Unbricking a $2k bike with a $10 Raspberry Pi
ptx2.net
ptx2.net
Looks like somebody rediscovered the Kalman filter without realising it :)
I recall implementing one for an IoT device, to de-noise gas sensor readings a few years ago.
Pretty fun read. Makes me wish I could gather the courage and patience to get back into hacking on embedded stuff
In fact, the CEO of Peloton had the idea for Peloton... IN A FLYWHEEL CLASS. That's insane.
We'd need to do a lot more reading to have on opinion on that case.
I agree that Peloton had a patent. My argument isn't a legal one (clearly, legally speaking, Peloton was in the right). I just think it sucks.
https://patents.google.com/?inventor=john+foley&assignee=pel...
They are as absurdly simple as you would expect, so I assume Flywheel simply didn't want to/had the money to fight this. Like, here is the ultra-obscure "KETTLER World Tours" in 2018 having you race online against others on archived footage retrieved over the internet:
If we embraced copying a little more I think our society would be better off.
So it was bigger than just a patent case, and Flywheel, caught red-handed, had no choice but to settle to Peloton's satisfaction.
I had one of their bikes, and sold it because the service was crap. I encourage people not to do business with this shady company.
The problem is not Peloton persay, the problem is the Patent office allowing these obvious "Thing in the real world -> On the internet" patents to pass right on through
It’s a great idea, but I don’t think it’s always the right idea.
I don’t think so
I also think it doesn't have to be.
There are many things that make regular locks effective at preventing unauthorised entry to your house. Ability to access the lock is not one of them, and neither is knowledge about its principle of operations.
But I don't think full open APIs any software can use in this case precludes getting as much security as is possible to get out of the software/electronics side of things. And full open APIs would be super useful for longevity, variety of use, etc.
...thanks for repeating what I wrote in the fifth sentence, I guess? You could have at least mentioned steroids or something which I didn't cover which would also be easy to use there. But the fact is that like so many things level of effort required matters. Some people will try to cheat anything at any level, either for the rewards or even for the meta challenge of cheating itself. But when talking Big Numbers, millions of people using something, it can still be a big difference if it requires significant effort to cheat vs something trivial, and crypto signed data does raise other active response options too. Even in the electric motor example, is the electric motor output identical in cadence and so on to a human? Does the cheater use it the same way every time? Because if not, that may show up and they can be banned and leader boards recalculated. And cheaters could try to respond in turn, but having to try to hide things via physical systems would be trickier then pure software.
And at any rate, I was taking the poster's concern I was responding to as a given. My point was that even then, I don't think that open APIs are in conflict with doing as well as can be done from the electronics side. It's fine to also say "well, I just don't care about cheating and/or our group would socially moderate it" which I also tried to mention, merely signing an open API wouldn't get in the way of that either. It'd just be an extra open data point to use or not use as a given community wished.
Self reporting only works so far. Leaderboards should be connected to in person events with judges/rules if accurancy is important.
At a previous workplace that showed similiar stats the focus was on personal breakthroughs and personal goals. Leaderboards existed within small groups who met up in person and rode together.
I guess at least that makes it realistic.
https://www.schneier.com/blog/archives/2016/04/cheating_in_b...
>Hidden electric motors have been used to cheat in real pro cycling. If they can’t always catch it there Peleton etc. have no chance.
Though this is getting off topic, I'm not sure I agree with you. It's not necessary to always catch something in a situation like this after all, as with video games it is more about keeping down the rate, and permabans on discovery with retroactive stat updates may also discourage by raising the risk even if one might get away with any single instance. There is also the fact that stakes are just plain lower, things like Zwift are mostly about fun, getting into shape, and competitions to the extent that competition helps some people with A & B. It's not like there are massive cash prizes and sponsorships and so forth on the line in the same way the pro sports has. So lesser reactions could still work.
And the purely electronic world does have some additional potential tools, if we want to theorize about if a given community really got concerned about cheating. While as this example shows right now the needed data is very minimal, it's not as if an open API couldn't have a lot of biometrics, resulting in major data sets that could be kept around indefinitely. Which obviously has major privacy implications too, but purely from a cheating angle I suspect it'd be a challenge to get everything right vs sufficiently powerful ML analysis on a data set like that from millions.
I mean, at the end of the day the fact is that a human being assisted by an electric motor just isn't thermodynamically the same system. With sufficient resolution (possibly not feasible on real roads, but quite possible for a contained standalone system) the energy budgets and how they interact with human physiology just won't add up right.
