All IoT devices Bricked after Insteon shuts down? | Hacker News Reader

All IoT devices Bricked after Insteon shuts down?

twitter.com

162 pointsClumsyPilot78 comments

The LinkedIn scrubbing is the most obnoxious part of this IMHO - we've learned to expect IoT companies to go out of business or just stop supporting a product at this point, but the people involved trying to pretend they weren't is ehhhhhhh

(highly recommend using home assistant and getting everything onto as much local control as possible, both to own your own data, and to know you aren't dependent on a phone home server being shut off. It can be a bit of a heavy list initially, but getting easier everyday, and onboarding is way quicker than 2-3 years ago)

You don't even need Home Assistant. Many compliant devices just speak UPNP and have MDNS so you can just use UPNP clients. There's even a nice GTK UPNP IOT GUI for Linux.

You don't NEED home assistant no, but likely if you have many different smart products form many different vedors and want to be able to see what is set to what and set up automations etc it would be nicer than sniffing packets to figure out what you need to say

Agreed. I use Home Assistant to standardize across the various devices I have. I have a collection of misc. Hue bulbs, Tasmota-compatible plugs and other random devices.

HA acts as a HomeKit bridge, meaning that as long as I get a thing working with HA, I can control it from my Apple ecosystem.

Do I need it? No. But it's extremely helpful and still meets my goals around data ownership and no dependency on an Internet connection to turn off the lights before bed.

> but the people involved trying to pretend they weren't is ehhhhhhh

Nothing wrong with removing information about yourself in some random online profile. When the only thing that is coming from that is angry people yelling at you, I'd just as soon do the same thing. I'd get awefully bored of repeatedly pasting something like, "Per a legal agreement I have with my former employer I cannot comment on this issue," and then blocking the sender for their inevitable rage-reply.

Better to just let the rage subside and then quietly add that back in your profile so you can tell a good story about an acquisition gone wrong in a future job interview.

Personally I am highly hesitant to deploy IoT at home, and I will definitely eliminate any product that cannot function without an Internet connection.

Enough of these ephemeral systems that becomes e-waste as soon as the company behind it goes bankrupt.

> and every single device they've ever sold is bricked.

That’s simply untrue, Cory.

I have a couple dozen Insteon switches, all controlled locally (by a non-Insteon controller from Universal Devices, which way predates the Insteon hub) and everything works exactly the same as it has for the last dozen years.

People who bought the Insteon hub and have no local control are a bit screwed, and if / when my interface module dies, I’ll be screwed too. But all my switches will still have local control.

> exactly the same as it has for the last dozen years.

As long as no zdays for Insteon hub show up. In that case, you.f**ked(goat.tied).

It seems that you should not factory reset Insteon switches, as a call to home server is a part of the startup.

The scrubbing of the LinkedIn accounts was a classy touch.

So by this logic there is no way to not brick devices when a company shuts down. You could OSS the code but to first order nobody will bother using the community maintained version so it still creates just as much e waste.

> So by this logic there is no way to not brick devices when a company shuts down

Uh, don't make the device phone home? Make the phone home optional? Don't put software in it in the first place? There are many ways for devices to continue working long after the manufacturer is dead and forgotten.

Something has become clear to me: Since the IoT industry refuses to regulate itself, we need environmental legislation to regulate this industry.

Done! But it still wont get any security updates then so by the parent’s comment it might as well be useless.

Why couldn't they simply allow initial setup without the phone-home, then recommend a user-initiated phone-home for updates only (or request to continue auto-updates, etc.)? If I stop receiving security updates, at least I could use the devices in an isolated network, or through a separate firewall/controller, whereas the former case is just a paperweight.

I have several Insteon switches too. They've never connected to the internet and they never will -- because they have no mechanism to do so. Insteon is a powerline carrier (PLC) protocol coupled with a local RF protocol which is neither wifi nor bluetooth. The use of an internet-connected hub with Insteon is optional.

Factory resets are a non-issue with my switches.

Simple feildbusses with a hub are definitely the way to do this. Eventually you can replace the hub with something better without having to rewire the building.

This only works if your hub already completed an initial setup:

> If you are a spurned Insteon user seeking to move your hardware to some other system, whatever you do, don't factory-reset your Insteon Hub. Apparently, contacting Insteon's servers is a key step of the initial setup, so this may now fail.

Seems like you're fine until your hub dies, but you'll have to switch everything once it does.

