If you're interested, I sell a dedicated Sonos music controller (built out of wood no less). It's available at https://turntouch.com and it's entirely open source so you don't have to worry about me taking your data and selling it. Earning money based on the initial sale is all that I want out of my users. That and props.

That's a neat and well executed product. Kudos.

Can I ask how it works to protect my data from Sonos? Don't they still get all the same data?

What you do with the remote is between you and what you control. I store anonymous metrics that I use to gauge usage levels but you can turn that off. Sonos undoubtedly takes your listening habits and profits off that data but Turn Touch does not, even though it has access to that data.

> I store anonymous metrics that I use to gauge usage levels

How valuable has that data proven to be? Is it worth collecting?

It tells me which features I should invest more time in getting right and handled edge cases and which features nobody but me uses and so it’s not worth the extra effort. I only have so much time!

Is it opt-in?

Has spying on your customers revealed any surprises?

Assumedly it can be used to inform which features are most used by customers, and thus most worth investing additional development effort in.

OK, I was wondering if you were a complete middleman between me and Sonos. I don't own one, but I would consider it if there were a way to keep their paws off my data.

Btw, this is a tough crowd, getting downvoted for a simple question like this. Sheesh.

Seems cool, and perhaps I'm missing something, but it appears to require a closed-source app from a walled-garden app store to configure it, so it could easily be made useless if the app disappears?

Check it out, 100% open source: https://github.com/samuelclay/turntouch-ios. The Mac app, the firmware, and even the CAD and CAM designs are also there. And I documented everything so you can get a peek into how it was built if you want to change the designs for yourself. http://ofbrooklyn.com/2019/01/3/building-turntouch/

Everything I build I want to last beyond myself. So beyond the source code I also write about the why for everything. That it improves sales is a nice bonus.

> by having it run on a disconnected network

This is only a temporary solution to the problem of devices phoning home against your wishes (or knowledge). The "system-on-a-chip" CPUs used in embedded ("smart") devices with an integrated cellular (LTE/etc) modem have existed for years[1]. The hardware that can simply bypass your local network and phone home over the cellular network already exists. The people that want to spy on everyone for profit will no longer ask for internet access through your LAN when someone finally negotiates with the carriers for some sort of low-priority/off-peak access they can use to batch-upload their eavesdropping ("analytics").

[1] random example from "Q4 3014" https://en.wikipedia.org/wiki/Exynos#List_of_ARMv8_Exynos_So...

> when someone finally negotiates with the carriers for some sort of low-priority/off-peak access they can use to batch-upload their eavesdropping ("analytics").

I can happily confirm that Canada’s telecom oligopoly will never allow such a thing to happen.

Discounts for off-peak cellular data? Bwahahahahahaha

> The hardware that can simply bypass your local network and phone home over the cellular network already exists.

Wouldn't such a thing require an antenna that you could remove or disable to function?

Speaking of... is there a more effective way to disable a cellular modem than removing its antenna? Like some kind of component that you could replace the antenna with that would mitigate any residual antenna-function of the remaining wiring? I want to do this to the modem on my car.

Just strategizing: a wired in jammer should work.

Or a micro-wireless jammer that’s so weak, it wouldn’t even disrupt anything outside of what it’s built into.

Even if you can’t block the outgoing signal, you’ll disrupt the incoming signal and prevent any kind of handshake from happening.

> is there a more effective way to disable a cellular modem than removing its antenna?

Wrap it in aluminum foil as a Faraday cage?

> Wrap it in aluminum foil as a Faraday cage?

That's not a practical solution for a car.

Basically, the problem is the car's electronics have a cellular modem component, but I want everything besides that to continue to function and receive other radio signals. I can disconnect the antenna plug, but my understanding is that will just make the reception worse but not eliminate it.

I'm wondering if there's something simple and safe that would basically act as an anti-antenna, and absorb or interfere with any signals the rest of the electronics manage to pick up or transmit. I don't know much about electronics, but I was thinking maybe some kind of passive component, like a capacitor or resistor, might be able to soak up any residual signal.

