Hacker News Reader

Comment by bognition | Hacker News Reader

The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes.

My guess is this isn't about sending data to those sites, but rather using relying on high availability urls that you can connect to from most countries.

Is this bad engineering? Probably. Is it nefarious? Probably not.

One thing to keep in mind is that the companies making these smart appliances do not make their money from the internet connected features. Internet connectivity may be enough for to push a buyer over the edge or for the device to qualify for some rebate.

The manufactures make them from selling ovens. This means they probably don't have the best software development team or processes.

View on HN

When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk might have broken some things.

There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.

A good use case for using HEAD instead of GET

Ancient wisdom… easily forgotten.

There are alternatives like simply pinging the servers or one of the many alternative DNS servers like 1.1.1.1 or 8.8.8.8 that are out there.

Some internet connectivity check endpoints I see in my home networks:

- http://detectportal.firefox.com

- http://ping.manjaro.org/check_network_status.txt

- http://connectivitycheck.gstatic.com/generate_204

- http://captive.apple.com

- http://www.msftconnecttest.com/connecttest.txt

- http://api.ipify.org

The manjaro one will respond with "NetworkManager is online" when accessed from curl, but redirect to manjaro homepage when accessed from a browser.

Given that nuclear subs were supposed to use the ability to pick up BBC Radio 4 as a signal to determine if London had fallen, I think, no matter how improbable, it would at least be prudent to check the MOD didn’t have any alarms set to go off if the BBC website stopped responding on port 80.

XKCD 1172 is both fun and realistic

I was on the phone with my BT customer support a while back and part of their debug process was to ask me to ping bbc.co.uk.

Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...

I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.

Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.

Do you know how many ovens there are? The AWS lambda fees are going to be insane!

So much cheaper just to ping google.com instead.

Hopefully no one is using lambda for connection health checks. An empty static page on a CDN is probably a better use of resources.

But yeah, at that point just ping google since they’ve spent millions on availability.

I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.

Let's see: ping packet size is say 64 bytes so 128B both ways

My $3 VPS has 1TiB/mo bandwidth limit. So that's 2^40 / 128 / 24 / 60 / 30 = ~200k ovens pinging once every minute (which is ridiculous frequency) for $3

I guess if manufacturer can't afford $3 per 200k ovens sold, he should go out of business or stop stuffing ovens with IoT shit. :)

It is always better for debugging purposes to be able to distinguish if the problem is with the client's connection (if google/baidu/yandex all are not reachable) or with the vendor server (if those former are reachable but the vendor server isn't).

Then ping your own server, and if there’s a failure then fallback to pining another public service with known high availability to determine if it’s an Internet issue. Pinging Yandex by default every 5 minutes is not necessary

Why pay for bandwidth when you can make Google take the cost?

I don’t agree with it but I’m sure it saves a few dollars.

You don't pay anything. You either complete whatever you intended, or if there's no connection to your server, no request hits your server.

It doesn't save anything.

The devices would reach out to other third party services as well. The check would ensure they didn’t pointlessly do so. Knowing whether there was internet or not was used for a lot more than talking to our own servers.

> Well, just connect to your own service, then?

When you’re pinching pennies as a startup there’s a real cost associated with that. Several thousand devices checking in every few minutes isn’t expensive, but abusing Google was free.

Fwiw I’m not defending this, I’m just saying it’s common even if bad practice. There’s a reason IoT devices have a bad reputation.

I can't imagine this passing code review on any project I've worked on.

It was a startup, things weren’t super strict.

looks like an OR relationship.

Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.

Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.

that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google.

Guess you're out of luck in Turkmenistan, but works well enough most other places.

For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.

No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known.

As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch...

I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.

I agree its probably benign, but its really hard to trust companies these days to do the right thing. Consumers are basically being treated as sheep to be sheared.

And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents).

This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.

You can never tell if it’s a covert channel.

Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected

What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way?

Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.

Oven usage data is probably extremely valuable for advertisers.

The things you can do with statistical methods nowadays might blow your mind if you think there is not much information in oven usage.

You could infer likely occupancy periods of the home, since obviously if the house is empty no one is pushing buttons on the oven, and use some basic priors (9-5 jobs, x number of kids) to develop what is likely a pretty accurate model that would be profitable to sell to advertisers. Perhaps there are sensitive voltmeters on the power supply that can detect usage of other devices on the same circuit. Not to mention that it is yet one more channel of information alongside the flood of data being generated about you and your home by the rest of the devices you have incorporated into your life, and these things tend to have superlinear benefits when combined a la "multi-task" ML contexts. This is not an exhaustive list.