Not true. I don't have and have never owned an Insteon hub. I have no reliance on anything from Insteon in the sky. I have an ISY-994i which controls all of my Insteon gear.

My switches don't communicate with the outside world and as long as I have a functional PLM connected to the ISY, I'll be able to control them. There are probably ways to do that without a PLM too.

I will likely move to something else soonish though, likely Lutron. But I want to be clear that for those who have Insteon and have never relied on the Insteon hub, they can keep chugging along for now.

Insteon devices have switches on them allowing you to link them without a hub.

Jumping on to agree: it is absolutely untrue that the devices are bricked. The hub and app are just pretty useless right now.

In fact, with Insteon, you can even set up and link devices manually without any hub at all, using the "set" buttons on the devices. The scenes and links and triggers are all stored locally on each device, iirc.

How relevant is this for the vast majority of Insteon users? Is this possible for everybody else with less technical knowledge/interest?

That really sucks, but this is exactly why I refuse to buy any smart-home devices that I can't control directly and work with Home Assistant. I prefer bulbs and switches that I can also reflash.

I do have a few Wyze cameras because they're cheap and I needed something "now" for a vacation home hours away, but long-term I'd like something that works either with Synology or control myself and preferably that I could reflash - again without cloud connectivity requirements.

FWIW Wyze makes an RTSP-enabled firmware that, while not as featureful, works well with Surveillance Station.

Yes, but overall the RTSP implementation is absolutely terrible. Wyze cameras are a novelty, but any permanent implementation should use something better.

This RTMP/RTSP/HLS docker container bridge is leagues better, and there's no firmware to mess with.

https://github.com/mrlt8/docker-wyze-bridge

I have Lutron Caseta switches. They can be controlled entirely locally. You can't reflash them, AFAIK, but they work with Home Assistant just fine, and it's all local (it doesn't need to talk to a web service)

Maybe Ubiquiti's lineup would be something for you?

Don’t all Ubiquiti device phone home now? At the very least they require a controller to manage, and flashing openWRT on them is a pain.

Depends on what you mean by "all Ubiquiti devices". My Unifi APs, switches, and EdgeRouter don't need to phone home and the controller can be run (intermittently if desired) on your laptop or a VM. My parents have an all-Ubiquiti network and the only time they have a controller in their house is when I come visit and do an upgrade.

My network has an always-on Ubuntu VM hosting the controller, but it's not needed for normal operation here either. (It is needed for things like guest portal pages and some network stats tracking.)

I just tested my local admin login and it still works. (Now, can I guarantee that nothing has even called-home and told Ubiquiti about that? Of course not.)

Cameras are a different ballgame; Ubiquiti cameras are much more tied to their software and hardware (and thus I don't have any).

UniFi devices don’t need to phone home, but they do try to collect telemetry

https://help.ui.com/hc/en-us/articles/360042384093)

Didn't Ubiquiti recently start to push cloud management for all their devices? I don't use their products but I recall seeing a heated discussion on HN about this.

Unifi Protect requires a) their hardware, either a UNVR or a CloudKey Gen2+ or higher and b) their cloud to SSO into the mobile app. If you don't want the mobile app you can use it entirely locally, but you still have to use their hardware.

edit: I know this because I have a Unifi Protect system.

+1 for HA.

I'm using some Tasmota firmware gear, ie outlets from Athom, just works, no cloud, all mine forever.

Any local camera recommendations?

I got quite fed up with existing solutions and bought a couple of ESP32 + camera to try to create my own.

I use a Reolink NVR and then I pull the feeds into Home Assistant for viewing. I ran ZoneMinder for years but you really have to make sure your hardware can support it and you are using the right disks. Moving all my cameras to their own dedicated hardware was the best decision I've made when it comes to cameras.

Yes on "refuse to buy any smart-home devices that I can't control directly and work with Home Assistant" but I'll go a step further. Only buy Z-wave/Zigbee or devices that use a similar standard (ESP32 comes to mind, especially with HA's new-ish core integration with that).

Wifi devices are a mess and you are often still reliant on a cloud/app for setup.

The Arstechnica article Doctorow is linking to: https://arstechnica.com/gadgets/2022/04/shameful-insteon-loo...

This is why I warn everyone to only buy devices that use a standard like Z-wave or Zigbee and ideally use a hub that works locally. I first got into IoT/SmartHouse stuff with SmartThings but I only would buy Z-wave/Zigbee which paid off in spades when I moved to Home Assistant. All my devices came over and the manufacturer didn't matter.

