ZH version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
55% Positive
Analyzed from 4959 words in the discussion.
Trending Topics
#data#more#don#access#api#https#car#companies#open#same
Discussion (187 Comments)Read Original on HackerNews
"where the user cannot directly access the data from the connected product or related service, the data holder must make the readily available data and necessary metadata accessible to the user without undue delay, in the same quality as available to the data holder, easily, securely, free of charge, in a structured, commonly used, machine-readable format, and continuously/in real time where relevant and technically feasible."
There is even special EU guidance for vehicle data for it: https://digital-strategy.ec.europa.eu/en/library/guidance-ve...
There doesn't seem to be much written about enforcing the Data Act, so I looked at the regulation directly. Article 39 [2] seems to require to first lodge a complaint with the competent authority as designated by the member state of your residence. Then when that authority invariably fails to act – I have no idea which timeframe we're talking about here – you can "in accordance with national law, either have the right to an effective judicial remedy or access to review by an impartial body with the appropriate expertise". But then you are suing that authority, and not the company directly (edit: I was originally unsure about who to sue under article 39, but 39(3) does clarify that it is the authority).
I would very much like to be wrong about this. I can imagine Muñoz vs. Superior Fruiticola applies [3] ("it must be possible to enforce that obligation by means of civil proceedings"), but I'm not at all sure, and it's a much weaker route than the one which the GDPR explicitly describes.
Would anyone know or have better references on how to enforce the Data Act, preferably individually?
[1] https://gdpr-info.eu/art-79-gdpr/
[2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:...
[3] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
Just let the EU enforce these laws like the US DOJ or FTC would. If I had to file a complaint with the Alabama FCC or the Mississippi Federal Reserve to get relief under federal regulations I would quite simply not bother
We might argue they will produce better/worse results than another DPA. Okay. But the whole point of much EU policy is that the member states preside over stuff themselves. That seems better than a (more) centralised bureaucracy.
https://drivesomethinggreater.com/eu-data-act
I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.
This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assistant" in the local press. This list circulates, and since nobody in the middle management wants to be responsible for anything, and there is no officially approved positive use case, draconian countermeasures are drafted and constructed one by one.
Except when it’s about privacy or anything else we actually care about: then absolutely nothing is done because it would cost more than 0 to do anything.
Of course, if that privacy risk came from them storing and selling your data, they happily accept that, you are right in that regard.
https://www.thedrive.com/news/shadetree-hackers-are-stealing...
It's pretty sad that "User used their product in a novel way we didn't expect" is seen as a risk that must be mitigated.
I hope I won't be in one of those cars when the in-memory encryption key gets bit-flipped by the unfortunate cosmic ray.
They appear to have seen making their Home Connect platform open as at least in part a matter of compliance with EU data transparency and portability laws.
Take a look what the automotive risc-v people are working on or the requirements of the EU cyber resilience act.
https://imgur.com/a/nj0dLku
https://www.meatpi.com/products/wican-pro
r/opensource_legalaid let's reply and demand access to the data.
https://github.com/robinostlund/homeassistant-volkswagencarn...
Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?
They don’t. Majority of users don’t care, and some middle manager shmuck, working on MySkoda, can report how “we” prevented a huge security risk and funneled valuable ~~cattle~~ user data where it belongs.
Infrastructure (servers, bandwidth, etc) costs money.
For better or worse, most devices don't have local interfaces. Some matter devices exist in the past year or two, but not all data/functions are available via matter. Older devices likely won't ever be updated to support matter.
Also lump in the fact that HA is a locally run/focused application, it isn't super compatible with a cloud based API/data delivery system without some additional development from the OEM end.
Last I did the math for an internal system.. in 24 hours HA traffic was ~20% of total, for less than 1% of users. That's wild. Mostly because each instance is pinging the API directly every X or less minutes.
If an executive here heard that math, they'd likely ask to block it as well. Right or wrong that's how people react.
Because people will still buy their cars. The average Joe has very little regard for their privacy. We've been trained to be numb.
