Bulb.
posted by dis_integration at 8:49 AM on June 23, 2017 [4 favorites]


Incandescent Bulb Babies. Looks like you've got rabies.
posted by dis_integration at 8:51 AM on June 23, 2017 [1 favorite]


I think the larger question is why a lightbulb needs firmware, or why that firmware would need regular, or any, updates.

Why does a car need firmware? Why does a camera need firmware? Why does a cigarette need firmware? All these things functioned great without them before?

The whole point of the microchip coming down to a penny per million transistors is that you can use them to get better operation and new features out of existing things. Cars? We got fuel economy unimaginable with electromechanical control systems. Using a carb today instead of fuel injection? Laughable. Cameras? No longer need film. Cigarettes? No longer need to burn anything and suck tar to get your nicotine hit.

Especially when you can find a ton of videos of people controlling their bulbs with the app and there is a perceptible delay. Light switches have no delay and do not require you to have anything on your person to operate them. You are paying a premium for worse performance.

That's because controlling it with an app is dumb and a bad show piece. When I use my smart switch on the wall I don't have any delay using it as a dumb switch. There's no loss in performance. Using it with Alexa it's no more than a second for her to turn it all on. No longer than telling a human to do something and them doing it. Using it with Siri timers or geofencing the delay is neither relevant (inside of thirty seconds it still wouldn't matter) or perceptible.
posted by Talez at 8:53 AM on June 23, 2017 [4 favorites]


My biggest gripe/fear is that eventually all this interconnected vulnerable shit will be the only way to heat/cool your home, turn on things or do anything at all--the manual, unconnected, non-hackable stuff will cease to exist. And then it's "Pay up or we lock your fridge and you can't access your food."

I like that my thermostat is not on the internet, or my fridge, or my lights. I have yet to have a true emergency that makes me thing "Oh if only I had the ability to switch them on/off from far away!" I believe people when they tell me they think they need these things, but their lives are clearly much different than mine.
posted by emjaybee at 9:22 AM on June 23, 2017 [19 favorites]


Why do lightbulbs even need to be affixed to static locations within buildings any more? You only need light where a human is at any given time. Or to be more specific, where human eyes are. But where we're going, we won't need eyes to see, the things of the internet will do that for us.
posted by XMLicious at 9:23 AM on June 23, 2017


I am still waiting for the day when I will be able to store all the photos of my cat on the cat. That will be a fine day.
posted by GenjiandProust at 9:56 AM on June 23, 2017 [11 favorites]


I am still waiting for the day when I will be able to store all the photos of my cat on the cat. That will be a fine day.

Soundwave has you covered.
posted by Fizz at 10:12 AM on June 23, 2017 [1 favorite]


You are paying a premium for worse performance

Pffft. You're just a Luddite who fears change.
posted by flabdablet at 10:12 AM on June 23, 2017 [2 favorites]


Today is a fine day.

Unless "all" the photos means "more than 64 MB of photos"
posted by nickmark at 10:14 AM on June 23, 2017 [1 favorite]


Cigarettes?

The electronic ones are great and all, but no firmware is really necessary there. All you need is a simple analogue circuit controlled by a mechanical button. But that button is typically a more expensive one hopefully with a little latch to stop it getting pushed accidentally while it's in your pocket, and if you've got any sense you'll probably want a knob for a potentiometer as well, and these devices are less popular, less mass-produced, and so cost more than the models full of electronics by more than they otherwise would.

So in that particular market, avoiding microchips is already a luxury you pay for.
posted by sfenders at 10:20 AM on June 23, 2017


1a) "Alexa set bedroom lights soft white"
1b) "Alexa turn on tropical twilight in bedroom"
1c) "Alexa turn off the bedroom lights"


Awfully generous of you to be providing your personal schedule on a day-to-day basis (including the, ah, special times) to whoever feels like paying for it today.

