There's also the bit where Zigbee devices have to share a secret key to talk to each other, mostly to prevent competition from low cost devices manufactured in China.

Yeah! They want you to use the high cost devices manufactured in China.

Or mostly the same cheap devices manufactured in China but sold through your friendly middlemen.

No, American Marketing Companies (Apple, Amazon, Google, Etc) want to use the Cheap China Manufacturers, they just dont want consumers to be able to buy them direct

When they kept the already known secret key for pairing bulbs in the new supposedly secret version of Zigbee it was obvious they didn't care about security at all

After all the "S" in IoT stands for Security.

I literally have an SSID on my Ubiquiti WAP with that as the name.

> mostly to prevent competition from low cost devices manufactured in China.

mostly to prevent competition from patent-infringing clones manufactured in China.

FIFY

I actually worked at Ember for a bit before leaving when they get bought by Silicon Labs. The reason, internally, really was the fear that there would be a flood of low quality products that would make ZigBee look bad.

For that, you need certification, not gatekeeping.

Publish a set of tests a device must pass, broadly, to be certified compliant.

Allow manufacturers test their devices, for a fee, and win a certificate, or know where they failed. Much like you can take a language exam (say, TOEFL).

> fear that there would be a flood of low quality products

That's mental gymnastics. The fear is having to compete against cheaper products (possibly low quality, but possibly not). Even broken DRM is an excellent anti-competitive tool because no one can legally sell a competing product.

as opposed to ZigBee making ZigBee look bad as it stands now. Only big names looking for a lockin pick ZigBee.

Key exchange for IoT devices is a tricky problem.

IoT devices don't support public key infrastructure, e.g. something like GnuPG or the SSL certificates used by web browsers.

It's a very practical solution to have a shared secret between the device and a central server, and, at registration time, have the central server make a key for both the hub and the device.

Without some kind of key exchange, people could set off your alarm, turn on your lights, open your door...

The solution is to have a pairing mode that allows the device to be paired with a control device (e.g. your phone) via wireless while you're in the same room as it. That would only have to be done once when it's installed and require pressing a physical button on the device while being in wireless range so that nobody can hack it remotely.

I will no longer install apps on my phone to pair devices. The reason is that then everyone wants to link my phone number to the device and create an account. There is nothing that intrinsically says they have to, but companies cannot resist asking for a unique identifier that happens to be linked to everything else in your life. No thank you.

So who says you should need their app? It should be a published protocol, and then you use whatever app you want that speaks the protocol instead of some heinous dreck from the manufacturer.

The part where they can't resist?

So no, there will not be a published protocol.

Isn't the topic of the article that they are trying to create a standard?

Isn't the topic about amazon, apple and google?

Probably most toxic companies on earth? Yeah, I'm sure it will be a wonder of openness.

Like ZWave has done for the last several years.

I know it has other issues, but particularly since ZWave2, the security model on ZWave far surpasses bluetooth or zigbee

Out-of-band pairing is a better idea, e.g. some key on the bulb has to be entered or scanned or read on the device.

The trouble with that is that you can't change it in case e.g. some temporary visitor to your house snaps a picture of the key.

If you as an individual has visitors who come to your house and snap pictures of codes in your devices... I wouldn't be more expectant of Zigbee or any other standards, rather I would be more keen on the visitors I allow into my house.

That shouldn't do them any good. The device should require it to be in pairing mode for the key to do anything.

But then what do you need the key for? In theory somebody else could try to pair with it while you have it in pairing mode, but they would have to be on your property for that and could potentially see the key anyway. So you go slap them with a trout or call the police or something, and then go back to setting up your future garbage.

So that that initial pairing is more secure.

Zigbee etc. tries to get around the whole thing by requiring that the pairing process is done from a 5cm or something distance.

Imho that is good enough but I don't know how far you could extend it with directional antennas etc.

That anyone can reclaim a device they hold in their hand is a feature.

I'm not a fan. If I get a new hub, the last thing I want to do is unscrew every light switch to find the picture on it to scan and if I buy a house with pre-existing hardware I don't want to rely on the last owner having taken pictures associated with every switch and left it for me.

OOB pairing could have rolling keys, but that's more expensive. In general the problem is difficult, every solution has a nasty caveat, be it taking over during installation or what your described.

If you look at the Zigbee member list, there are many China based companies. They don't need to 'steal' anything as members.

The comment mentioned nothing about stealing.

True. I was looking at TheKarateKid comment about infringing companies. The country where most stuff is manufactured, white labelled and sold at a premium by brand names :)

I'm sort of reminded of the book "Schiit Happened" from the Schiit guys (they make cool headphone amps). They documented how they started their business.

One thing they mentioned is that apart from RCA jacks, all the surround sound standards are tied up and closed.

Anyone else knowing any industries where "standards are tied up and closed"?

To understand some of the reasoning of what is open and isn't you can look at the different versions of their IPR, testing and use policies. There used to be 'profiles' but they were merged into one version: 3.0 IPR version 4 allowed anyone to use the specs and develop product 'based' on Zigbee and didn't protect anyone from IP enforcement from the many patent holders. This caused a lot of issues around 'interoperability' and end user adoption. "It says Zigbee but it doesn't work with other 'Zigbee' devices." IPR version 5 moved to improve interoperability and enable members to increase development by increasing protections. It granted RANDZ between all members. It improved interoperability by only allowing the use of the name and logo if the device was certified by an approved test house. This did increase deployments and reduced interop issues. Now there is IPR version 6, which allows for the growth of other protocols, providing the IP protection developers, manufacturers and retails want and could enable further industry consolidation - which is good for the end consumer. The average Joe and Jane just want stuff that works without having to be a technical expert. Any open source move is probably about getting more developers exposed and involved to help grow the base both creators - and consumers.