> Is this really a tangible income stream?
Yep.
> Is it really increasing security?
Nope.
I have VW and I suppose We Connect, there's not a single thing that's worth paying for, not when you have CarPlay and Android Auto (or whatever that's called). If anything I'd prefer that they'd just drop the personalization they do with users. Our car will forever assume that my wife is driving, because that what the dealer configured and none of us care to mess around with it.
But yeah, people will buy the cars anyway, because all the automation is something that only an incredibly small segment has any interest in. It's just weird that those who actually care about connected cars are the only one VW is punishing with this move.
I tend to agree. But the counterpoint is Tesla. They charge for API access, and there are several businesses that exist to make that data available to customers. I don’t know how valuable it really is, but it’s working. My wife would pay Ford for the level of data she was getting from TeslaFi but instead she gives it to MileIQ. It’s not huge but that adds up.
saving money on bandwidth
It's practically a law of business: executives prioritize their power first and their company's profit margins second. This is one reason why outsourcing coding was so popular despite not saving money and being so commercially disastrous - execs were in the driving seat with that relationship much more than they were with us.
Despite what some people will tell you about how the home assistant consumer segment "doesn't matter" (it does) it really is more about the tangibility of control over data vs the intangibility of lost consumer goodwill.
Companies are not profit maximizing at all costs. The shareholders and the executives are not a singular body they have different and sometimes wildly divergent interests.
Same mentality behind companies who insist users have an "account" to use their otherwise-unconnected products.
1. They dont think anyone will stop buying their cars because of this
2. They want to make more money
3. (speculation) The drop in demand for their cars in china is leaving them fucked, they need revenue now
What's worse is that other manufacturers are starting to do the same thing. They all see unofficial integrations as lost revenue (less of your data to sell because you don't use their app), and higher costs because the usage still comes on their cloud spend bill.
I was talking to my gadget-passionate (but not techie) best friend when the company making our cars made it more difficult to authenticate using the HA integration. He looked at me like I switched to an alien language. "Who cares? Don't you use the app?".
In this case, it's by Play Protect on Android, and whatever they use on iOS.
I recently hit the same wall trying to directly my garage door opener's API (MyQ).
I'd be amazed if Google enabling this behavior doesn't violate some EU competition laws.
It's a very cool and functional project but it is entirely dependent on companies keeping their APIs open, or, more commonly, companies not patching teh magic that makes reverse-engineered APIs possible.
Unfortunately, developments over the years have NOT gone in their favor. Tesla, Ring, MyQ, Ecobee and probably others have closed their APIs over the years. They've usually cited "security concerns" as the motivating factor for the API closures, which has some legitimacy, but IMO it's usually driven by fear of losing subscription revenue.
(Tesla charges a lot for official OAuth apps, though, to be fair, earlier hacks relied on a leaked OAuth app that they never got around to patching. Ecobee locked HomeKit and some other stuff behind their Security+ Subscription, which is a joke considering how anemic their security platform is. MyQ definitely did it to protect their $45/year subscription; jokes on them since RATGDO is infinitely better. Ring still works for some reason, but HomeKit Secure Video support is extremely dicey in part due to the fear of them turning their API off as well.)
For someone like me who primarily used HA for HomeKit integration, depending on it is a ticking timebob. When we moved into our new house, I focused on finding stuff that was natively compatible with HomeKit without workarounds. Our smart home works much better now because of it.
I have more than 50 entities in HA, there isn't a company in the world that could make a single one of them stop working.
Honestly I think that out of the things you mention, HA is the furthest from a ticking timebomb.
Often, the HK-only devices are terrible wrt WiFi stability, and I need to pay more attention to how matter/thread is working lately.
I know some people complain about zigbee/zwave but they've been way better on average than HK over wifi.
or products/companies that explicitly expose API access to their products.
