Hacker News Reader

Comment by Neywiny | Hacker News Reader

I think it's about being a configuration management nightmare. If every device has a unique password, you need the decoder ring for serial number to password. However, not all processors have unique IDs. So you either need to find a way to reliably serialize each board during manufacturing and hope it stays (like a sticker/laser/printer/etc) or add a serial number chip which is cost and complexity. It's not impossible, it's just extra work that usually goes unrewarded.

View on HN

I'm a long way from embedded development. But I was under the impression a lot of microcontrollers these days have some ID capability built in, even some relatively low-end ones. This strikes me more as laziness than anything.

This is true, for example many stm32 series have a 96 bit unique id which is derived from the lot number, wafer id and position [1]. Even the low cost stm32g0b1 series I am using has them, but they are missing from some older series.

[1] https://community.st.com/t5/stm32-mcus/how-to-obtain-and-use...

Surprisingly it's not everywhere. I'm very in embedded development and cannot count the amount of time I look for "unique" "id" etc in a reference manual and come up short. It's certainly more common than not, but you often have to design systems for the lowest common denominator.

Moreover, on any device that is connected to Internet you already have a unique MAC address on its Ethernet or WiFi interface.

You can hash this unique MAC address, together with other data that may be shared with the other devices of the same kind, to generate unique keys or other kinds of credentials.

> It's not impossible, it's just extra work that usually goes unrewarded.

That sounds like profit motivated negligence, and it sounds like a standard justification for why Europe is going to hold companies liable.

It is indeed. And that sucks but that's what it is. Product design is about calculated risks and trades. It's a good thing regulators are here to help because companies won't do it on their own and the general public doesn't care enough.

We will all owe the EU a massive debt of gratitude. Hopefully USB C was just the tip of the iceberg.

I have not knowledge of this kind of software dev/hw production, so can you please explain why the units cant just be born with a default pass and then have the setup process (which is always there) Force the owner to set a new password?

Knowledge or not, this..

> It's not impossible, it's just extra work that usually goes unrewarded.

.. is just not an acceptable way for business to think and operate i 2026, especially not when it comes to internet connected video enabled devices

This is just people working 24/7 for 50 dollars a month? Because we want cheap shit

I am shocked really, i think this is actual law in China.

I'll answer your question with a question: how often do you see people complaining about needing setup processes vs the old way of just plug and play? There's no perfect answer that placates all sides. Things can certainly be better, but when those people win and you no longer need to have a setup process, then what?

While true that in $current_year it would be nice if things were more secure, the sad truth is that most people don't care.

I agree that yes most just want PnP and basically don’t care about security. But it seemed on the posts above that there was an engineering complexity, and a robot vaccum needs local WiFi, so there will be a setup flow. Whats preventing a password selection just be part of that?

> a robot vaccum needs local WiFi

No, it doesn't. Unless it's supposed to spy on you (or "harvest training data") there's no reason it needs to phone home at all (c.f. Roombas).

Well it needs to talk to either a web frontend (internet) or app (bluetooth or wifi). If you're worried about it spying, well, the app could always relay data for it.

Anyway regardless of wifi, bluetooth, or something else there will be a setup process.

You're begging the question. Why does it need to talk to a web front end or app? Why does any appliance need this? (I know they all claim to need it, but it isn't at all clear why this (supposedly) needs to be the case.)

For that matter, I'm unclear why there needs to be a setup process. I understand that this may be key to the vendor's business model, but that's their need, not something the products needs, and certainly nothing I need.

I'm not begging the question although I am implicitly assuming that the vast majority of consumers will want to control a robot vacuum via their phone. I suppose including a touchscreen on the unit itself is not entirely unreasonable but I expect that would be an uphill battle for various disparate reasons (expense, durability, and ease of use at minimum).

Once you introduce control via phone the most straightforward approach is either wifi or bluetooth which requires a setup process.

Reply on news.ycombinator.com