It really shouldn't be a controversial point that tech has tradeoffs and you should always stop and think about whether what you're getting is worth what you're paying. Like, as a kid, I would've found the idea of being able to voice-control the lights in my house amazing. But I am not a kid anymore (and the implementation turned out differently), so I stop and do the math. I don't want to end up in a world where we don't own our fridges, we just lease them, and if we miss a payment, too bad that we want to open them up to get at the food inside. Or if Joe the Estonian feels like burning down the world.
posted by praemunire at 10:23 AM on June 23, 2017 [8 favorites]


The electronic ones are great and all, but no firmware is really necessary there. All you need is a simple analogue circuit controlled by a mechanical button. But that button is typically a more expensive one hopefully with a little latch to stop it getting pushed accidentally while it's in your pocket, and if you've got any sense you'll probably want a knob for a potentiometer as well, and these devices are less popular, less mass-produced, and so cost more than the models full of electronics by more than they otherwise would.

You'd think that but there's a big wide world of mods and firmware upgrades for vaping devices.

My biggest gripe/fear is that eventually all this interconnected vulnerable shit will be the only way to heat/cool your home, turn on things or do anything at all--the manual, unconnected, non-hackable stuff will cease to exist. And then it's "Pay up or we lock your fridge and you can't access your food."

Drive a car? You have an interconnected, vulnerable shit in your lock, key, and immobilizer. That key in your pocket? It has a chip that transmits to the car each time you put it near the ignition to authenticate the key. When you press the button any idiot can listen in. I hope your car manufacturer has implemented a replay counter or better yet mutually authenticated encryption. Your options to buy a car without keyless entry are shrinking further and further.

Never mind that you can take the "pay up or we do x" concept everywhere without interconnection. Landlords in the UK used to put coin operated slots on the power and the heat. Apartment buildings do it for laundry. If a rental place thought they could make a profit out of it at a private residence I'm sure they'd do it. There's nothing special about an Internet connection that enables you to be a rentier dick.
posted by Talez at 10:31 AM on June 23, 2017 [2 favorites]


1a) "Alexa set bedroom lights soft white"
1b) "Alexa turn on tropical twilight in bedroom"
1c) "Alexa turn off the bedroom lights"


1d) "Alexa please enable Skynet protocol"
posted by Fizz at 10:31 AM on June 23, 2017 [2 favorites]


1d) "Alexa please enable Skynet protocol"

She told me she can't find that skill but that I might find it in the Alexa app.
posted by Talez at 10:32 AM on June 23, 2017


there's a big wide world of mods and firmware upgrades for vaping devices.

Yes, and the non-electronic ones I was talking about are referred to as mechanical mods.
posted by sfenders at 10:35 AM on June 23, 2017


Why do lightbulbs even need to be affixed to static locations within buildings any more? You only need light where a human is at any given time.

seriously every time people ask stupid questions like, "why does every light bulb have to come attached to an autonomous, hovering drone now?" it takes all my energy not to show my contempt for them. making sure the firmware is updated and charging the batteries regularly and removing any visual patterns in your living space that might confuse the navigation algorithms is just part of being an adult, you know? be responsible.
posted by indubitable at 10:50 AM on June 23, 2017 [9 favorites]


My biggest gripe/fear is that eventually all this interconnected vulnerable shit will be the only way to heat/cool your home, turn on things or do anything at all--the manual, unconnected, non-hackable stuff will cease to exist.

Regardless of our emotional or social concerns, I think this is pretty much inevitable as costs drop. As cost barriers are passed, the manufacturing question will be "why not?" rather than "why?". So there's a technological and economic inevitability here. So the main questions will be how we deal with these problems. Questions of "should we" are already, I fear, past meaningful debate.
posted by bonehead at 10:51 AM on June 23, 2017 [1 favorite]


I like my Hue lightbulbs because it allows me to turn off all the lights in my house from wherever I am.

This has measurable benefits for the health and wellbeing of me and my spouse ; she's terrible at turning lights off and I'm terrible at communicating the importance of this is a polite, constructive manner. So the bulbs have been a win-win for both of us.

Smart taps next please.
posted by sektah at 11:00 AM on June 23, 2017


Drive a car? You have an interconnected, vulnerable shit in your lock, key, and immobilizer. That key in your pocket? It has a chip that transmits to the car each time you put it near the ignition to authenticate the key. When you press the button any idiot can listen in. I hope your car manufacturer has implemented a replay counter or better yet mutually authenticated encryption. Your options to buy a car without keyless entry are shrinking further and further.