Well, that and making it possible to deploy devices you own in environments where they might be physically accessible to people you don't want extracting credentials from them. Or for ensuring people can only access sensitive company information on company issued devices rather than being able to casually make a copy of any data they have access to somewhere else. Or using a phone as a credit card payment terminal without the possibility of displaying one payment amount on screen and authorising for a different amount.
I'm quite firmly in favour of anything I own giving access to the data it's generating in an open format but screaming about how there's no legitimate use for attestation is quite simply nonsense.
It only attests that the device booted normally (locked bootloader, factory firmware, etc.). Any kind of post-boot compromise (whether it's from malware or something user-initiated) goes completely undetected and does not impact attestation status.
If IKEA ever bought Škoda.
And then, even if you could look inside, there's another type of asymmetric cryptography going on: the remote attestation itself. Again, if properly designed and possibly backed by a hardware security chip, it cannot be spoofed. This isn't something trivial like a shared secret in an HTTP header.
They lost a lifetime customer in me - i think i have spent close to 20k on garmin gear between my wife and myself, watches, gps devices for cars, boats, and hiking gear. If they refuse to give me access to my data, i will (a) lobby for laws to be passed to make this mandatory (b) absolutely never ever buy anything garmin until i see a reversal of this policy and an apology.
More broadly though, its yet another service that blocks API access. No doubt this is caused by proliferation of amateurs armed with agentic tools building nice, personalized frontends for themselves. Companies seem to absolutely hate it when people dont go through their shitty websites with dark patterns, misleading search results and analytics.
For now its just tls fingerprinting, not client attestation - so, I managed to implement a working solution. But I am sure they will tighten the screws still further.
The only annoyance is that Garmin requires 2FA if you enable the ECG feature on your smart watch/fitness tracker, but I have a small program that reads the 2FA codes from my Gmail inbox and supplies them to the scraper without too much trouble.
I have the impression there are permissions and APIs to access sensor history and activity records, but I haven't had a need to dig in and learn what restrictions there might be...
Where's the open source phone?
The open source washing machine?
That was even the norm for complex electronics for decades. But since it makes it easy to reverse engineer it, it's no longer being done due to fear of cheap clones (often inferior, and still doesn't stop anyone these days).
And people buys them because they don't care
https://steveblank.com/2009/12/21/the-elves-leave-middle-ear...
And China, well, it's a dictatorship with effectively unlimited foreign currency reserves. They can do whatever they want.
I'm reminded of the fact that when I got a Roomba ten years ago the box said that the device was open and hackable. Searching online, the text looked like:
> This robot contains an electronic and software interface that allows you to control or modify, and remotely monitor its sensors. For software programmers interested in giving your iRobot new functionality we encourage you to do so.
My Dreame X40 Ultra does work flawlessly with Home Assistant but it carries no such text. In the end, I prefer the working to the text (so perhaps the Chinese companies are better), but things have changed over the intervening years.
I hate Elon as much as the next guy, but Tesla is still playing the API game way better than the rest of the pack (even with the "not so new" Tesla Fleet API change)
I was dealing with this 6 weeks ago!
If you want a real Volvo get an old one.
Even Google Maps is usable without an account.
Only regulation can help.. or a revolution in case the political system in your country is broken..
I think revolutions are more successful when there is some new idea of what to replace the system with. Currently I did not see anything remotely interesting (ex: french revolution came with the new idea of equality before the law, which was not the case before), and I think is mostly due to low overall education - you can't improve a system if most of the people do not think about complex issues like laws, taxes, efficiency, etc. Everybody loves to point a finger at someone and blame them (immigrants, rich people, woke people, etc.) like that would "miraculously" solve any issue.
The anti-regulation arguments aren't framed as "market competition is bad", but rather "the market will sort itself out without intervention" and "let companies do whatever they want to avoid killing innovation".
These two sentences seem to be completely unrelated.
If you had any actual understanding—:as opposed to just hearing this little factoid in passing and have been waiting for every opportunity to whip it out— you’d know that already. It’s funny as a quip, but don’t for a a second act like it’s a legitimate point, which is exactly what you’re doing.