monkeyisland | # 1 | 2017-01-23, 11:39 | Report

At home i have an Robot VaccumCleaner it is a Vorwerk VR200 with WLAN.
I managed to connect it with my jolla via an Android app called
"Kobold Robot"
What i dont like is that the app connects to neato Servers i cant
connect my Robot directly from my jolla.

Now i searched the web an i am really sure that my Robot is similar
to the Robots fom Neato.
For Neato Robots i find a Python Script here :

https://github.com/stianaske/pybotvac

is there anybody to make a "app" from this or somebody who can tell me a how to to use the script ?

pichlo | # 2 | 2017-01-23, 11:57 | Report

You may be surprised but that Python script you found also controls the robot via the Neato cloud You can check it yourself.

I am afraid it is the common solution for may IoT (Internet of Things) implementations. I have not seen any robot vacuums yet but I have been involved in other IoT solutions. There is nothing sinister about it, it is simply the easiest solution. The device regularly "calls home" to check if there is a new command pending. The customer uses a remote control "app" that simply makes sure the command is ready by the next time the device checks in. It is the simplest solution from the device firmware's point of view. The device does not need to know anything about its surroundings and does not require any setup that would confuse and scare away 99% of customers. All it needs to know is its own ID and the URL of the central server.

There may be a command telling the device to check in with a different server, but then you would need to implement that server yourself. There may also be a way to talk to the device locally. Try finding out the robot's IP address and then navigate to that address with your browser. It may present you a "config" page. But I doubt this could be used for a direct control. More likely for things that do not change often, like configuration or a firmware upgrade.

juiceme | # 3 | 2017-01-23, 12:31 | Report

I agree with @pichlo that the given scenario is the one most widely used by any appliances that are "internet enabled"; however from my point-of-view it is just as badly flawed as could be!

Even if there was no sinister ulterior motivations from the manufacturer who so wants to become more of a service operator then just purveyor of HW I'd feel extermely uncomfortable to allow it.
It's an intrusion to my home if external parties can access the information provided by appliances and potentially control them and/or upload firmware or configuration to the devices.

What I'd do is to try to figure out the protocol that the device wants to communicate with homebase and write my own counterpart for it, running it locally and diverting the traffic from the device to it.

pichlo | # 4 | 2017-01-23, 13:48 | Report

I would not necessarily call it "badly flawed". Just "naively implemented". There are a lot of advantages that solution brings, resulting in a simpler implementation. Not only for the manufacturer, but also for the user. You may have the know-how to talk to the thermostat in your bedroom from your phone on the beach on Ibiza but my sister does not. She needs a device that talks to a central server and a phone app talking to the same server. There are a million people like my sister for every juiceme.

Of course there are disadvantages too! For example...

...this is one of them. It is not so much that the manufacturer "wants" to be the operator, it is more like he is "forced to become" one. In many cases the roles of "HW purveyor" and "service operator" are separated. An obvious example is smart meters: in such cases, the "service operator" is your utility company, not the meter manufacturer.

One obvious disadvantage for the operator is the additional load on supporting such devices. At the very least maintaining the server and keeping the SSL certificates, both on the server and on the end devices, up to date. One obvious disadvantage for the customer is that if the manufacturer goes out of business, your otherwise perfectly fine device may stop working.

That is a valid concern and one that comes down to trust.

That may be tricky if the protocol involves encryption (and if it does not, I would steer clear of it like from a rabid fox). I can see https in the Neato server's URL in that Python script, which probably means cryptographically sound, but difficult to RE

Why would anyone want an internet enabled vacuum cleaner anyway?

juiceme | # 5 | 2017-01-23, 16:25 | Report

These things are the warning signals; when the services are both to be meant to be used by everybody's second cousins and the service provider is not working on their core competence area, it is a valid receipe for a disaster!

There is no such thing as an unbreakable networked system, and the more closed the system is the more vulnerable it becomes. When a system is to be both idiot-proof and tamper-resistant while at the same time it leverages the whole bloody internetz as a connectivity method it is going to be really difficult and really expensive to specify, implement, test and maintain.

It is going to be eyebrows-raisingly expensive even to huge corporations like in automotive and telecom businesses where they have the incentive to do it correctly and dilute the cost of the system around their already large R&D expenses.
It is absolutely impossible that some household-appliance company can resource it to make it correctly.

tldr; blackhats are going to walk in and out your house and you will never know about it

pichlo | # 6 | 2017-01-23, 19:42 | Report

Which brings me back to my question. Why would anyone want an internet enabled vacuum cleaner?

mrsellout | # 7 | 2017-01-23, 20:40 | Report

With apologies to monkeyisland for going further off topic, there's at least a couple of posts on Matthew Garrett's blog about IoT and how poor the security is on them:

Blog:
http://mjg59.dreamwidth.org/
I bought some awful light bulbs so you don't have to
https://mjg59.dreamwidth.org/40397.html
I've bought some more awful IoT stuff
http://mjg59.dreamwidth.org/43486.html

peterleinchen | # 8 | 2017-01-23, 20:42 | Report

Do you not see the use case?
Your Android/Imer knows where you are and when you come back home. It/IoT also knows about wind and sun and atom states and can use energy whenever it is available. And you are not at home, so not disturbed.

I could go on and on. But I do not really like to

monkeyisland | # 9 | 2017-01-24, 05:42 | Report

So i read the pevious Posts.
I think i dont want that the machine "calling home" to neato Servers.
The machine works without connecting to the web great enough.
the timer function in the machine is enough.

pichlo | # 10 | 2017-01-24, 07:45 | Report

Yes, I can see why someone might want to sell you one. My question was, why would you want to buy one?