Now I personally am not a serious bike rider at all, just casual for exploration of the countryside on my own, and while I have a bunch of family members who are they're all out on roads and aren't into the tech side as much. So I honestly don't have any idea what level of privacy/creep tradeoff people would accept in data collection vs cheating and any other benefits (better personalized AI training suggestions? maybe?). Still though, it's an interesting cat and mouse game, and I'm not sure I'd bet on the mice if the cats have enough data collection, memory and computing power on their side.
All of which not merely could but should even more be open, so that people can see exactly what is going out and have full control over it.
There's have been at least 2 deaths related to use of Strava and probably many unreported near misses, all to have your name at the top of a list on a system you have to pay to use [1]. Cheating is widespread in any online game that has a decent audience, often for no discernable benefit. Humans are not rational, especially when it comes to competition.
[1] https://www.velonews.com/news/road/family-sues-strava-over-d...
If the high score is what you want you can play a video game.
I just don't get why the Peloton thing is so popular when you can get a smart trainer and a bike you can actually take outside for sooo much cheaper. You could even sign up for Zwift and a Trainer Road subscription and come out waaay ahead of $50/month.
The protocols coming out of these things have become pretty much a standard as well. Get an ANT dongle for your computer and the data can be consumed from so many apps, even an open source project like Golden Cheetah. Or just read the data from a head unit that already supports it.
You'd be surprised how much twiddling and research you need to do to find a correctly sized bike and which smart trainer (elevation? resistance? etc?) to get something that will work for the average person. It's the same reason people go for iPhones or Macs or anything else that 'just works', the time cost for getting to where one can actually use it vs. just unpacking a box w/ a 'good enough' smart bike means that a shiny package like a Peloton will always be preferred for a large chunk of the population.
Not sure what twiddling you are doing with resistance and elevation, smart trainers pick the resistance based on what the app tells it to do in real time.
By no means can a 'large' chunk of the population afford $2,500 up front plus $60/month.
With a real bike on a trainer some people might even decide to try riding outside, who knows...
Where did you get $60/mo from? GP mentioned $50 which is also off base... A peloton sub is $13/mo. The only way you could pay $60/mo is if you’re financing the bike.
Now that said, should you buy a peloton? Unless you're interested in indoor spinning classes don't. Get a tacx neobike, the wahoo kickr bike or the stages bike. They are much better bikes and allow you to use any of the many training platforms out there (zwift, rouvy...). If you're just interested in indoor spinning classes, just get yourself an indoor spinning bike without all the fancy electronics.
I've been riding competivily for a long time and when I moved to Northern Europe from Australia and needed to get myself a trainer for winter, it still made the most sense to get the tacx neobike despite already owning 2 roadbikes and a cyclocross bike.
Honestly prefer training this way to the gamified Zwift experience, there's something deeply off-putting about gluing my eyes to a screen when I'm meant to be focusing on 4x5 intervals. I have a Wahoo Kickr; I hardly ever use it.
I didn't have any prior wrench experience, this was a project in part to gain some. All I had were some Youtube videos, a copy of Leonard Zinn's The Art of Road Bike Maintenance, and some basic tools. I did, however, already know my fitting dimensions.
The bikes I race on are what you'd expect though. More expensive than my car.
As serious road frame design is moving to disc brake and thru axle, something like a 12 year old all aluminum Cannondale or specialized road frame and fork set for QR skewers and 130mm rear should be pretty cheap. Then add basic all aluminum components for stem, bars, seatpost, etc.
I'd still expect to spend $125-200 on the saddle if I want exactly the same model to match my actual on-road bikes.
Can confirm it was still the single most expensive component of the whole bike build, more than the frame, wheels, or groupset even.
Test saddles aren't supposed to be sold to the public; I believe it was a liquidation sale.
Since I built using mostly Shimano or Shimano-compatible groupset parts, their techdocs archive was a goldmine, particularly the dealer manuals and compatibility charts. The site navigation is horrendous but the information is essential.
I’d still recommend the Leonard Zinn but note the most recent edition is 2016, may have omissions for current wheels and groupsets.
Yeah, I'm surprised. People come into a bike shop and come out with a reasonable bike unless they're really looking for something special. A Kickr stand and a bike which fits you "just works" in my experience. What exactly do you think an average person would need to do beyond that?
The price isn't that bad of a deal for someone inside all the time wanting a great bike to workout and the classes.
Thankfully, I'm kinda a nomad so I haven't done it yet, though the past few months I've been stuck in one location and debated about it.
hard
Try to find one! They're fun and good. It's all fake motivation and such but it's really good if you follow the yellow brick road and do it 2-3 hours a day.
