[abrowne]

I got new boilers (furnaces for radiator heating) installed recently, and halfway through one of the crew asked where they should install the boxes that connect the thermostats to the internet. Luckily they were completely separate, so I said I never agreed with that and they left them boxed up, because they had never thought to mention it. (They listened to my explanation that I would not have something that literally starts a fire in my house connected to the internet without at least being able to control the software it runs, but I think they were just being polite.)

[theonealtair]

I went to use the app for my hot tub and put in the 6 digit pin, except the last number I put in was a 4 instead of a 3. It logged me in, but the temperature looked off, then I realized I wasn’t connected to my hot tub, it was someone else. Turns out the 6-digit pins are sequential. And this is from a billion dollar pool company.

[TheCoelacanth]

The S in IOT stands for security.

[Mountain_Skies]

My neighbor has never properly setup the internet connection on his hot tub. It's still in access point mode, waiting for anyone to connect and take control of it. Going to guess that it at least has manual controls on the hot tub itself. If he wasn't such a difficult curmudgeon to talk to, I'd warn him about it, but he'll probably just think I'm trying to sell him something.

[bombcar]

This is true across a frighteningly large swath of “quasi industrial home control” stuff - all the vulnerabilities of industrial controls with zero of the attention paid to it.

[conk]

What’s industrial home control?

[bombcar]

All the commercial stuff from before the Apple Home craze. Automated sprinklers, lighting, controls. It’s been out there since the 70s and got rudimentary internet access early on - and lots of it is very slapdash (underlying assumptions that everything is local wire or low range radio from before internet was slapped on).

[JoeyBananas]

That's incredible

[theonealtair]

The temp said 20° (which is impossible in my climate). Good thing I didn’t crank the heat up.

[13of40]

A year or two ago, my newish car was at the shop, recovering from a fender bender, and I got a call from the police asking where it was. I told them and they said that matched with the coordinates they had. It turned out that the SOS system had malfunctioned, and the GPS and integrated 4g (which I didn't even know I had, because the car doesn't have a built in navigation system or voice phone) had been phoning home and telling the car company I was in trouble. I called the manufacturer and asked if I had a subscription to this service, and I was informed that the car had a subscription, and I couldn't cancel it. Luckily I appealed to the dealership and after a couple of days the sent me a "confidential" pdf with instructions on how to unplug the spy module...which of course threw up all kinds of scary warnings starting the car after that... until it suddenly didn't anymore. So now I have a dumb car, and I love it more than ever.

[LAC-Tech]

I can't imagine living in a place where there's enough police for any of them give a shit about stolen cars. Jealous!

[spaetzleesser]

I lived in Sonoma County for a while and there they followed up everything, even noise complaints. Same for the post office. It’s nice to live in a wealthy area.

[wrycoder]

It also helps when the police have very few complaints to follow up.

[kQq9oHeAz6wLLS]

I gotta know now...what make and model?

[13of40]

2017 BMW X3. I forget what the module is called, but it's behind the panel in the cargo area on the left side.

[titzer]

That's bizarre. Given that Germans generally care more about privacy than most, it's surprising that BMW would be doing that.

[DocTomoe]

That module will soon be mandated by EU law [1], BMW just jumped the queue

[1] https://www.bmvi.de/SharedDocs/EN/Articles/StV/Roadtraffic/n...

[toss1]

May I ask what kind of car that was, and what country?

[vetinari]

AFAIK the SOS system is mandatory in any new car sold in EU since 31.3.2018.

[nunez]

I think your BMW had those because both (4G hotspot and navigation) can be "enabled" remotely through upgrades to iDrive

[megablast]

Good. Every car needs to be tracked at all times. They are death machines, responsible for over s million deaths worldwide every year. It is insane we allow this.

[smegger001]

so are knives but i don't think my folding pocket knife needs gps tracker built in

[couchand]

You raise a goood point, deaths by knife do approach (checks notes) a rounding error on the number of auto deaths.

[baash05]

mosquitoes?

[KennyBlanken]

They were being polite, as all service workers have to be. Tell me you've never worked s service industry job without telling me you've never worked a service industry job....

