upvote
I do get the sense that you're not malicious, just that maybe you're not seeing this from the standpoint of someone that assigns a higher value to some elements of privacy. In this case, your user base expects a home automation system. They do not expect that system to scan their computer for passwords, regardless of how "safely" the home automation system were to behave.

You might have a heart of gold, and just be having an off day due to reasons, so I hope people cut you some slack, but if I were you I'd update this feature to be opt-in and conspicuous, immediately

reply
Security issues rarely arise from explicitly malicious behavior. It's usually careless attitudes until the holes in the swiss cheese align
reply
I've not seen the claim that it is scanning their computer for passwords. My understanding is the ones it checks are those that are used in HA's config (I assume, for different devices it connects to in your home).

There are a lot of problems with poor security practices devices of this type. Maybe the feature is a bit too paternalistic but it is not malicious.

I still agree its not the right default but thats quite a lot less invasive than you are making it sound.

reply
How is a provably anonymous operation a violation of privacy?

I value my privacy quite highly, but I don't mind harmless, anonymous use of my data

reply
Even sending out a request to a third party server without any input by the user or good reason (which I wouldn’t count this as) should be counted as a privacy violation because HIBP can now infer that network is running HA.
reply
Trust is hard won and easily lost. The entire reason I use Home Assistant is because I trust it to be the local, privacy focused home automation system. Things like this is a huge surprise that gives me pause to wonder what else it's doing that I wouldn't approve of. If I feel like I need to start setting up firewalls between HA and my internet to protect my privacy and data, I'm more likely to look towards alternatives and push my family members towards something else as well. This is the first time I've wondered if the project's ethics and culture matches what I expect out of the software.

Just my $0.02.

reply
Just to add to your point, I’ve deliberately avoided home-assistant since this kerfuffle where frenck was quite rude to the NixOS maintainers. https://news.ycombinator.com/item?id=27505277
reply
Asking basically the same thing as the sibling replies, but hopefully in a less aggressive way: can you elaborate on what led you to reply like that in the first place? As someone with no horse in the race (I don't use Home Assistant), the first reply you gave genuinely does seem like it was intended in good faith, even if it was not satisfying to the user, and I can understand that angry users are not fun to interact with, but I'm struggling to wrap my head around why your second reply was "This issue is closed as won't fix" without any elaboration about why. The explanation that seems most likely to me is that you were annoyed at the user and decided not to spend any time looking into the issue, which would be unfortunate but maybe understandable if that's what you're apologizing for. Without any explanation about why you quickly dismissed and then suddenly turned around and changed your mind later though, I think you've risked the apology coming across more as damage control than genuine regret.
reply
why lying on your first reply? you mentioned 1Password did the same, in an attempt to make yourself "less guilty", but you failed to realize 1Password doesn't enable that option automatically without consent, and in some cases this option is periodically DISABLED automatically. address this, please, it's pretty embarrassing to lie like this just to cover y'all's ass.
reply
From my understanding, they seem to be under a lot of stress/pressure lately.

I'm not exactly sure why, but the stuff that happens tells that story (to me at least).

Barking at frenck on a Friday at 11.30PM like this is probably not the right thing to do.

reply
Hehe not really. I'm also just enjoying my hobby on a Saturday evening honestly :)

But you are right, it is time to head downstairs for a beer with Mrs. Frenck.

../Frenck

reply
Cheers. Same. (well, not with mrs frenck- that'd be scandalous!)
reply
good bye
reply
People accusing others of lying all the time is a major problem in current societal discourse.

It’s not a lie if the speaker believes it to be true; it’s just a mistake. A lie must have the intention to mislead behind it.

I don’t dispute that there is a lot of, perhaps way more, lying going on, especially in politics now, but let’s not both inflame opinions and cheapen the word ‘lie’ by just using it for non-deliberate falsehoods.

reply
"It's not a lie if you believe it." -George Costanza
reply
> It’s not a lie if the speaker believes it to be true

I'm looking forward to that latest Elizabeth Holmes documentary.

reply
Not a lie, but I was wrong on that one. I'm happy to admit that.

I've used 1Password's Watchtower for so many years that I assumed the breached password check was just part of it. After your reply I looked it up and learned it's actually a setting in their privacy preferences, so my comparison was off.

../Frenck

reply
As someone reading this with no dog in the fight, you came across as rude and patronizing. I'm sure you are not like that in real life, but those responses were ..ooof, not pleasant.

I'm just a rando stranger, don't mean to pile on to you. But as someone that has also launched products and talk to customers every day.. that's not a good look.

Again, no hate here, I'm sure you're great to talk to in real life, but just the way you wrote that was not pleasant at all.

reply
deleted
reply
It was far beyond “more dismissive than they should have been”.
reply
And I believe it is far less than what could be.

Too many OSS projects die because authors are too afraid to tell demanding users in which direction they could proceed and instead burn out.

reply
> My replies there were more dismissive than they should have been. My apologies.

I’m curious what made you change your mind, perhaps seeing this getting traction on hn?

reply
I can’t speak for him, but I regularly reword replies after a minute of consideration or if I manage to think to myself “is this as kind as I intend to be to others” during it’s formation.
reply
> Only the first 5 characters of a SHA-1 hash go to HIBP

Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'.

Some would consider phoning home to a remote server to be worrisome. It's home assistant not cloud assistant.

reply
I would consider a single byte sent to any server without my explicit permission a breach of trust.
reply
It is already enough to prove the existence of a password or that another password is not disclosed for example.
reply
Thanks for being here. Who made the decision to enable this by default without consent and without a GUI setting to disable it?
reply
> My replies there were more dismissive than they should have been.

What would have been an appropriate amount of dismissiveness in your view?

reply
>As it turns out, the check can already be turned off

Problem solved!

>My replies there were more dismissive than they should have been

What about this one?

reply
Problem is not solved. Why was this turned on by default behind our backs? What else is being contacted and with what purpose behind our backs? This is a serious breach of trust from Home Assistant.
reply