You think this isn't a huge and under-recognized security concern? It's a huge and under-recognized security concern. There are a lot more potential benefits to society from this kind of automation, though.
posted by praemunire at 11:11 AM on June 23, 2017 [2 favorites]


I remain confused as to why a lightbulb, whose entire purpose to me is only served when I am in close proximity to it, needs to be controllable and monitorable across the internet.

My (open source) controller knows if I am home or not, the time of day, how cloudy it is, and where I am in the house based on motion sensors. So the lights come on at appropriate levels based on all that and I have not touched a light switch or an app since I set it up. Cut my electric bill down a lot too.

My biggest gripe/fear is that eventually all this interconnected vulnerable shit will be the only way to heat/cool your home, turn on things or do anything at all--the manual, unconnected, non-hackable stuff will cease to exist.

Did someone say hackable I'll just leave this here. I have some generic Chinese WiFi lightbulbs that I use with an open source firmware. If you want to own and control these devices without all this cloud based BS it is certainly possible.

My attitude is this future is inevitable so I'm trying to DIY it, or at least learn enough about it to not have the cloud all up in my house. Once you have a lot of stuff talking to each other it is kind of amazing the things you can make it do.

Haven't seen a smart fridge that takes groceries hostage, but I have been trying to install a webcam in mine that will text me a photo of the contents whenever I arrive at the grocery store.
posted by bradbane at 11:15 AM on June 23, 2017 [3 favorites]


Never mind that you can take the "pay up or we do x" concept everywhere without interconnection. Landlords in the UK used to put coin operated slots on the power and the heat. Apartment buildings do it for laundry. If a rental place thought they could make a profit out of it at a private residence I'm sure they'd do it. There's nothing special about an Internet connection that enables you to be a rentier dick.

I can only guess that you've never had to negotiate this kind of precarious living situation not to recognize how massively the potential for the scaling up and going granular of this kind of control is, and how badly it could affect people. Already we have companies seeking to be able to "remotely repossess" cars from people whose loans are (allegedly) in default. You could find yourself shut out of daily conveniences that, in the past, you would own. Oh, you want to use a fridge? We don't sell them anymore, we only lease Fridge360 at much higher profit margins for us, and, if you ever don't pay, or we think you aren't paying, or a hostile person convinces the device or our server that you're not paying, or we're pushing through a mandatory upgrade that is incompatible with your older device, too bad about your dinner. Coin-heating is nothing compared to the sweating that companies are going to be able to do.
posted by praemunire at 11:16 AM on June 23, 2017 [11 favorites]


it's going to be great, though, because capitalism is great.
posted by indubitable at 11:23 AM on June 23, 2017 [2 favorites]


Why do lightbulbs even need to be affixed to static locations within buildings any more? You only need light where a human is at any given time.

Don't worry - industry will get you there with lights out warehouses. The solution? Headlamps! It will be like a coal mining job, with less black lung I guess.
posted by rough ashlar at 11:32 AM on June 23, 2017 [1 favorite]


You could find yourself shut out of daily conveniences that, in the past, you would own.

With a "right to repair" support starting you'd have to show you had some kind of right to own to fix that Zune of yours. (where Zune is the stand in for the word for getting frozen out once the original maker walks away and therefore breaks your IoT thing. Odds are someone is gonna out-Zune Microsoft for being the example of broken due to abandonment.)
posted by rough ashlar at 11:41 AM on June 23, 2017 [1 favorite]


Never mind that you can take the "pay up or we do x" concept everywhere without interconnection. Landlords in the UK used to put coin operated slots on the power and the heat. Apartment buildings do it for laundry. If a rental place thought they could make a profit out of it at a private residence I'm sure they'd do it. There's nothing special about an Internet connection that enables you to be a rentier dick.

In addition to what praemunire said, off the top of my head, some other differences are,

> Being able to charge debt instead of taking available money. Therefore, it's less charge a quarter for a thing, and more charge a quarter plus 20% interest for a thing.
> Being able to slice fees more granularly, so it's less "pay a quarter to use this thing" and more "here's a whole buffet of fees we can charge you that now adds up to 50 cents for the same amount of service but seems more luxurious because we can give each fee a fancy name"
> Tracking and surveillance, resulting in aggregated data that describes you, but that you don't profit off of. Potentially being sold on data markets to adversely affect you.
> Being able to set variable price points based on the above data, similarly to how Amazon sets floating price points depending on a number of factors. Those things will also be able to effectively be coded for aspects like race, gender, and socio-economic class, but due to the proprietary nature of aggregate data no courts will be able to check it.