Wifi IoT devices are terrible IMHO. Yes, they are easy to add and cheap to buy but you are left juggling 3-4+ apps even if they all talk to Alexa/Google/Siri. Also you are putting god-knows-what on your network. Yes, you can put them on their own vlan but still, I do not like devices in my house that can phone home even if they can't see my local devices.

Stick with Z-wave or Zigbee (ideally pick just 1 or 1 main one) and if you want a nicer onboarding then SmartThings is fine but Home Assistant is probably more attractive to people on HN. At least if/when SmartThings goes under you can move your devices to a new hub.

I just started automating my house, mostly with ZigBee.

For WiFi stuff- setting up ESPHome and programming ESP32s to do whatever it is I want them to do (report sensor values, twiddle gpios to control an h-bridge, whatever) is stupid easy. Highly recommend anyone who's been meaning to try ESP32s but hasn't yet take the half hour to try it out.

ESP32 is my 1 exception to my "No WiFi rule". Really I use that rule as a blanket statement since 99.9% of what people are talking about when they have a WiFi IoT device is crap. I don't personally have any ESP32 devices but I'm not opposed and at some point I want to play with them. I've heard very good things about them on the various subreddits and on the HA podcast.

I was skeptical at first, then I assumed it would be too hard to set up, then I gave it a shot and was pleasantly surprised in every way. They're cheap and worth grabbing a few to play with, and when you find time to play with them, you will get farther with them faster than you thought you would.

I'm not a security expert in the least and I have never heard of this company till it folded, but I've got a question. How do they prevent someone from later acquiring the domain down the line, and then talking to these devices for malicious purposes? Do these devices expect a specific certificate, and won't communicate regardless of the domain?

That would be the proper way to do it. But I doubt a random IoT company does stuff the proper way...

It's easy: they don't. Certificate pinning in IoT devices is pretty unlikely.

If you're lucky, some engineers added signature validation for firmware updates, but then your device is a brick because you can't do anything new with it.

A long time ago on a BaaS platform I worked on, we dealt with an IoT company that pinned certs and when we rotated them they had no way of updating their devices... I think we had to put them on their own server and just left the old cert running forever. As the sibling comment here says, "I doubt a random IoT company does stuff the proper way..."

This will inevitably happen at some point in the future. And it could be very very ugly, depending on what hardware is compromised.

There is no chance that we can count on IOT manufacturers to pin certificates or to have any motivation whatsoever to focus on security. That is up to the user. So we really need some sort of firewall / antivirus / etc. living on the user end to defend them from this.

Insteon, Insteoff

comment of the year right there

I’m just shocked and amazed. Presumably this company had hundreds of employees, millions in revenue, etc. what would have caused them to disappear like this?

I’m guessing there is a large legal aspect we haven’t heard about yet. Somebody did some crimes.

I looked into insteon products a few months before this, and there was that much community activity about it. Nobody really has talked about insteon products in the past couple years much, which has led me to believe they were dying as a company.

I think it was a competition thing. There is way more cheap stuff out there now, and insteon is known as annoying and unreliable (as in devices die after a few years), so the high end market just moved to lutron.

But to have no sunsetting. Unreal.

I believe they were bought by private equity a few years back and their MO is: buy, leverage and go bankrupt. This fits that pattern.

I've stopped buying IoT devices. At first I thought, "wow, how neat, I can turn lights on with my voice." But really, switches work fine. They cost $5, don't really fail, and have filled their role since the ~1880s. I'd rather spent my mental energy coding or building more interesting things than futzing around with IoT.

We had to mute an echo dot because our toddler was constantly trying to tell it to play songs, and alexa kept misinterpreting his requests into not-child-appropriate music.

Solution is straightforward, although often not plug and play - only use IoT devices that you can control, based on ESP8266 or ESP32, that can be flashed to Tasmota, ESPhome, etc and controlled with Home Assistant.

Similar here. I'd rather set up my own home tech than pay for some connected service. My stuff isn't actually smart home stuff, but stuff like PoE security cameras with ZoneMinder, home assembled cycle timers to run sprayers or air bubblers (agriculture related), etc.

I built it, so if it breaks I know how to fix it. No chance of the cloud shutting down bricking my devices.