There are numerous safety interlocks in gas furnaces ranging from flame presence sensors to (usually) several heat limit switches, often which are wired directly in line between the gas solenoid and the furnace controller. The controller's logic has a lot of "expect this condition by this amount of time" rules, too.

The furnace's controller is usually separate from the system controller (the box that talks to thermostats, valves/dampers, pumps, etc.)

On forced hot air systems that are new enough, the furnace and system controller monitor outlet air temperature and shut down if it's too hot.

Gas furnaces are incredibly safe.

Also, the quote to install the system specified what thermostats they were going to install. It's on you to read the quote, not to get uppity at service personnel and lecture them people haxx0ring your furnace.

[chris_st]

We had a water heater installed a few years ago, that along with a heat exchanger heats the house, so it comes with a thermostat. Salesman tells me in glowing terms about the WiFi-enabled thermostat they're "giving" me, to which I reply "ABSOLUTELY NOT"... turns out they have an old-style one that's $300 cheaper, and... has worked fine for the entire time, without poking a severe security hole in my WiFi network.

[assttoasstmgr]

I mean you do realize a Wi-Fi connected thermostat just closes a pair of contacts that tell the boiler "heat on" or "heat off" and it's not "literally starting a fire" in your house. Assuming someone took over and had full control of your thermostat the worst they could do is turn the heat on and make you uncomfortable. All boilers/furnaces/etc have protection mechanisms built in and in no circumstance is the 'fire' controlled by the thermostat whatsoever. A thermostat simply sends a signal that 'calls' for heat or cooling. The only exception would be a mains-voltage thermostat that controls an electric wall heater but I've never seen those connected to Wi-Fi.

[DonHopkins]

>just closes a pair of contacts that tell the boiler "heat on" or "heat off" and it's not "literally starting a fire" in your house

Unless you observe Shabbat.

https://en.wikipedia.org/wiki/Electricity_on_Shabbat

>Nobel Prize-winning physicist Richard Feynman recounts that he was approached by young rabbis in a seminary who asked him "is electricity fire?". He replied, "no", but asked why they wanted to know, and was shocked that they weren't interested in science at all, but just wanted to interpret the Talmud. Feynman said that electricity was not a chemical process, as fire is, and pointed out that there is electricity in atoms and thus every phenomenon that occurs in the world. Feynman proposed a simple way to eliminate the spark: '"If that's what's bothering you, you can put a condenser across the switch, so the electricity will go on and off without any spark whatsoever—anywhere.' But for some reason, they didn't like that idea either".

Feynman was SHOCKED I say SHOCKED they weren't interested in science at all! ;)

[assttoasstmgr]

If only there was a technological solution to this.......

https://en.wikipedia.org/wiki/KosherSwitch

I believe thermostats are okay, as long as you don't adjust it. Many observant Jews use timers on Shabbos.

[pengaru]

Thermostats generally have an "off" setting, and it's historically not uncommon for homeowners to use this setting when the home is unoccupied as it clearly carries less risk in terms of both fire and unexpected energy costs than ones that may run the furnace.

Not only is your comment pedantic, it's not even correct.

[assttoasstmgr]

The 'off' setting on a thermostat is no different than when it is not calling for heat and it does not make any other failure mode any less likely nor does it reduce the risk of fire. In fact, leaving a home without heat in some climates like the northeast leaves your home susceptible to pipes freezing which carries a much higher risk of damage to your home than a well-maintained boiler or furnace spontaneously burning your house down which happens almost never.

Homeowners typically use this setting because the overwhelming majority do not understand the mechanical systems in their homes.

The typical configuration for a steam boiler or hydronic heating is a single pair of wires. They are either closed (heat on) or open (heat off). That's it.

I worked in the HVAC industry. My comment is pedantic because it is correct.

[pengaru]

> The 'off' setting on a thermostat is no different than when it is not calling for heat and it does not make any other failure mode any less likely nor does it reduce the risk of fire.

You're completely ignoring the difference between an unattended vs. attended fire. The former has a much higher risk of being destructive and spreading to the structure.