That's just off the top of my head. I think there are good aspects to the IoT, but this is more than just allowing more of the same rentier capitalism - it's a huge magnification of the concept, which will mostly negatively affect the poor and working class.
posted by codacorolla at 11:44 AM on June 23, 2017 [4 favorites]


I am not worried AT ALL!

I have a house license for Norton Appliance Security 360!
posted by Samizdata at 11:54 AM on June 23, 2017 [1 favorite]


"It's convenient, it's shiny, you're just a Luddite, everyone's already tracking you anyway"

Add in "it's keeping us safe" and that's why I have so little faith in the future not being terrible.
posted by bongo_x at 11:57 AM on June 23, 2017 [6 favorites]


In my house we REFUSE to let our lightbulbs onto the WiFi.

The thermostat, BluRay player, TV, printer, car, toaster, refrigerator, and alarm clock, sure, but NOT the lightbulbs.

sadly even though this comment is a joke only 3 of the above things are not actually already on my WiFi
posted by caution live frogs at 11:58 AM on June 23, 2017


"I can only guess that you've never had to negotiate this kind of precarious living situation not to recognize how massively the potential for the scaling up and going granular of this kind of control is, and how badly it could affect people."

Sounds like the dream of a bright libertarian future needs to be much less libertarian than today. There will need to be much more government regulation to prevent the abuses of IoT by private companies, or at least all of the necessities need to be government owned and operated. If companies can keep you from lighting your home, eating refrigerated food, traveling to work etc. then, in order to continue our current ideas of human rights/civil rights forward, we need to be able to stop private companies from violating such rights somehow, right?
posted by RuvaBlue at 12:31 PM on June 23, 2017 [2 favorites]


Cars? We got fuel economy unimaginable with electromechanical control systems.

Also the VW emissions scandal.

Cameras? No longer need film.

No complaints there.

Cigarettes? No longer need to burn anything and suck tar to get your nicotine hit.

May not actually be safer than conventional cigarettes. More study needed.

I recognize the irony of saying this while carrying around a tiny surveillance box in my pocket, but I don't actually need Amazon or my television listening to my every word and selling that data to any number of shadowy data brokers. But y'know, give me convenience or give me death or whatever.
posted by Existential Dread at 12:39 PM on June 23, 2017


Good article, but it has one irritating flaw. Twice it defines the acronym CPA (coordinated power attack) and once it defines DPA (distributed power attack), but it uses OTA over and over again (10 times) without. Ever. Defining. It.

Sure, I can Google and find out what it stands for (Online Trust Alliance) and what it is (organization to create trust standards for Teh Intewebs). but if you use an acronym that is central to your story, please fucking define it.
posted by Mental Wimp at 12:42 PM on June 23, 2017 [2 favorites]


> Tracking and surveillance, resulting in aggregated data that describes you, but that you don't profit off of. Potentially being sold on data markets to adversely affect you.

I will say the amount of data generated by my DIY smart home crap is quite amazing. I see why Google etc. are all pushing these cloud connected smart home services, once they are in the smart home they will literally know every time you take a shit, what you watch, what you listen to, what you talk about with other people. Everything.

I have no problem surveilling myself though on my own server, just looking at my own data aggregation I can see how many times I went to the bathroom this week, how much time I spent listening to NPR yesterday, how the humidity of my living room is related to the temperature of my aquarium during this heat wave, and exactly how badly I have neglected my house plants lately.

The problem for me is what the hell do you do with all this data, I am not a programmer or smart enough to figure it out I guess (other than synchronizing the coffee maker to my alarm or having the closet lights turn off when I walk away). It is scary to think about this stuff being plugged into these cloud machine learning algorithms, all so Amazon can sell me more toilet paper.
posted by bradbane at 12:44 PM on June 23, 2017 [3 favorites]


OTA in this context means "Over-the-Air". As in flashing the firmware wirelessly.
posted by bradbane at 12:45 PM on June 23, 2017


I am still waiting for the day when I will be able to store all the photos of my cat on the cat.

Personally, I'd rather have a more enduring storage medium that doesn't expire in 15-20 years.
posted by Greg_Ace at 12:54 PM on June 23, 2017


Personally, I'd rather have a more enduring storage medium that doesn't expire in 15-20 years.