IoT switches work fine (specially those with local control) and they can have the exact same role as the current switches - with the ability to also be controlled remotely. Which means that you can control them even if you are not present. Those downstairs lights you forgot to turn off? Yes, those. Or maybe you forgot to turn the coffee machine off and went on a trip? Can be turned off too, remotely, on a timer, or by sensing the reduced power draw once your cup is done.

They can also be turned on and off based on presence, on time of the day, on the fact that you just turned on your TV, etc.

If companies were actually trying to make good products, there would be almost zero drawbacks if we turned all current switches 'smart'. It's just a single bit in the case of switches and lights. The problem is that they want to monetize said bit in addition to the device cost, they want it to talk to a cloud, they want to make it so only their hub can flip the bit, etc. Oh, and they will have unnecessarily complex firmware with security vulnerabilities and that require regular updates. EVEN when most of the logic is in the cloud, which is mind-boggling. And cloud integrations will randomly fail.

I do like the ability to be able to make all things 'smarter'. In particular, I want to be able to collect data from all devices(this all feeds to Home Assistant in my case). When you have all the data, and the ability to remotely control, you start thinking of all the use-cases you can automate.

Today, I can automate when light switches turn on or off, I can have my robo vacuum not run if my 3d printer is running so it won't bump it, I can have reminders to plug in my EV (when the @#%6 Nissan API works properly). I have locally controlled power switches. I can have reminders when laundry is done. If my dishwasher was 'smart' I would be able to control when it runs (as it is, I'm going to jury rig my own solution). Also thinking about automating my garden next (I already have weather forecast information, just need moisture sensors and a pump).

Honestly, we could turn our homes into a Star Trek ship bridge today, if only companies got their act together. I think there will be an 'IoT winter' as consumers get fed up with all the shenanigans.

I like really minimal IOT that solves meaningful problems in my life. This way I have more mental capacity to live! My mailbox lets me know when the mail person has deposited materials inside. My garbage cans remind me when they're not on the street on garbage day. When someone pulls into my driveway I get a photo of their car texted to my phone. My power and water meters can be checked from anywhere in the world, and if I need to, I can shut off the water supply to the house remotely. My generator lets me know when it needs service. My chest freezer lets me know if it doesn't have power. Etc etc. I only install smart switches as repeaters for the useful stuff.

Local IoT switches (ZWave/Zigbee/etc.) are kind of the best of both worlds: being able to switch off at the wall, plus being able to control digitally/remotely.

For example, I love being able to switch off the living room's lights, as well as all adjacent rooms' lights, all with two taps on my iPhone, without getting up from the couch. Also nice is turning the lights on/off at certain hours of the day, or when certain triggers occur.

My setup goes: ZWave wall switch <-> (Raspberry Pi) [ZWave hub <-> Mqtt <-> Homebridge] <-> AppleTV (Home Hub) <-> iPhone. Despite all of the moving parts, this has been 100% reliable for me with near-zero latency. It even works well when I'm away from home (albeit with a tenfold increase in latency)

Unfortunately, this setup is not a low/no configuration one, so it's not a solution for the vast majority of people, and is why internet connected IoT (Nest/Alexa/Hue/Insteon) are as popular as they are.

Agreed. Except that companies are now trying to deprecate those protocols. Used to be called "CHIP", don't know what the latest name is for the initiative.

> Used to be called "CHIP", don't know what the latest name is for the initiative.

Matter [0]

[0] https://csa-iot.org/all-solutions/matter/

I use IKEA wireless stuff (which in turn use Zigbee) and, outside of a relatively slim range of products, they work great. Good quality stuff, easy to set up, and continue to work even if my internet cuts out.

And they're cheap. When I started messing around with smart home stuff the IKEA TRADFRI line bulbs were around $10-15 while Philips's Hue was at about $50.

I agree, they work good, but one thing I love most about them is that, if you use IKEA's gateway, they neither require nor provide "the cloud". Everything's local, it's great.

Seriously more people need to realise this. Is there a shortage of interesting problems to solve? No. Then why do we keep spending our valuable energy on trivial things.

What I do is I think about the massive challenges like climate change and then compare it with what I'm doing. Immediately makes me realise what is worth my time and what is not.

Climate change was just one example. There are some things in my personal life that are just as scary as climate change for me. Immediately snaps me out of wasting my time.

Spending energy on trivial things is called recreation or entertainment. If you are only going to spend your time trying to solve serious problems, then what really is the point of solving those problems anyway.