One obvious reason is that no one cares what the exercise bike weighs and it will never be exposed to dirt or rain. That allows you to make a drivetrain that can trivially last past the useful life of the equipment without any maintenance ever. Meanwhile on the road bike you strapped to the trainer you have a chain, cassette and chainrings for no good reason - all of it ends up feeding into a variable resistance unit anyway!
Similarly putting a road bike you have used extensively on the trainer back on the street generally means doing a complete overhaul - you sweat salt water all over it and don't want your alloy handlebars to break in half because it corroded underneath the bar tape.
Ceterum censeo: we should focus on fixing the reasons that many people, particularly women, feel unsafe riding a real bike outside that they would rather stare at this screen going nowhere inside. Most of them without the mandatory two box fans blasting a hurricane their way, it makes me die inside just seeing that.
I have 3 friends that were hit by cars last year, 2 bikes and one e-scooter.
None of them were at fault.
He with the most lugnuts wins.
The cemetaries are full of people who were "right".
1) Distracted drivers. And it has no relation to age. I see old people using their phones, I see young people using their phones. This is number 1, by a huge margin, and it is just getting worse. I never use my phone, other than for navigation, while driving. Not even hands free. Leave a message.
2) Bicyclists that don't follow the rules of the road. Stupid young kids using both side of the road, and sidewalks, I sort of understand. We were all stupid young kids at some point in our lives. But there is no excuse for stupid adults. If you have a drivers license, you know the rules, they are not that hard. Where I live, more than two thirds of bicyclists ride to the left, against traffic. Lately, maybe as much as three quarters. My kids (young adults) all ride on the right, when they ride. They were taught that from day one. Does no one teach bicycling to their kids?
So I am out riding, trying to be aware of the roadway, blind spots, cars (worse, trucks on narrow roads), and as I crest a hill I meet another bicycle coming straight at me. WTF?
Of all the ways to crash - mechanical failure, operator error, 3rd party - this is the one that keeps you up at night? We come from very different cycling worlds...
That doesn’t seem like a bad thing? Instead for cycling, it seems...like an inherent property I’d expect a cyclist to actually anticipate and empathize with.
You're missing the point. It's not indoor cycling, it's more like at home spin class or soul cycle. The customer base is pretty different, and the experience is a lot of what they're looking and paying for.
Someone who knows what they're doing with road bike mechanic stuff can probably piece together a decent dedicated indoor trainer bike for $1000. Using a combination of used and new components.
Since my commuting distance is fixed, I want the ride to be as hard as possible, otherwise I don't train effectively enough. I should probably trade it for an even shittier one , to up the difficulty level.
This is certainly true, luckily my commute runs along a pedestrian waterfront, and I never go on the road, so I feel safe enough with it. Then again, I wouldn't ride on the road in Greece even with a $10k bike.
Are you riding centuries on a regular basis? Yup, $3000.
Are you just out riding to get some fresh air, sunshine, and exercise? $500 is plenty.
It's heavy? I am only riding twenty miles. Oh, and it has inch and a quarter tires, with a wee bit of tread, and I cannot remember the last time I got a flat tire.
As I opened with, it all depends on your goals.
It makes me wish there were an open, real-time, fitness data project that had more easily usable SDKs for these kinds of things (along the same lines as Golden Cheetah).
I get the appeal of Peloton. First, Peloton is fun. Zwift is so freaking boring. I listen to murder mysteries while on Zwift because I think it's so darn boring. I only do it because I feel like it's a more effective workout. And cost wise, I already have a bike. Second, I know tons of people who don't ever want to bike outside. It's too dangerous or too much logistics.
The classes are fun and they also include other things like strength, yoga, running, etc. There is no way to get classes around me for $12/mo or even $12/session.
I've attempted to answer this question before for others, but honestly, I've only ridden zwift once, on someone else's setup, so I can't compare how "good" the experience is.
That said, despite my involvement in the cycling world, I still have no idea how to Zwift. I know I need a bike, a trainer, some kind of device to play the 'game' part, a display, and sensors. Presumably the smart trainer has power built in, but I don't know if I would want BT, or if I'd want ANT and then an ant dongle for my computer/tablet. I know the words Zwift, Watopia, Sufferfest, TrainerRoad, and about 37 others, but don't know the relationship between them. I don't how how the whole ecosystem fits together, what I download, who I pay, and from watching others struggle with it, it's pretty clear there's a non-0 learning curve.
I know for a fact that I COULD figure it out, but that doesn't mean it's for everyone, or all cyclists, or all cardio enthusiasts, or all people into spinning. From the cycling groups I'm in, whenever Zwift comes up, it seems like people are always discussing what components to get to work best together. I'm sure once you get the 'right' components it just works, but it sounds fairly fiddly for newbies.