Still, the cat is probably more resistant to damage from strong magnetic fields
posted by Existential Dread at 12:57 PM on June 23, 2017 [2 favorites]


There's nothing special about an Internet connection that enables you to be a rentier dick.

The Internet of Things allows you to be a rentier dick at scale, and as the famous argument for increased military spending puts it: quantity is a quality of its very own.
posted by Svejk at 1:16 PM on June 23, 2017 [3 favorites]


May not actually be safer than conventional cigarettes. More study needed.

Excuse my weakness, but I can't stand to see that go by without commenting. It is outright disinformation.

The lead author of the study in your first link is directly quoted as saying otherwise, that cigarettes are "super-unhealthy" whereas vaping is in his opinion merely "unhealthy". It appears that his report builds on the earlier work which found that if you use the wrong voltage for the coil you've got, or otherwise setup your vaping device incorrectly so as to get a "dry puff", bad stuff happens. In any case, relying on any one experiment in such an immature field of research so full of propaganda and bias is unwise. As to the actual health effects of e-cigarettes, yes, more study needed. As to whether they're safer than smoking, by this time there is absolutely no reason to even suspect they aren't by a long way.

Sometimes it's astounding, the things people will believe when it comes to drugs, politics, and computer security.
posted by sfenders at 1:19 PM on June 23, 2017 [1 favorite]


I have been trying to install a webcam in mine that will text me a photo of the contents whenever I arrive at the grocery store.

But that won't tell what you need/want that isn't typically in the fridge - like, say, an ingredient for an appetizer that you don't make often but you're making it for a party this weekend.

In my case I'm perfectly happy with the grocery-list app on my phone that (a) doesn't need an Internet connection, (b) lets me build a list of things as I think of them/need to plan for them/use them up so I don't have to remember - or more likely forget - to buy them later, and (c) retains every item I've ever added to it as I went along so it's easy to browse through and select not just what I frequently run out of but also easily-forgotten things I don't get often ("Oh yeah, I haven't made that in ages!"). And it covers my pantry items as well as my fridge items.

Of course, for me such an app is a major upgrade from scribbling items on a scrap of paper that I have to remember to bring with me to the store, so it's all a matter of perspective. It's interesting seeing the generational differences between people who grew up pre-Internet and people for whom the Internet has always existed. I mean, I'm somewhat of an "early adopter" for my cohort so I'm happy to to use technology where it makes my life easier without compromising my personal sense of security, but it's not necessarily the only approach I think of. For instance, I don't use things like Alexa or Internet-connected lights and appliances, because it just doesn't make my life enough better than what I was used to before to be worth dealing with the security issues.

I'm not knocking technology by any means, and of course everyone's entitled to use however much of it works for them. I just find the different attitudes fascinating.
posted by Greg_Ace at 1:28 PM on June 23, 2017 [2 favorites]


I probably should have said often-generational, because otherwise it's a blanket statement that's not always true.
posted by Greg_Ace at 1:32 PM on June 23, 2017


(other than synchronizing the coffee maker to my alarm or having the closet lights turn off when I walk away).

Back in the early 90's I bought one of those plug-in timers just for this purpose: about alarm time, turn the lamp and the coffeepot on at the same time, in the kitchen. I felt like Buck Rogers.

Also, speaking of camera firmwares: for Canon, check out MagicLantern for DSLRs and chdk for point-and-shoots.
posted by eclectist at 2:14 PM on June 23, 2017 [1 favorite]


OTA in this context means "Over-the-Air". As in flashing the firmware wirelessly.
posted by bradbane at 12:45 PM on June 23 [+] [!]


D'OH!
posted by Mental Wimp at 3:42 PM on June 23, 2017


I will say the amount of data generated by my DIY smart home crap is quite amazing. I see why Google etc. are all pushing these cloud connected smart home services, once they are in the smart home they will literally know every time you take a shit, what you watch, what you listen to, what you talk about with other people. Everything.

We have to take at face value but the local recognition for the watchword all stays at the device. That's not to say the market isn't very sensitive to this sort of thing. Google might as well have put a bullet in the brain of its nascent smart devices division after the massive Beauty and the Beast cockup. It absolutely destroyed enthusiasm for the Google Home among the nascent smarthome market.

