Devastating Amazon hardware review of a wireless power switch
amazon.com
amazon.com
https://twitter.com/mjg59/status/747612713786847232
> Incidentally, now up to three separate emails begging me to remove [the review] or they'll be fired
https://twitter.com/mjg59/status/747866725945737216 contains a screenshot of an email complaining that the review is "unfair" because it is negative and people are marking it as helpful, making it more difficult for other "honest reviewers" to get traction.
What's really ironic is that this experience shows how well capitalism does work, more effectively than other systems can: The reviewer found a bad product, reviewed it honestly, and is now helping other people stay away from it. Let's see you try to make that happen when you're faced with poor and disinterested government-provided services.
Soviet-style five year plans are also not the only alternative to hobbesian capitalism, that is a false dichotomy.
Actually, what I had in my mind when I was typing that was an experience of my wife, very recently, right here in America. Her job is researching regulations for Medicaid across the country. Her boss came across documentation from State of Illinois that were contradictory, so he tried to call their offices. He logged 11 calls to them two weeks ago today, with no one taking his call, and then had to hand the question off to my wife.
Last Monday she attempted to call, only to get a message saying that: (a) they were replacing their phone system for the entire week so they can't receive any calls; and (b) they normally don't take any calls during the last week of the month (!) but because of the phone system problems, they'd make an exception and open their phone lines for the last week of June. So she started trying again this past Monday, and it still took several days for her to get someone to pick up the phone.
That can happen in any system where there's no market allowing people to reject bad alternatives, and to signal the importance of a product through the price system. But any time you remove the market forces (e.g., any socialist-type system where the government is making the calls), the system quickly stops responding to the needs of its customers.
Can you imagine any capitalist company that would simply take down phone communications for a weeks while replacing the system? Years back, my employer put in a new phone switch, and the outage amounted to hours over a weekend. Even worse, can you imagine any company that would just say "we never take customer calls during the last week of any month"?
That avoids the classic arguments about whether socialism is really diametrically opposed to capitalism (Americans tend to treat it as synonymous with communism, much of the world tends to disagree) and instead places attention directly on the management culture which encourages that bad behaviour or chooses not to invest the resources necessary to provide better service.
It's not devastating because there's enough 4- and 5-star reviews from people who have evidently overlooked these flaws (or who have iPhones or old Android devices that allowed setup to work). This word of caution is likely to get lost among the noise.
The author has done a steller job highlighting the awful quality and attention to security of an innocuous IoT device. Granted, a wifi-controlled socket is likely to only power a table lamp or something similar, so anyone brute-forcing the MAC addresses isn't going to do horrendous amounts of damage, but the inability to prevent someone doing this is a clear illustration of the little control the end user has over 'smart' devices.
Bottom line: if you can't root it, don't put it on your LAN.
You misspelled "been paid by the seller via Fiverr".
Not any longer ;). I didn't have the stats for helpful-votes on this review before it was posted on HN, but now with over 600 votes it's #1.
(How many potential buyers care about is another question...)
I bet if you do write a lot of negative reviews, the UPS guy doesn't visit your office as often as the author who writes a lot of positive reviews.
Pure speculation of course.
It's time we setup a standard so that everybody can choose there own "cloud" server for these "smart" home electronics. These manufacturers should not be building their own. Of course the app on your phone could also just connect to the bloody thing itself instead of using these relay servers of the manufacturer. (yes I know, NAT punching is a PITA, but better than this)
Hell, maybe they left the FOTA port open and I can give people a small script with a firmware so they can just run that and flash the plug over the wifi network!
It has the same configuration problems he mentioned but is easily flashable via FTDI.
http://www.nfriedly.com/techblog/2015-12-16-itead-sonoff-sla...
http://dl.itead.cc/IM151116002/sonoff-parts-without-433.jpg
Then you flash it with PlatformIO as usual, except I'm not sure which pins are connected where, that would take some fiddling. I'll buy one to experiment with.
EDIT: Looks like they even expose serial connection pins. It should be pretty easy to figure out which pin the relay is on and which the button is on.
So, it's not that you can suddenly magically access devices by MAC address over the Internet (MAC addresses are still local network only), but since the sockets are all connected to a central server who knows them by their MAC address, that makes it possible to send those messages.
This would all not be a problem with good crypto for authentication (and secrecy), but apparently they put pretty much none of that into the product/app. So it should be realtivly easy to find out the MAC address and then very easy to talk to the central server and tell it to send messages to whatever device.
(It's a little like an open relay mail server, and bad for similar reasons)
It would be pretty cool to remote control all of those sockets and make a blinkenlights display visible from space :D
Anyone can send a command to the server, and the server routes it to your device based on the MAC address in the command.
That's an honest review? I tend to ignore reviewers who talk about security as an all or nothing proposition. Maybe everyone else will in a few years too.