I also hate riding a real bike indoors. When we had a mag trainer, my wife and I NEVER swapped the bikes out; she wanted me to do it, and so the 'wrong' bike was always on the trainer, and it always felt so damn fragile to me. I'd definitely want to use a dedicated bike for a smart trainer, not one I try to ride outside.
Another (admittedly minor) factor is size. I actually realized that I physically cannot fit a bike+smart trainer in the space our Peloton bike goes in our workout area (with a Peloton treadmill and Precor elliptical).
I'm pretty active in a handful of Peloton FB groups, and it definitely feels like there's a tendency for folks who use Peloton and ride outside to head towards Zwift for their indoor training, but there's also a significant percentage of people who went the other direction, or tried Zwift and didn't like it/found it boring/etc. The video game competition aspect of it looks like a lot of fun to me, but not enough to bother investing in a setup.
So, that's my 2 cents. While I didn't personally make the purchasing decision, I've made a lot of similar ones -- pay a bit extra for something that just works, where someone already did the research and made the decisions for you, and you don't need a new hobby or project to make it work. The same reason I use Apple devices, the same reason I bought a Synology instead of building my own NAS.
There are plenty of completely legitimate reasons.
The bikes are about the same price, but the Keiser screen is a simple LCD display that's much cheaper to replace if it gets broken and is fully usuable without a subscription.
Plus, I think the bike looks better.
When I'm considering buying a smart device that I'd be uncomfortable throwing away if/when the company ceases support, I ask them beforehand: Is there an open API and/or SDK? Does code or protocol escrow exist? This saved me from buying a smart watch and a smart ring. The manufacturers seemed healthy at the time but were bankrupt or acqui-hired and shut down within a year.
"It's a $2k training bike. You could spend $1k and get a really nice brand new road bike and a smart trainer that controls resistance like a Wahoo Kickr Snap (or several others) for ~$500."
That being said the M3i seems to be one of the more flexible options if you are gonna go the stationary bike route.
I have a really nice road bike, and a decent steel framed commute bike. I've used both on a trainer, but it's not the same feel as a spinning bike, particularly when standing up and cranking hard on the pedals.
A good spinning bike will last a decade or more with little maintenance, but you'll be changing tires often on the road bike trainer as well as all of the other maintenance that comes with a bicycle.
You can get a good workout on a bike+trainer and if that's all your budget (or space) allows, it's a good option, just don't expect it to be a spinning bike.
I haven't actually tried pairing it to my iPad or other devices.
Selling a product whose interface/API/whatever is deliberately obfuscated so that the manufacturer also has a monopoly on a subscription service or an app for said product is blatantly anti-consumer, anti-competitive, anti-environment, and should be illegal.
Fuck Peloton. Fuck Flywheel. Fuck all the proprietary IoT companies.
And apparently fuck me for having the gall to want to control my air conditioner from my computer rather than GE Android app #12 that has God-knows-what baked in and that's going to be abandoned in two years anyway.
Nobody should ever feel like they have to throw out an otherwise functional refrigerator-sized appliance because of software obsolescence.
I am absolutely willing to die on this hill. We need a GDPR-sized hammer to fix this.
Not merely abandoned, but abandoned with gaping security flaws, no other way to update the device, and an always-on internet connection. We really have not thought this IOT stuff through.
And if it's not user that owns it in practical (control) sense, then I hate it already and personally won't buy it.
We had a solution and everyone pissed on it because the misinformed and perhaps intellectually lazy lawyers and leaders and yes even engineers convinced everyone that the GPL was unfit for a capitalist society.
“Was” is admittedly unfair because free software is not actually dead. It’s just popularly dead. If this type of crap actually outrages you, it’s not GDPR that we need (it makes no sense if you think about it, too), it’s smarter consumers and more courageous engineers/leaders. Go speak with your feet and use free software products. And help breath life into a culture that has been wounded by greed.
Some time ago I finally understood what's the point of GPL vs. just Open Source - the former is written with end users in mind, not developers. And unfortunately, these days not only developers aren't end users, they're very often working against end users.
or any abuse of power imbalances.
I'm still going to prefer MIT but this is probably the best rhetoric I've seen in favor of copyleft.
Free software isn't illegal. You can run Linux and not buy IoT/IoS junk. Yes, you might have to decline Netflix and Disney.
The only place consumers are screwed is when they get stuck with monopolists like John Deere -- and no one got "convinced" there, just screwed.
I'm simply saying people don't take the free software movement seriously and if you as consumer advocates and developers get frustrated by this fact you don't need to invent a "GDPR for software interoperability" you just need to advocate for software that protects consumers. And you need to do so even in the face of uneducated and uncultured business leaders, which takes courage.