I know I'm in the extreme minority here but I also hate Netflix, Amazon Prime, Hulu, Spotify, Apple Music, and even Youtube tracking what I watch. For youtube I watch lots of things in incognito mode. I like the idea of getting recommendations. I hate the idea of a profile being built on me.

Yes I get this Sonos is arguably worse since they're spying on stuff not from a service. iTunes does this as well though you can opt out. Oculus does it too. No opt out there AFAIK. Steam as well. You can add in PS4/Switch/Xbox too.

Does the law preventing companies sharing your video rental history apply to internet companies and streaming music, videos, and games?

> They used to sell dedicated controllers/remotes years ago but these were also bricked as part of an upgrade about a year or two ago.

Would a class-action be successful in a situation like this?

Years back, Sony updated the PS3's software to remove the 'otherOS' feature (i.e. the ability to run Linux).

Apparently they lost the class action, but only paid out a couple months ago.

http://www.otherossettlement.com/

My Sonos system is by far the biggest slice in the “Blocked” pie chart of my PiHole dashboard. I have no idea how much dat still ends up on their servers because I didn’t bother to dig too deeply yet.

Next step is different VLAN with no internet access.

Just for conformity so I don't bash and run, it seems Philips (Hue) has taken the crown recently with ~30 times more attempts to call home then the next culprit, Microsoft. MS also snuck ahead of Sonos.

A lot of these attempts are probably due to the fact that they fail and keep retrying. Possibly allowing them all would lead to far fewer attempts.

"... Unfortunately I have a Sonos system ..."

How very funny - as I read the OP and was clicking into the HN comments, all that I had on my mind was "Sonos".

I wish I had the time to clearly and succinctly elucidate the path of Sonos, corrupted by the mobile ecosystem and a reach for easy profits, from a darling hardware provider that users loved to a wannabe data broker that I hate-use.

Does anyone know of a good (from a privacy and usability perspective) alternative to Sonos?

I plan to buy 5-6 of them sometime later this year, and for what that costs, they have no excuse to data-harvest me.

Quite a few people run systems with a Raspberry Pi, a high-quality I2S DAC+amp, and a set of (normal, non-internet-connected, firmware-free) speakers. There's a tiny industry of producing hardware and software for this situation.

"Usability" means very different things to different people (after all, the reason Sonos asks for location access is to improve usability), but maybe look at https://volumio.org/, http://www.runeaudio.com/, http://moodeaudio.org/.

Or just install MPD and Pianobar for that old school experience.

What were you looking to get out of a Sonos? If you just want something that can play music wirelessly from various devices, I'd recommend getting a pair of bookshelf speakers and plugging them into one of (Airport Express, Chromecast Audio, Raspberry Pi[1]). You won't be locked into Sonos and generally bookshelf speakers sound better than all-in-one units. I'd love to recommend some speakers if you're interested (e.g. [2]).

I have run a few Airport Expresses for the past 10 years and love them. Older models are cheap (<$30) and still work great.

[1] https://support.hifiberry.com/hc/en-us/articles/205699981-Ho...

[2] https://www.amazon.com/Micca-PB42X-Powered-Bookshelf-Speaker...

Low cost SBC (Raspberry Pi, etc) and whatever speakers you'd like. Airsonic or a basic UPnP server as your driver.

Take it a step further (if you prefer portability of sound quality) and get an SBC with a bluetooth adapter, and several bluetooth modules which you can rig up to each speaker.

Well, there's snapcast that allows you to relatively simply build an alternative, but I don't know if anyone builds and sells ready-made products.

You can probably go by using a couple raspberry pis (or any ARM board with a jack output), a preconfigured SD card image, and some external speakers. I don't know the price of Sonos speakers, but I don't think it would be much higher. I guess someone could even create a business out of this, especially if tailoring the PCBs to the task.