Interestingly, having automated lights and detailed power monitoring has helped me to reduce my average electric consumption by around 20%. Imagine the impact on global warming if everyone reduced their electric consumption by 20%.

I can relate to this. In the past, I've had smart switches and smart light bulbs everywhere, and could also control and measure power usage for many circuits/sockets in the apartment.

Everything was connected to the Home Assistant.

This setup worked 99,9% percent of the time, but occasionally there would be some issues, especially if WiFi or power was down, which would usually mean that devices wouldn't connect to the WiFi, or in some cases ZigBee light bulbs would go into pairing mode (I guess ensuring that I use more expensive Philips Hue bulbs everywhere might solve the latter.)

At some point I just figured out that I want my light switches to work 100% of the time, regardless of the status of network or connected devices (Home Assistant NUC or ZigBee bridges), and that I don't have practical benefits from all the automation and data gathering (Grafana dashboards were nice, but didn't really improve my life in a meaningful way.)

In an article covering bad engineering resulting in bricking, I think it's relevant to point out that Insteon's kind of bricking is impossible if you choose the right product, and which product that is.

I did some research before investing in home automation. I settled on Z-Wave exclusively exactly because there are multiple manufacturers in the market, their devices are interoperable, and I can use Free Software controller software that I host myself that doesn't phone home. Admittedly I am dependent on binary firmware blobs embedded in every device, but at least my system has no Internet dependency whatsoever.

'I am dependent on binary firmware blobs embedded in every device'

As long at they follow a standard, i think this is somewhat acceptable

What do you use for your hub software? I've heard good things about home-assistant.io but I haven't tried it.

I wrote my own (in Python+trio). I still need to publish it :-/

I'm sure Home Assistant would also be fine though!

Currently it uses openzwave, but I found that it didn't suit me very well. So I have a half-written replacement for the low level protocol parts too, to eventually take it to pure Python.

Home assistant has deprecated open zwave and is now using zwave JS. Which has worked very well for me so far.

this is the kind of IOT hell i hate. sure you can open and close your power strip from anywhere in the world but when you FORCE the said power brick to first talk to their server and then flip the switch, aka it wont work locally, that is the scummy kind of company that i refuse to give my money to.

I honestly don't understand why these companies aren't publishing their code for both firmware and server source.

AFAIK, they aren't charging any money for this shit, so why not make it open source so, in the event you go out of business, your customers can figure out workarounds. Bonus point, you'll get security fixes for free.

I agree that publishing the source would be positive for the consumer, but I can think of lots of (variably sensible/moral/legal) reasons why they wouldn't:

- A public-facing codebase is a reflection of the company, and thus needs to be polished and maintained in a way that a private one doesn't.

- You might have trade secrets in your code base that you don't want your competitors to have

- Even without explicit secrets, your code base is a substantial investment that any competitor will need to make themselves in order to enter the market; publishing the code would give that to everyone (and let's not pretend that licensing terms and copyright will prevent a knock-off hardware manufacturer in a less cooperative country from reusing the code wholesale)

- Alongside the free security fixes, you give adversaries more opportunity to look for, and exploit, flaws in your security.

- The IP represented by the source code has a value that might well be a substantial part of your company's valuation, in which case you might need to sell it as part of an acquisition/bankruptcy proceeding.

- (I am not accusing Insteon of this, but) if you publish your source code, you may expose all the 3rd-party code you are using/modifying whose license terms you may not be respecting.

Many offer upgraded options that they charge money for. But I think the main reason they like to do web based is to make the system easy to setup for remote access. 99% of their customers are not going to want to figure out how to open a port on their router so they can control it with an app while away. And then of course you have to deal with dynamic IP addresses and other edge cases.

Recent discussion: https://news.ycombinator.com/item?id=31056027

https://twitter.com/internetofshit

Best Buy did the same thing with their HomeKit compatible light switches - they were nice enough to give you gift cards equal to the purchase price, and the switches continue to work just fine with HomeKit, though maybe you cannot set up new ones.

They also annoyingly blink a green LED because they can't contact the server.

Does anyone know the current state of WebThings? I dabbled back before Mozilla dropped it and it seemed cool, but with some rough edges. I wonder if it survived the transition to a community run project.

So, could this lead to legal action?

Only if they really screwed up their licensing agreement.

But if they have, I'm not seeing information that they filed for bankruptcy, so they (or their owning company) may be at risk.

Reply on news.ycombinator.com