The GPL was not created to help businesses, it was created to help end users, which for the most part means people with the know-how to understand software and improve on it or extend it for themselves.
[0] Maybe in the future when their capabilities get a bit better, but the gist is every device should respond to a 'hello' ping with a list of commands and NLP'able descriptions such that for an air conditioner 'alexa set temp 67 degrees F' just works.
One of my most-used automation setups is a dust collection fat near the cat litter boxes. The basic idea is to turn the fan off, if it's on, when the cats approach, then turn it on five minutes after they leave and turn it off ten minutes later. The cats are detected using a PIR sensor hooked to an ESP8266 running ESPHome. I've also got an automation which will turn the fan on and ignore the PIR sensor for ten minutes so that I can clean the litter without breathing in a bunch of dust - this part is kicked off via an input_boolean that's exposed to HomeKit, so I can tell Siri to turn it on and it triggers a whole bunch of work.
That said, there are devices out there that can be used on mains power that are UL certified. I have a ton of Z-Wave [0] switches and relays for various things all talking to Home Assistant. Z-Wave is an open [1] (or soon to be open) mesh networking communications protocol that is pretty widely used and supported, so you're not locked into a single vendor.
For low-power stuff, I'm a bit more willing to experiment, but not on mains power. But I am also not an EE. :P
[0] https://en.wikipedia.org/wiki/Z-Wave
[1] https://www.theverge.com/2019/12/19/21029661/zwave-open-stan...
It may be too small for an ultrasonic sensor to work well. The ultrasonic sensors I've used are all basically blind to anything closer than 5-10cm.
Solving that issue is a rather more obvious way forward. Wood, trees etc.
You should definitely fix that light though. That sensor may also be part of a safety cutoff to prevent burning out the element.
[0] https://www.amazon.ca/Kerick-Valve-MA252-Float-Adjustable/dp... This was from a quick search, I know nothing about this particular valve.
The hard part with checking the water level is that the boiler is pressurised and very hot, which is going to be hard in any sensor.
There are two water levels that could be monitored, the stainless reservoir and the brass boiler. Despite the metal I think it would still work for the reservoir, because this seems to be how new models work.
It’s the boiler I mainly want to monitor however, and it is very hot and is pressurised.
For controlling 110V loads, I've found that the Ikea TRÅDFRI outlets work well. If you stay within the TRÅDFRI ecosystem, you need a "steering device" such as a switch or remote to pair them to the gateway, but if you're willing to step outside that ecosystem Zigbee adapters like the ConBee II can talk to the outlets directly (I'm in the process of migrating my Ikea gear to this). The Home Assistant TRÅDFRI component works well.
Hit me up if you need any advice!
I just wish there was more truly open hardware out there.
If you want to build a smart light switch you are trying to get the response time very low and worry about things like syncing behavior around the network. Doing these things ends up being very domain specific and you do creative engineering to make it happen. These are very different than the requirements for say a vacuum cleaner.
Then we have standards that come out like Bluetooth mesh or HomeKit that say this is exactly how a light switch should work. Great, except your light switch has this cool feature that Philips did not think of in the committee meeting and now you are forcing it in and your product once again suffers.
These standards all suck, some small percentage of your customers want custom access (rightfully so), and a large percentage are comparing you on price and experience. The outcome is a closed off product. With maybe a cloud API.
Like I said this is why I don't want to work on these products anymore. You cannot win.
It's one things to want standards, but when it's still an emerging field, with so much different functionality, it's an impossible task.
Any poster who advocates standardization at this stage would probably be wise in reading about the early computing days, when you had so many different standards, before it crystallized behind IBM MS-DOS. Or even HTML, where would we be today if MS had listened to "standards" and not released XMLHttpRequest/MSXML library.
No ajax, no modern web.
This is a perfectly normal, and perhaps desired, period of experimentation where standards will just hold the industry back.
I don't. He's basically admitting his engineers are incapable of reading relatively short, well-written spec documents.
This stuff is standardized. BLE is extremely easy to use, both on a device and in an application. BLE makes it possible to create self-documenting devices that any application could use. Device manufacturers are going out of their way to prevent that from happening.
Sort of a duality to how lack of standards propels innovation in the nascent days of a technological field.
Not saying there shouldn't standards in general; simply that we should be cognizant of market forces using standardization efforts as offensive tactics.
The modern web could stand to let off the gas.
For that matter, would removing AJAX and modern JS have fixed anything, or would people have routed around the problem? Any alternate web I can imagine just ends up with everyone using Flash/Shockwave/Silverlight/Java applets, which are even worse. A handful of diehards stay on plain HTML, just like they do today, while everyone else moves to gigantic ad-ridden behemoths.