Apple on the other hand is taking a different tact and is focusing on embedding machine learning in devices rather than sending it out to the cloud for mining. Siri is ridiculously private, doesn't associate with your ID and can be easily purged of all plausibly linked data by turning on and off the service. Hell, you can even turn off location sending if you're uncomfortable about it. All of Siri's data mining is done and kept on device. All of the HomeKit stuff is kept within the home, the Apple TV can act as a proxy through a persistent connection to iCloud but it's all end-to-end encrypted and it appears Apple can't see shit a'la iMessages. Given Apple's incredibly impeccable level of attention to detail on their privacy and on device hardware security I can only give them the benefit of the doubt on their privacy claims. I can see it becoming the privacy buff's refuge in the connected world.
posted by Talez at 8:17 PM on June 23, 2017


"Light switches have no delay and do not require you to have anything on your person to operate them. You are paying a premium for worse performance."

I live in a house with 1950 wiring, and a 1950 number of outlets (ONE in some rooms) and 1950 number of light switches, which is to say HARDLY ANY, and I've set two -- just two! -- fixtures up with smart bulbs, and it is AWESOME. One is a wall lamp that's the ONLY light for an entire half of the living room, but it's inaccessible and tricky to turn on and off, which left people fumbling at it, the lamp FALLING one when someone tried to force the not-switch too hard, or just leaving it off or on all the time. I mean it was so inaccessible we basically sat in the dark unless we were having a party and didn't want our friends to think we were cave people. Now we tell our smart-home device to turn it on. Or off. It's great!

Similar situation with the other one; difficult-to-update dining room fixture with odd-sized shades and basically the whole thing gives me a headache (literally because its placement w/r/t the ceiling fan creates a strobing effect on the ceiling, it's a nightmare) and it can't accept traditional dimmers and the switch is in the least convenient spot possible. So now I just tell it to turn on and off and it's GREAT. And it can turn on super-bright when the kids are doing homework at the table, or nice and dim when we're sitting down to dinner and don't need to feel like we're in an OR.

Anyway, having updated lots of the wiring in this house, $60 smart bulbs are HELLA CHEAPER than fixing the problems from the electrical side (some of which can't be fixed because some of my walls can't take outlets). I haven't felt any particular urge to upgrade any of my other bulbs because I can turn those lamps or lights on and off easily enough and I'm not super-into tech for the sake of tech and I don't want ALL of my bulbs talking to the cloud or whatever. But those two fixtures? They have improved my life satisfaction ENORMOUSLY.

People who tell me they don't understand the point of smart bulbs or they think it's too intrusive usually live in homes with WAY MORE MODERN electrical than I have. Other people who live in older houses like mine are always like, "DUDE!" and coming up with all the ways their life can now improve because they don't have to trip across a dark room three times a day.

I actually do worry about when my current baby gets old enough to talk to the Echo and can play evil toddler tricks not just with the light switches she can barely reach, but with the device that she just has to shout at. But then it only understands my 6-year-old about half the time because he still sounds a little like he's saying "Ayexa" instead of "Alexa." So maybe it won't be so bad.
posted by Eyebrows McGee at 8:45 PM on June 23, 2017 [2 favorites]


IoT will be a boon for the IT security profession.

Me: "Alexa, log me into HomeCloud"
Alexa: "What is your username, Annika?"
Me: "Annika OR 1=1"
Alexa: (proceeds to read out the entire username database)

You think I'm kidding but I'm already probing vectors of attack in conversational UI...I'm also interested in UHF side chain attacks as well.

It's a weirder ass world than I could have ever imagined, and it's gonna get a whole lot weirder. Kind of exciting in a breathtakingly frightening way. I'm just along for the ride y'all.
posted by Annika Cicada at 7:32 AM on June 24, 2017 [1 favorite]


The problem I have with color-changing smartbulbs is that not only do they have hackable firmware, they hack your own internal firmware to generate sensations from experiences which are extremely divergent from the experiences that have generated those sensations over evolutionary time, and which may have consequences which no one can predict in advance.

In the example in the link, the true state of affairs is only revealed by rapidly panning a camera across a color-changing bulb, but if you happen to be flicking your eyes back and forth at a certain distance from such a bulb, say when reading, you might inadvertently duplicate that on your own retina.

