Ninja Sphere: Next Generation Control of Your Environment

Re:Ninja Sphere: Next Generation Control of Your Environment by Amadou on Tuesday November 12, 2013 @10:38PM (#6723192)

I don't see mention either way of subscription/cloud requirements. If it isn't fully self-contained, then the risks out-weigh the benefits.

Edit: Drilling down to the ninja blocks pages I see mention of a "ninja cloud account" as being required to install drivers. That sort of unnecessary external dependency is a deal-breaker for me, essentially negating the entire value proposition of open-source.

http://ninjablocks.com/blogs/how-to/9555237-installing-drive...

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by rsync on Wednesday November 13, 2013 @01:46AM (#6723771)

Agreed. I was, for instance, very excited about the new nest smart-smoke-alarms and just stopped reading and went away when I saw the first mention of my "nest cloud account" or "nest login" or whatever it was...

Thank god Sonos came out back in 2005 (or so) and was built without all of this nonsense - no doubt if it was released today there would be a mySonos web login account cloud identity blah blah blah...

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by nitrogen on Wednesday November 13, 2013 @01:54AM (#6723795)

Mandatory cloud connectivity is detrimental to the usability and security of an automation system. I, for one, will never add non-optional cloud features to my own automation products.

Some day I want to see more systems with a decentralized architecture, where cloud servers, if used at all, only help facilitate a secure VPN connection between the user's device (e.g. a phone) and the user's home network.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by thatguydan on Wednesday November 13, 2013 @03:19AM (#6723998)

The code on the device will be open source. If you wrote something that made it easier to use when the internet was down (or you weren't connected at all) and sent a pull-request you'd have a good shot of it being accepted. When the backend is released as O/S too there will no doubt be some effort towards getting it running on the device itself.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by amirmc on Wednesday November 13, 2013 @05:45AM (#6724377)

I'm working with others on a FOSS toolstack that makes it easier to build decentralised systems. Take a look and let me know what you think. http://nymote.org/

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by Amadou on Wednesday November 13, 2013 @06:12AM (#6724466)

All I get is a spinning blue dot. Your site is unfriendly to people who take their security seriously. That's not a good sign.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by amirmc on Wednesday November 13, 2013 @09:43AM (#6725423)

Thanks for the feedback. I don't understand your second comment though, how is it 'unfriendly to people who take their security seriously'? You can email me instead, if you prefer.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by pjc50 on Wednesday November 13, 2013 @11:54AM (#6726467)

I'm guessing it doesn't work if you have javascript turned off, due to the unnecessary "splash screen".

It does look like you're addressing the right problems with "Signpost" and "Irminsule". Am currently reading your slides.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by Amadou on Wednesday November 13, 2013 @01:31PM (#6727253)

Pjc50 is correct. Practically every browser exploit over the last decade has had javascript as an essential component. Forcing users to enable javascript to use a site is a bad idea because it makes them more vulnerable. Javascript should be a last resort to provide necessary functionality that is impossible to do in any other way. If you want to use javascript for frills, that's fine as long as the frills don't become obstacles if javascript is disabled.

To put it into perspective, NoScript is the 4th most popular add-on to firefox.

https://addons.mozilla.org/en-US/firefox/extensions/?sort=us...

Software like what you are developing needs to be designed with a strong security mindset from the beginning. It is a truism in the industry that security tacked on after the fact never works very well. I was extrapolating from the security naivete of your website design to the likely naivete of your software design.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by amirmc on Friday November 15, 2013 @12:08PM (#6740568)

Thanks, this is a helpful explanation. The site came from a template and I didn't think too long about the issue you mention (but I agree it's important [1]).

Regarding your final para, please be assured that the folks working on the software are 'best-in-class' and do have a strong security mindset as well as a deep background in internet systems. The software is the output of research work being done in the University of Cambridge and I made the site to try and showcase the work and provide more context around it. The front-end of the site may be lacking but that shouldn't reflect on the software we're making (though I do understand why people extrapolate).

[1] https://github.com/nymote/nymote.github.io/issues/10

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by nodata on Wednesday November 13, 2013 @09:51AM (#6725465)

WFM

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by malandrew on Wednesday November 13, 2013 @12:44AM (#6723584)

I agree. Why not open-source the other software parts under some fairly protective license like AGPL for the server and Artistic License v2 for the client interface to the AGPL-ed server. These licenses adequately protect you from a commercial entity coming and stealing the mass market business opportunity or the community, while still making it possible to support individual hackers like Amadou that can contribute a lot, but won't unless it is open source end to end.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by Amadou on Wednesday November 13, 2013 @12:56AM (#6723623)

I don't wish to give the impression that hacking on the hardware is my goal. I could, but I'd rather not. The reason external dependencies are a problem for me is that they take away my ability to control my system. If I have to hack together something to use it without the servers, then that's a marginal improvement over having to reverse engineer the protocol on the wire, but it's still really customer unfriendly.

Anyone who buys this system and makes it central to their home's operation (as intended) becomes exceptionally vulnerable to the decisions of the people who control the servers. Even if the developers' interests always align with my interests, I'm still vulnerable if their system gets hacked, if they go bankrupt (and shut down) or if they are acquired by a company with a different management perspective.

It would be like buying a car that has to check in with Lexus every time I want to start the engine.

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by nitrogen on Wednesday November 13, 2013 @01:56AM (#6723798)

It would be like buying a car that has to check in with [ed: GM] every time I want to start the engine.

Isn't that called OnStar?

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by jamesaguilar on Wednesday November 13, 2013 @02:58AM (#6723950)

Risk of what?

[ Parent | on HN ]

Re:Ninja Sphere: Next Generation Control of Your Environment by smelliot on Wednesday November 13, 2013 @03:07AM (#6723978)

You can also just SSH in and 'git pull' a driver if you prefer =)

[ Parent | on HN ]