How many times do you encounter a website that doesn’t support your OAuth provider of choice? So you keep 2 or 3 around, and oh this site only does their own password based auth, OK I’ll use my password manager to make a one-off for this site.
Keep in mind, JS itself was developed by one browser vendor (Netscape IIRC) because there was a lack of a standard for interactivity on the web. These tools arise out of need, but because of capitalism the players creating the tools don’t work together. They stand to benefit if they can “win” and starve the others until the other solutions die, so that’s what they hope to do. It’s anti-consumer.
I don’t know what the answer is. Maybe it should be illegal for apps not to allow certain levels of interoperability and freedom to migrate. Hence a previous poster’s term, “GDPR-sized hammer”.
At the time you could lock up Android devices just by sending too many beacons and require users to factory reset there network settings.
When people say Bluetooth is easy I assume they have not done much more than GATT connections and a simple beacon.
Following a standard is great but extending beyond that for your own features or using a variation is still fine if the API is accessible by users.
This seems like it could be solved by a meta-standardizzation: a standardized extensibility model. So the light bulb supports "on", "off", and "dim", and the vaccuum supports "begin cleaning", "return to charging base" and "open dust cup lid", but both support a "Get model-specific register and function list" command, yielding something like WSDL.
Maybe Philips bulbs activate their RGB disco seizure mode with Model Specific Function 82, and GE bulbs have colour temperature control on Model Specific Function 74, but so long as the bigger, smarter device controlling both can query this and package it up for users, it works fine. And when your new vaccuum has "knit new cat out of collected cat hair" they can define it as MSF 74 if they want, so long as the catalog is accurate.
[0] >send 10.10.10.143 'what are you'
>> "A light bulb serial number ######"
> 'list commands'
>> on() | off() | color(int red, int green, int blue) | strobe(frequency)
>help color
>>"""description of color function"""
etc.
Where there isn't a predefinition for say 'strobe' specced anywhere, or 'light bulb' for that matter, but a person or reasonably intelligent AI can work it out from context. There does need to be a bit of a framework and around 'what are you' and 'list commands' for this to work.
I hope I've explained this well, but it doesn't seem far off for an AI to credibly facilitate the bulk of human-smart device interaction with a little bit of help breaking the ice.
[1] As you mentioned, scoping even a light switch without feature creep is a challenge.
The ESP8266 microchip is very popular for use with consumer IoT, because it includes not only a microprocessor with full TCP/IP software stack included, but also WiFi hardware that's compatible with most consumer WiFi systems, all on a 5mm x 5mm x 1mm IC. However, it doesn't even have enough computation power to implement 802.11x WiFi certificate authentication for standard enterprise WiFi environments. There's no hope for implementing an NLP DNN AI on chips like this. You'd "need" to upgrade from a $2 microchip to a $100 IoT Edge AI chip like Coral or Jetson, and now each of your $30 IoT light switches would cost $130 instead and consume much more power.
You could instead have a pretty standard telnet access with 'help' functions like most *nix programs have, but enabling any kind of telnet/SSH is often a big security risk with IoT devices.
Most home automation stuff doesn't have that big a command vocabulary.
"But web tech is insecure!"
If they can't secure a form post, what hope do they have of securing a proprietary api?
Yes, home appliances running webservers would have downsides for management, but that's where routers could add value. It would be trivial for a router to scan port 80 of every device on your network and present a page to pick your devices. That's something I'd even use an app for.
"Port 80? But what about encryption you complete monster!"
How the hell is that cert going to work? Even if they had some magical way to store a cert on the device securely, surely they're going to screw up keeping it up-to-date, or do you want your "it's MY device! Mine!" to depend on an external provider for security?
Just make sure the devices can run on some kind of VPN.
Router can keep them on a VPN and run a proxy with proper SSL for outsiders. Then you only need one device in your network secured to modern standards, all your IoT run in the router's IoT sandbox and all access to them is through a proper SSL-encrypted proxy portal.
There. It would be possible to make that layman-friendly infrastructure. Router detects you connecting to LAN device over port 80 and says "hey, this looks insecure, do you want to move this device to the secure sandbox? You can access all IoT devices securely through my app! Y/N/OMG this is awful never ask me again!"
It was a revelation putting a Pihole on the network and making a firewall rule that forced any non-Pihole port 53 traffic back to the Pihole. Samsung and Google make a lot of connections to home.
To me, the general model of selling/giving away a device that serves only to lock the customers into buying overpriced consumables is ethically questionable. I find it exploitative, dishonest, wasteful and anti-competitive. Such business model requires the corrupting the law to create completely artificial constraints, to make it illegal for competitors to offer said consumables, in order to prevent competitive pressure from pushing the price of consumables down to where it should be[0].
