Dean Roddey
Senior Member
We would certainly be happy to make that kind of deal with anyone who can get us hooked up with qualified installers.
Dean Roddey said:No, I'm not joking, and to know to turn the off switch off or to put into place serious protections you'd have to read the documentation and put in some effort to learn what's safe and what's not, which this thread sort of shows is not that likely since it takes a fair amount of learning curve. That's why there are so many homes out there that are dangerously exposed, and lots of hardware devices that are pretty much gateways into people's homes. It's a real problem. Given that most people would probably end up using it from outside the house, the issue is considerably worse.
Browsers typically use at best digest authentication, which is pretty trivial. If they are willing to learn about public key encryption and certificates they can set up their server so that at least their clients know they are actually talking to their real server, but most people would struggle with that. I struggled with it quite a bit myself. And that does nothing to protect the server from clients. Putting a certificate on the client for reverse authentication isn't much use since if the phone is stolen, then they have it.
You could do a little better with Websockets, but that didn't exist (fully baked) until relatively recently and wasn't supported by us to much more recently still. And Websockets requires an ongoing up connection to the server, which for many out of the house uses isn't necessarily practical. Something like simple, stateless HTTP query/response is probably more practical, but then you are back to trivial authentication.
Hey, Mr. Automation System Guy, my lawyer says you sold me a Trojan horse that let some hacker flood my house.
Frederick C. Wilt said:Dean certainly deserves a pat on the back for being willing to come here knowing what sort of things he might hear.
bbrendon said:Dean himself is the lowest.
Dean Roddey said:I wish we could find more IT type folks looking to get into the automation world. Though, a big part of it is always going to be physical, so they'd still have to at least partner up with installers who can get the gear into place.
Correct.Frederick C. Wilt said:"Lowest" as in priority (I hope) not as in, say, class - correct?
bbrendon said:Regarding what I think is severely wrong with CQC.
1. Responses from you like the last one. I've seen some of this on the CQC forums. It's fine, everyone is human. I feel your personality traits are getting in the way of some sanity sometimes. There are so many ways to hack a home automation system it's a joke. I just found a major security hole in the CQC UPB driver. If you want to speak like this, then I would have expected it to be pulled from CQC, a CVE posted, and a patch released. You can't play both sides. Pick one.
bbrendon said:2. CQC reliability. I love the vote "you FEEL CQC isn't reliable". SERIOUSLY?? I KNOW its not reliable. I've found SO many bugs that crash it. I even changed my network two weeks ago it make it "CQC friendly". ... guess what, happened a week later? It crashed.
bbrendon said:3. The GUI is a Windows GUI but it doesn't act like a Windows GUI. I feel like I'm in Sun's CDE interface sometimes.
bbrendon said:4. Web-ish-ness. No web stuff. Everything is done using Win clients.
bbrendon said:I run a business with a partner. After doing it with him for 10 years, I would NEVER EVER do it myself. You need another person to kick your xyz into line and peer review what you think is good, but in reality is a dumb idea.
The thing that intrigued me most about Zipato’s system is that it’s modular. By that I mean you start off with the main unit, which is Z-Wave, and add on other modules (i.e. ZigBee, Battery Backup, Security, 3G, KNX, etc.) to expand the system as needed. Another feature that really got my attention was the Rule Creator. This is a graphical interface that allows you to customize the system and create true automation without the need for complex programming.
Dean Roddey said:One thing I find interesting (in a bad way) is how people will shy off of a company like CQC because of our (current) size, despite the fact that we've been in business now for 14 years. Other companies can start and die off, abandoning their customers, but as long as they have a really nice web site (and hide their real situation behind marketing and bravado), people will just continue to jump on the next one of those, and ignore the company that's been here all along, making real sacrifices to bring a good product to market and keep it there. The company doesn't even have to have a real product out anymore, e.g. Kickstarter, and in all too many cases never will or it will never live up to what was promised.
But, hey, I'm not bitter or anything...