And not only that, as we know from the Pokemon Shock incident in Japan in 1997, flashing lights at just the right/wrong frequencies can have very untoward effects.

If you were especially malicious, I wonder whether you might be able to hack such a bulb to generate those very frequencies.
posted by jamjam at 11:36 AM on June 24, 2017


I take it you are referring to the fabled brown light?
posted by Greg_Ace at 12:49 PM on June 24, 2017


I don't know . . . might be kind of a feature, really.
posted by jamjam at 1:28 PM on June 24, 2017


Bathroom lights for people who suffer from constipation!
posted by Greg_Ace at 1:30 PM on June 24, 2017


Jasper Fforde wrote a novel called Shades of Gray that talk about color's medicinal properties. It is also a fantastic read. Additionally, some people will swear about the healing properties of color, so I am sure that someone out there is convinced of an actual "brown light", as it were.
posted by Literaryhero at 6:10 PM on June 24, 2017


I am still waiting for the day when I will be able to store all the photos of my cat on the cat. That will be a fine day.

Speaking of all one's eggs: Just the other day I saw about five minutes of CSI: Miami where they had files folders with the electronic copies of the contents attached to the front. It was cool though, they could read them via proximity like RFID. I took this as a signal they didn't want technical people watching the show and turned it off after yelling to my wife that yes, it was entirely more convenient to digitize file contents and then put them in back in an obscure filing box than, like, store them in the cloud or its 2009 equivalent server farm.

Its late here: when I read the lede sentence I thought this thread was going to be an art project or something. Who wouldn't want a worm-of-light following you from bulb to bulb across town, shutting itself down as it goes, presenting itself as a friendly invertebate companion?
posted by Ogre Lawless at 1:34 AM on June 25, 2017 [1 favorite]


The problem I have with color-changing smartbulbs is that not only do they have hackable firmware, they hack your own internal firmware to generate sensations from experiences which are extremely divergent from the experiences that have generated those sensations over evolutionary time, and which may have consequences which no one can predict in advance.

Just wait till you hear about the new "motion pictures", which hack our visual system's time resolution to create the illusion of motion from a series of still images!
posted by heatherlogan at 8:39 AM on June 25, 2017


There's nothing special about an Internet connection that enables you to be a rentier dick.

Yes there is. It allows you to do so remotely, to a lot of people. I rent now; if my landlord wanted to put a lock on my bathroom, he'd have to come to my house to do it, and I could take legal action if he tried. If a Russian hacker in year 2040 wanted to do so to the wired bathrooms of me and 1,000 other people, then what could we do to him?

I'm not paranoid about technology or even hostile to it, but the possibility of massive amount of control of daily life activities being given to outside people, for tiny amounts of convenience, baffles me as a selling point. Having to wait a little while for my house to cool off after a vacation, installing some more lighting, having to write a grocery list*...none of these has ever been more than a minor inconvenience to me.

Some smart house things do seem like good ideas for people with disabilities, mind you. Such devices would still need to be really secure, which so far, they aren't.

*I have a whiteboard on my fridge, where we write down stuff as we run out. I take a picture of it before I go to the grocery store. It is less work than typing shit into my phone.
posted by emjaybee at 4:54 PM on June 25, 2017 [2 favorites]


Funny. We tried all kinds of tech solutions with shopping lists, but they were all too much work and didn't work. Now we have a small notepad on the fridge. When you think of something you write it on the pad. When you go to the store you tear that page off and take it with you.
posted by bongo_x at 7:20 PM on June 25, 2017


It is less work than typing shit into my phone

Pffft. You're just a Luddite who fears change.
posted by flabdablet at 12:49 AM on June 26, 2017


When you think of something you write it on the pad. When you go to the store you tear that page off and take it with you.

That's all very well but what are you supposed to do when the pad runs out? Huh? Huh? Didn't think of that, did you, you miserable belt-onion curmudgeon. And think of all the trees you're killing to make your stupid pads. That's the trouble with olds, they don't care about saving the planet.
posted by flabdablet at 12:53 AM on June 26, 2017 [2 favorites]


« Older Cathartic for POC Audiences   |   The roles of beauty, aesthetics and signaling in... Newer »


This thread has been archived and is closed to new comments