Well, it also talks about using Thread, which I just learned has the same "must be a member of blahblahblah" restrictions (https://en.wikipedia.org/wiki/Thread_(network_protocol)).

It reminds me of the old "FireWire vs USB."

Firewire was an originally open standard, but there came Apple and demanded to exact a symbolic 1$ per device payment.

Despite FireWire being an indisputably better standard from technical standpoint, that 1$ completely ruined the mood with OEMs, and they lost the market.

USB on the other hand, was not really open, but Intel's central leadership in it guaranteed that there were no disarray with association peers throwing random capricious demands.

Most USB implementers were random Taiwanese OEMs who never formally joined the USB-IF, but nevertheless Intel was smart enough to close eyes on that.

>Firewire was an originally open standard, but there came Apple and demanded to exact a symbolic 1$ per device payment.

What? Firewire was a project initiated by Apple in mid-1980s, which then was further developed by the IEEE P1394 Working Group. Patents and pooling was part of it from the very beginning, with the primary drivers being Apple, Panasonic, Philips, and Sony (there were also a half-dozen odd smaller contributors). I don't remember there being any sort of "originally open standard" part to it whatsoever. Yeah, Apple owned the trademarked name "Firewire" for IEEE 1394, while Sony and TI used "i.LINK" and "Lynx" respectively, and Apple initially tried charging extra for that which was really stupid (but late 90s Apple was pretty dysfunctional). But even without that wasn't there still the standard $0.25/unit manufacturer royalty?

If you've got some other sources I'd be happy for the trip down memory lane because it's been a really, really long time since that particular battle. I'm not disagreeing that Apple's charge definitely harmed momentum, just that it's not like they came out of nowhere. Though it's worth noting that Firewire was inherently more costly anyway since it required dedicated silicon rather than handing everything off to the CPU. At the time that also gave it vastly more reliable real performance and latency vs USB, and Firewire 400 would typically obliterate USB 2 despite the latter having a sticker speed of 480 Mbps. But it was more inherently costly IIRC.

1394TA was open as far as I remember

HEVC, VVC, H.264 are also Open Standards, does not mean it is patents free or Royalty free.

While VP8, VP9 arguably isn't as much of of Open Standards, it is not patents free ( Neither is AV1 ) but Royalty Free.

Margins on most consumer electronics are extremely small. $1 per device may seem symbolic, but it starts looking like real money at scale.

I own many USB gadgets that I bought for less than $10. Paying 10% of the retail price for the privilege of using a specific port/protocol seems out of the question. Even for low-end computers (~$300) $1 for a license is a lot of money.

FireWire also had a few port types which required different cables and connectors, while USB at the time only had one (this was before Mini and Micro USB). Apple even included dongle converters with their iPods.

USB also had the advantage of Intel pushing it, resulting in almost every PC with an Intel CPU (large majority) having USB ports.

> USB also had the advantage of Intel pushing it, resulting in almost every PC with an Intel CPU (large majority) having USB ports.

In the mid to late 1990s, USB was scarce. It didn't take off until after Apple replaced its ADB (Apple Desktop Bus) port with USB in the first iMacs. Once that happened, manufacturers flooded the market with consumer products (e.g. CDRW drives) and PC makers followed suit. Up to that point PC makers had standardized on the serial port.

I don't have contemporaneous links at the moment but the second paragraph of a relatively recent (2015) article summarizes:

> But Apple shocked the computing world when it swept its old connectors away with the original 1998 iMac. The bulbous computer adopted a then-struggling standard developed by Intel called USB (Universal Serial Bus). In a hint of what was to become the company’s ability to make or break certain technologies, USB would go on to live up to its “universal” descriptor and become the most prevalent connectivity standard in the world. The solid-and-hollow stacked rectangles of its “A” connector now appear in everything from alarm clocks to airplanes. [0]

[0] https://www.fastcompany.com/3044088/apple-and-usb-a-history-...

That neglects to mention that Microsoft Windows 95 OSR2 launched a few months before (97) and that entire release was centered around better USB support for a broader range of components. (e.g. CDRW Drives)

I don't think its fair to say PC "Followed suit" in using USB.

If I remember at the time peripheral manufacturers had USB devices ready to go for the Win95 launch and Microsoft fucked up and couldn't get USB support ready in time. So Win95 shipped without it and peripheral manufacturers were utterly livid.

The next couple of releases of Windows included totally redesigned USB support.

Once Windows 98 hit though, USB was well supported on the platform. During a brief stint in late 98 through 99 I worked at a consumer electronics chip manufacturer (56K modems and DSL) and we had good support for USB on Windows 98 and Windows NT at that time.

> I don't think its fair to say PC "Followed suit" in using USB.

I didn't say that. I said, specifically, "PC makers followed suit".

Microsoft may have supported USB in their OS, but PC manufacturers lagged.

I doubt Apple had anything to do with pushing USB's widespread adoption. Apple was at one of its lowest points during this time period, and it was pre OSX.

The poor support in Windows, as well as peripheral OEMs still using other ports slowed its adoption.

I think the problem was that USB can charge only @ 5 v vs firewire @ 12 v

There is just one open standard. User having root access to the IOT device and scripting there whatever it wants. Any 3rd party dependence is a way of collecting and selling data (google and fitbit acquisition) and should be prohibited. Vote with your wallet, dont buy devices that prohibit you root access and make 3rd party servers access mandatory. Simple as that.