I can't give a detailed and coherent argument for why I feel that way, not just yet - part of the reason I comment in IoT/DRM/another-product-turned-into-bullshit-service threads is to try and discover that argument through discussion. But it really feels wrong, compared to a hypothetical reality where both the devices and their consumables were properly priced closer to the marginal cost of production, which can happen only if people can freely build on top of platforms.
--
[0] - And if I'm listing negative adjectives, I might add parasitic - in the sense that if you imagine business models as organisms, this one took over host society's legal system to ensure it could to outcompete more straightforward (honest) ones.
> Such business model requires the corrupting the law to create completely artificial constraints
So what? As long as no such laws exist that's fine, and a corrupt country will get bigger problems anyway. The problem is that it's not true since constructors can increasingly rely on complexity: reverse-engineering is getting more and more complex (see recent iPhones).
Manufacturers often do really silly things like encoding all the data into one custom attribute:
https://github.com/open-homeautomation/miflora/blob/31e59bdb...
All of this easily could've been done with standardized attributes but fuck interoperability lol.
> it cannot do anything else than SNMP-like get/put/trap on some attribute
It can do whatever you want. Nobody is forcing you to use ATT, you can speak anything over L2CAP.
And not just in the IoT field. Pretty much every company that could use their closed software/firmware/designs plus lawyers to enforce their right to render a product useless or obsolete, or simply becoming the only authorized to repair it then refuse the repair, so the user must buy a newer one, will eventually do that if allowed by the law.
John Deere has been really hostile to their customers, for example. https://www.vice.com/en_us/article/xykkkd/why-american-farme...
Remember that awesome time when Apple disabled phones, because they had a 3rd party home button installed? Absolute scumbags.
To my memory the bricking of phones was a bug related to not handling the non-matching key condition correctly. But I believe they fixed that bug quickly?
As long as RE is legal (and even when it isn't...), people will figure things out.
We need a GDPR-sized hammer to fix this.
AFAIK, RE for interoperability (which this is absolutely an instance of) has always been and is likely to remain legal in the EU.
Even many of the really popular ones take years to hack these days, because the mitigations keep getting stronger.
Do you have IR controller for your AC ? If so you could get one of those smart plugs that you can control remotely (zigbee, wifi service, whatever) and it will communicate with your AC via IR, you plug it in to the AC socket and then plug AC into it.
Any thoughts on a labelling system? Like, "re-flashable open source firmware", "cannot be remotely bricked", "API-spec and code examples included" stuck on the side of the box.
I'm surprised some hardware hacker supply company, like adafruit/sparkfun hasn't gotten on this yet.
Maybe "every IoT vendor must put their source code in escrow and when they go out of business the source code becomes GPL"? Of course they could just escrow incomplete software with parts just being sourceless blobs and no-one would have verified it is complete by the time they go out of business. It also doesn't work when they buy proprietary software bits from other companies.
Or are you saying you would like to see Right to repair legislation for software? Me too, but it won't happen.
I have one running for the last 6 years and I always say that it was the best purchase of an electrical appliance I ever made.
Super quiet also, my model is around 19dB inside and the outside unit is also quiet.
My aircon is infrared based so I bought a $20 infrared emitter, recorded all the button signals from the remote control and plugged it into HomeKit. Now I can voicecontrol/Remote control my antique aircon better than current models that still don’t support HomeKit
Bonus points: I put the emitter in line with both aircon and TV and use the same device to control both
To me, this stuff actually devalues the product. It has the potential to be useful but the way it is being used is to deny the buyer full ownership and reserve additional rights for the seller.
Otherwise yes, agree that subscription dependent IoT needs regulation.
I bought a segway mini years ago, only to find out you had to download an app before you could ride it.
Same with with a DJI mavic quadcopter.. you could not just turn it on and fly it with the included RC remote controller - it would just say "see app" or some nonsense.
both got sent back. Seemed a little silly at the moment (I just got this cool new thing -- cave.. cave..) but I'm way better off.
(turns out the mavic sends details of EVERYTHING to lots of sites willy-nilly)
If you provide the bike with a public API, it’s going to cost more. You now need to actually test the API works, instead of simply testing the bike works, end-to-end, with your own software.
A stable API with supported version changes and backwards compatibility is a much more challenging engineering prospect.
Forever ‘twas this. Maybe they can start by using something like an automotive CAN bus.
Wouldn't that defeat the purpose of the "smart device" (from the manufacturer's point of view)? The business model often seems to be locking you in to a subscription (rent seeking) or selling your personal information (surveillance capitalism).