You don’t mention which ecosystem you live in. I’m very happy with my Apple Homepods. The sound quality is great and I trust Apple with privacy. I don’t use Siri at all (I have disabled the microphone) and so for me they’re purely network speakers which are very easy to use and look after themselves with updates.

I've used Libratone [0] for years. Superb products. Excellent audio.

[0] https://www.libratone.com/

Do you want to stream audio from online streaming services, or just play local files from your NAS/PC?

Bose has a competing range called Soundtouch, no idea what their privacy is like but usability is good.

It is such an outrage that it is now just taken for granted that your hardware and software will be remotely attacked by the manufacturer. It doesn't even raise eyebrows anymore.

And looking at the Sonos debacle, I don't think they realize how damaging it is to their brand to just make their devices die every so often. Why not just save money and get something that is unreliable because it is cheap and poorly engineered?

I can't see how situations like this aren't anything but a bait and switch. You buy something, it changes out from under you.

This is why I'm getting sick of cloud services like Dropbox and I'm trying to bring it all back under my roof

Example: Dropbox's $99 plan used to be able to share a link with password protection, that's been conveniently moved to their $199 plan.

This simply can't happen with self hosted/controlled alternatives that you control updates to.

I've found Dropbox to be notorious with this. Their business plan used to be only $150/yr (Fine Print: you pay minimum 3 seats.) That magically changed to five seats at some point and now the $150/yr suddenly shows up as $750/yr auto-renewed and almost impossible to cancel.

How is it impossible to cancel? Are cloud services becoming modern equivalents of gym memberships? Do you have to fax them?

It was a manner of speech. There was no way to get out of the 2 extra magically added seats, even though you agreed to 3, you pay for 5 because they changed their minimum seat policy. I spoke to customer service over and over and they wouldn't even point me to the agreement I signed...just the agreement on their website (the new one.)

The Adobe Cloud suite certainly is. It took me nearly an hour and a half on customer support to cancel my subscription after it autorenewed without my consent. They tried to charge me a full year of service as an early termination fee, as though they were a 90s cellphone carrier.

Protip for anyone else in this situation: The only way to make the cancellation happen without the fee is to repeat "I need to talk to your supervisor" to the drone on customer support, no matter what they try to tell you about not being able to waive the fee. They will never, ever connect you to a supervisor, but they will eventually waive the fee before hanging up on you.

Is there not an alternative to Dropbox that offers better service for the same if not lower cost? I understand that they could pull the same bait and switch on you but maybe there are providers who wouldn't do that or grandfather you in.

I eventually completely terminated the account and moved to Google Drive. I got lured into DropBox because I was an editor to a book that required DropBox to access manuscripts.

The way they were set up, I ended up having to upgrade to a business user given the shared file sizes I was editing (had something to do with the book publisher being on a business account as well.) I ended up paying more for DropBox than I even made as an editor. Brutal.

It felt like a mobile phone contract: seemingly inexpensive, sneaky, convoluted, and before you know you have a gigantic bill committed to for the year.

That is why i cut the cord on my cable tv. I dont understand how companies can accept the ill-will of bait-and-switch tactics -- is it really more profitable than an upfront deal where each party feels it was an honest deal? I mean, I dont mind paying...but I want know know what i'll be paying and decide accordingly. Cable TV is a virtual monopoly, but DropBox is not and I dont know how they can deal with ill-will from former customers, once bit twice shy.

Host your own Nextcloud on a NAS, and have the most popular files synced? Be sure to make proper backups. On the short term, it will be expensive, but the investment will pay off.

I'm also using Stack by TransIP. 1000 GB for 0 EUR/month, with e.g. offers of 1250 GB for 2,50 EUR/month. TransIP is by made by the same people as bunq (its Ali Niknam's first successful company)

Intention was to set up next cloud on a rock64 talking to my nas as backing store - but it turned out more difficult than I originally intended, might do it all on AWS instead - still not sure and didn't have time to try again

I use mega.nz, I don't know how it compares but I am very happy with it.