The "off" setting explicitly won't trigger in response to temperature change unattended, which is a similar concern to internet-connected thermostats; unattended operation. For those living in freezing climates they obviously must weigh the relative risks. That first use of the furnace in winter was always a monitored event back when I lived with parents in the midwest, and it was often accompanied by a burning smell we'd investigate and verify was just some dust and nothing serious.

Even if you refuse to acknowledge there's a difference in unattended vs. attended fire risks WRT the furnace, unexpected energy costs from continuously heating an unoccupied home can break the bank for some.

Even my Harman/Kardon amplifier's manual advises unplugging it when going on vacation because of the risk of it spuriously turning on wasting electricity and being a noise problem. Its capacity to waste energy (~1kw) is nowhere near that of a gas furnace, and it clearly doesn't utilize combustion as part of its normal operation.

Fortunately I no longer live anywhere burst pipes are a concern, and I'd never leave a heater setup to automatically run in my absence. It makes zero sense for my situation.

I find it amusing that you're qualifying statements with "well-maintained", which amounts to a tacit recognition of the risks. Well-maintained isn't the default, ignored and neglected is, especially for systems out of sight and out of mind.

[slavik81]

You should not turn your furnace off in a cold climate, especially if the home is unoccupied. If the temperature drops below too low, the water in your pipes may freeze and expand, breaking the pipes and causing flooding. Without anyone home to notice the problem, the flooding can easily cause tens of thousands of dollars of damage.

https://totalph.ca/should-i-turn-my-furnace-off-before-i-go-...

[couchand]

Or you could just drain the pipes, too...

[jdavis703]

Correct, this is totally different than having a smart gas oven or stove. I too would never have plumbing or gas appliances hooked up to the internet. But my Nest thermostat is totally safe.

[assttoasstmgr]

Whirlpool figured this out and deserves some praise here. All their new appliances that support Wi-Fi connectivity have a physical "Remote Enable" button that you must manually push every cycle to enable remote control of the device through the app. You cannot start the oven/washer/etc remotely unless someone has manually acknowledged it at the appliance and I believe it resets after 24 hours or when the cycle is complete.

[jay_kyburz]

I bet its all software though.

[WalterBright]

Of course, and it's remotely upgradable, too. That way, the manufacturer can install spyware anytime they want, and any hacker can use it to mine bitcoins.

[jay_kyburz]

I'm looking forward to banner ads on the front of my oven nagging me to buy more frozen pizza.

[pengaru]

> But my Nest thermostat is totally safe.

It is not "totally safe" for your furnace to start in an unoccupied home, particularly after it's been off for an extended period. It's not impossible for critters to have setup shop in the warm space near a pilot light, and in an unoccupied home there's nobody to even smell what would be an obvious problem before it becomes a crisis.

[assttoasstmgr]

This is FUD.

Thermocouple-based gas valves immediately extinguish the flow of gas when a pilot goes out in e.g. a pilot fed hot water heater. This has been standard for decades.

Pilot lights have not been used in gas furnaces in decades. Everything has been electronic ignition since the 80s at the latest. In fact they have been outlawed in some locales for close to 40 years.

[pengaru]

> Thermocouple-based gas valves immediately extinguish the flow of gas when a pilot goes out in e.g. a pilot fed hot water heater. This has been standard for decades.

Who said the pilot light was out?

> Pilot lights have not been used in gas furnaces in decades. Everything has been electronic ignition since the 80s at the latest. In fact they have been outlawed in some locales for close to 40 years.

And the baby-boom produced how many homes with pilot lights? Thermostats are often upgraded on existing homes without touching anything else, and every single home I've lived in was built decades ago still having original HVAC.

[efreak]

My grandmother's house has a stove with at least 5 pilot lights on it (one for each burner); I'm not sure about her water heater, gas dryer, HVAC, etc. Just because pilot lights aren't commonly used in the past half century doesn't mean they don't exist.

[baash05]

Didn't some company turn up the heaters at night, to increase the power costs.

Also this https://www.wired.com/story/water-heaters-power-grid-hack-bl...