Moreso, you never know if there's some logic bomb inserted in the response.

And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.

I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).

Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.

Removing antennas from electronics isn't too hard, or worst case, physically damaging them or installing faraday cages.

Seems like an interesting cottage industry that could bloom around intentionally stupifying your unwanted smart home.

I'm sure they'll just throw error messages until they've managed to establish a connection. Device manufacturers have already shown they'd rather cripple your devices than respect your wishes.

Antennas on cheap consumer devices are often just a trace on the PC board. Still not that hard to remove (could just cut the trace), but harder to do without damaging anything than unplugging an external one.

Enclose your kitchen in a Faraday cage.

I was about to scoff that even if the oven, fridge, microwave, and dishwasher are all talking to each other, I'm not going to connect any of them to the Internet.

But then I realized that my neighbor might connect his to the Internet, and that a low-bandwidth 433 or 900 MHz radio mesh can hop from house to house until it finds any house that's connected to the Internet.

BRB, off to replace my drywall with a Faraday cage...

Amazon Sidewalk already does this. For what it's worth, they claim you can opt out. I'm not sure I trust that the transceiver is always off.

The best feature of an internet connected oven is that the clock is always accurate. No more manual updates after a DST change.

or a notification on your phone when the oven is at temperature, has been left on, when the timer has gone off...

We've had clocks for decades that synchronize to atomic time sources accurate to within 1 second over 100 million years that automatically correct for daylight savings time that do it all by just listening to publicly available radio broadcasts, no wi-fi or information harvesting required.

This solution is so cheap that you can buy it in the cheapest alarm clocks.

This is not a good reason to have wifi on an oven.

> We've had clocks for decades that synchronize to atomic time sources accurate to within 1 second over 100 million years that automatically correct for daylight savings time that do it all by just listening to publicly available radio broadcasts, no wi-fi or information harvesting required.

In the US we have:

https://en.m.wikipedia.org/wiki/WWVB

> WWVB is a time signal radio station near Fort Collins, Colorado and is operated by the National Institute of Standards and Technology (NIST).[1] Most radio-controlled clocks in North America[2] use WWVB's transmissions to set the correct time.

Radio time has never worked for me in Boston on any of the devices I've owned. I'm sure I'm not alone. It's simply too far away or there's too much interference or both.

Atomic clocks are less reliable and require more expensive circuitry. Everyone has wifi and a simple SOC that has everything needed to run the oven, display, and do WIFI at the same time can be found for pennies. Plus, internet connected is a selling point.

Huh? Wifi soc is way more expensive than a statically tuned radio receiver. The atomic clock isn't in the device, that's the point.

I was thinking more of the case of poor reception where you need a receiver outside and the device is inside.

Ok, I did not know about that. Why isn't this more popular? I have a fancy $1000 high end microwave that does not have wifi and does not sync its time. We've learned to ignore its clock.

If only everything in my home would sync to my local NTP GPS time source...

WiFi should provide a clock even if you're not connected.

Some routers (e.g. asus with asuswrt-merlin) can intercept all NTP traffics and redirect them to router's NTP server.

Can you elaborate, how does that work? Just having a wifi radio chip, you can get the time by listening to other wifi broadcasts in the area?

This came up in a Reddit thread[1] yesterday; anecdote from there[2]:

> "My favorite part is I have 3 Samsung Wifi Appliances including microwave and double oven and I really couldn’t think of a great feature other than the clock automatically setting. Well fuck me when I found out they don’t set themselves at all, and in fact they don’t even have memory so the slightest power outage means I have to reset $3k worth of appliances manually. Oh and each of them have different ways to set the clock so it’s always fun trying to set them differently in PM. No I’m not salty."

[1] "Appliance makers sad that 50% of customers won’t connect smart appliances" - https://old.reddit.com/r/Futurology/comments/10l6vl0/applian...

[2] https://old.reddit.com/r/Futurology/comments/10l6vl0/applian...

Just finished reading "Ubik", I found it partly amusing and also prescient that to get thru a door or make coffee required putting a nickel in the slot. Practically everything required a small payment in order to use it. We seem to be almost there: cars, ovens, tv's, dishwashers...the list goes on.

Yes, agreed. No other writer has so well captured the helpless, bemused terror of being imprisoned by small helpful machines.

> Is this bad engineering? Probably.

Curious, how would you implement it?

They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.

So what IS the correct way?

Reply on news.ycombinator.com