That's the issue with using cloud services... what used to be your data is now their data.

I have been on the fence of buying a Sonos because I've always loved the sound quality but I could never bring myself to spend so much on them, your comment along with comments in this thread have made my decision easier. I'm going to stick with my dumb speakers and avoid all the hassle that comes with "smart" devices.

Building a dumb system will also provide a much better audio quality if you're willing to spend some time researching what to do. Plus it's of course more flexible as all parts are replaceable separately.

Sounds like lawmakers need to enforce warnings labels on such products: „works only with sensitive data collection“ or similar.

This is worse, in a way - from what I can tell at the point of purchase the system didn't have the problematic data collection - that was added later in an update. Even a savvy consumer who researched which product to buy would be screwed in this circumstance.

It does seem to me that once a product is purchased, it ought to remain usable and supported under the terms it was purchased under, but that seems a long way from the current laws around user agreements.

The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase.

That said, I'm not sure you can really pin this down. It's probably better to just assume that any device that requires a wi-fi connection to work is phoning home until proven otherwise.

And you have to assume that any device that phones home is collecting data. It's not even a secret that this is the case. Pretty much every time I go to a lunch-and-learn for a data product, the major premise of the obligatory client case study is, "We sell this consumer product that does X, but our most exciting product is actually all the data we can harvest from it and then resell."

> any device that requires a wi-fi connection to work is phoning home until proven otherwise.

It's really beyond me why people are buying these devices in case the wifi functionality is completely superfluous and has nothing to do with the main function of the device. It's like asking "hello strangers, tap me and track what I'm doing". This crap needs to stop.

I think this should be approached more broadly, making void any clause on contracts that allow unilateral modification on the contract at a later date

> The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase.

This is IMHO a broader issue with products that receive firmware or OTA updates, it's probably legally a breach of contract already to modify products after sale and change functionality to the disadvantage of the consumer.

Example off the top of my head: you have devices in the field which have not received an update since they were purchased 10 years ago.

A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc.

But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.)

You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.

> What do you do?

Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.

The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread.

But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".

I bought a Roku via NowTV, and used it for NowTV and sideloaded an app for local media display on our TV (music, family photos).

Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload.

In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification.

In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again.

Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.

You mean the contracts saying that the vendor gets to do exactly that that we all sign without reading?

I prefer the EU approach where the collection and use of personal data is regulated, not merely "be warned."

What difference does it make in practice? Sonos sells their products in the EU as well, do they behave differently there?

The difference is that they can be sued here in the EU now.

They don‘t.

The label would be useless at this point. You know how in California everything causes cancer? This would be the same.

CLASS 1 SURVEILLANCE PRODUCT

Come to think of it, this is the real work rivaled of an API breaking change. It seems entirely reasonable to that we should have regulation that prohibits this kind of change after you've already purchased the product. But then again, in a sane system, you should either need to sign the user agreement for anything at purchase time or be allowed to return a device whenever you encounter a the (new) user agreement. Currently you might buy something that you cannot return and only then at the user agreement. The user aren't should be seen as pay of the purchase contract and the purchase shouldn't be valid without it being signed.

A sane system would consider the knowledge and power differences between the average individual and the corporate lawyers who wrote the agreement, along with the one sided nature of the agreement, and void any consent as not having been possible to give. Likely the agreement would be treated as one signed by a child, where the more powerful party is the only one bound by it.

I don't have any internal data, but I expect that the percentage of Sonos users that play music from a local source is in the single-digit percentage now. The product they sell is focused on supporting streaming audio and voice control, all of which involved 100% monitoring of what you play and ask for. You're just not their customer anymore.

You can find old used squeezeboxes on Ebay, and their server software is just a big perl script. That might meet your needs.

It’s the reason I would never buy Sonos. I’d be interested in seeing an EU user give this the GDPR treatment