Re:NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
by l9o on Tuesday November 04, 2025 @03:55PM
(#45815784)
Personally, I think this might be an even better approach. The Nest Gen1/2 UI was pretty slick. It would be a shame to have to use a custom firmware.
Re:NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
by torginus on Tuesday November 04, 2025 @04:40PM
(#45816200)
Sounds fishy, if the device allows this sort of fakery, that means the traffic is vulnerable to some sort of MITM attack by DNS poisoning/packet rerouting, which is somewhat disconcerting.
Re:NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
by gruez on Tuesday November 04, 2025 @06:21PM
(#45817049)
>that means the traffic is vulnerable to some sort of MITM attack by DNS poisoning/packet rerouting
Because it uses https? OP gets around this by manually injecting his certificate, but if you have physical access to a device it's generally considered to be game over in most threat models.
Re:NoLongerEvil-Thermostat – Nest Generation 1 and 2 Firmware
by sedatk on Tuesday November 04, 2025 @06:11PM
(#45816972)
> if the device allows this sort of fakery, that means the traffic is vulnerable to some sort of MITM attack
No. This is a thermostat at your home. It forwards its DNS requests to your router. Feel free to establish whatever security protocols you need there. Or, even better, host your own server.
If you read the GitHub Readme (typically a better way to judge a project than stalking someone on LinkedIn) you can see that they didn’t write a custom firmware. They modified the Nest firmware to contact different back end servers.
The firmware is the same (they claim) except for modifications to change which server is contacted. They then built a back end to mimic the original Google serves.