What it points out to me, painfully, yet again, is that cool stuff can actually do everything its bought to do without a "monthly service fee." And yet here we are.
I avoid a lot of "smart" products in general, but feel comfortable with working on the equipment I do have --- whether it's maintenance, repair, or modification --- and I think that's the most important thing to keep in mind; to not be scared of treating things as anything other than mysterious black boxes. It seems that a lot of people treat "reverse engineering" as some equally mysterious and imposing idea, when it's really just about problem solving or figuring out how something works.
Also, I don't think the RPi is necessary here; the bike is a Bluetooth device, so any computer with a Bluetooth interface can receive its data and process it. I'm not an RF expert, but rebroadcasting BT seems like it would create more interference.
This should be the limiting factor, and this is often the case when a product was designed sensibly and the interface just wasn't documented. Reverse engineering a device like this is relatively straightforward.
But more often, companies deliberately obfuscate, encrypt, or booby-trap their interfaces in order to actively prevent reverse engineering, and this is the reason for the frustration you're seeing in the other comments.
The rebroadcasting is done because the goal was to get the data into a proprietary piece of software that expects data to come in over Bluetooth.
And rebroadcasting will actually be just fine on the air medium because right after receiving is exactly the time when the bike won't send another message.
The RPi is complete overkill of course, a tiny $3 nRF52 module could do that job just fine.
Lots of folks have additional constraints of time due to family/other responsibilities etc. I can afford to spend an hour or two if the API is open from the manufacturer's side to write a script or setup a simple service; I definitely cannot afford to spend time on packet sniffing or such low-level reverse-engineering.
> sudo setcap cap_net_raw+eip /usr/local/bin/node
Use AmbientCapabilities= in the unit file instead.
The community hasn't figured out how to root the tablet, yet, but there are some hints as to the manufacturer/boot-launch-software – https://www.reddit.com/r/FlywheelAnywhere/comments/gexqte/ha... – if anyone has any ideas or is interested in a challenge.
I'm all for hacking your gadgets, and open APIs, but let's get a sense of perspective.
I'm a little surprised, however, that Peloton, and Peloton-alikes ever happened because cyclists have training devices with open interfaces: Bikes, mounted on smart trainers that have standardized wireless links and protocols, connected to a choice of apps.
All it takes is taking the rear wheel off a bike. Or not even that for the most basic trainers, which clamp the rear axle and provide resistance to the rear tire. A fascinating case of a market segmentation that is less susceptible to being breached than one might think.
I have been tempted very often to just buy one of these ready to use training bikes because of the frustration of: put some yoga mat cut-outs underneath the Tacx to suppress the vibration of the spinning weight, get the bike from the cellar, exchange the quick release, store the old one somewhere where it's not getting lost, put the bike in place by its rear wheel, place the front wheel in a fixed position, get a fan to put in front of the bike trainer, mount the gear shifter, which clumsily hangs on the handle bar because my handle bar is too big. (It's a standard road bike handlebar)
Did I mention this thing was really loud?
I'm also sometimes worried about the fixed pressure on my carbon frame but I think that's actually unreasonable.
By the way, clip the resistance switcher on the top of your front wheel rather than your handle bars. Fits well there and is out of the way but still reachable.
Basically I want a home brew alternative for Zwift and TrainerRoad virtual power.
I've got a Peloton, have a Stages power crank on my road bike, and previously had Favero Assioma power meter pedals (highly recommended product BTW). I ran the pedals on the Peloton for a few rides to get a feeling for how close the calibration was. (surprisingly close, in my case).
The other option is to see if I can dig into the zwift or trainer road code. Both of those applications support “virtual power” for this specific trainer. Which is another way of saying that SOMEONE knows it. I’m sure that Saris actually shared the exact curve with Zwift and Trainer Road, but I’m not sure they’d share it with me.
(Probably best done with a different account.)
Mitch Hedberg
Moral of the story: choose appliances that support standard protocols.
And then I discover there is actually a market for it, and I am further dismayed... And amazed at the robustness of Say's Law.
Anyway, this bike and the whole associated product is preposterous.
Maybe that's your problem right there. Get a simple bike, leave the house (ok, I know there's Corona, I didn't say congregate), find someplace planar, and cycle in the real world.
In Amsterdam, a decent used bike will cost you the equivalent of 80 USD, maybe less.
It also has a climate geared more towards outdoor cycling.
Not everyone has one or both of those factors, making indoor cycling more reliable, safer, and more enjoyable
But even if he doesn't have a bike yet, he most likely would ride a road bike and you don't that for bucks.
I agree though, riding bikes is extremely underrated, no matter where you live.