tonesto7 / homebridge-smartthings

SmartThings Homebridge Plugin
385 stars 767 forks source link

[QUESTION] Plugin Development and Security #339

Open scoobaspeaz opened 4 years ago

scoobaspeaz commented 4 years ago

This plugin is pretty awesome and I am glad you made it! I do have a couple questions though hopefully you can answer.

  1. If you abandon this project what happens to our ability to control devices managed through this plugin? It seems all functionality depends on your app to control our devices through homebridge. Im just wondering before I get too invested in products that use SmartThings that rely on this plugins ability to exist and function :)

  2. What exactly does "Send HomeKit Commands locally" do? Meaning, short of just saying X sends the command locally what does this mean vs disabling it? Where does the commands come from and what commands does this reference?

What prompted me to post these questions is because im trying to troubleshoot why randomly homebridge disconnects from HomeKit. I noticed at times it shows my devices unavailable in the Home app. If I check the ID of homebridge, or any of the devices attached through homebridge, then it shows ID failed. If I wait a few mins it will come back and say succeeded and then my devices are working as expected in the Home app. I dont see any errors or anything of the sort in any of the logs indicating what is causing the issue even with debug on. I dont even know if its SmartThings v2 plugin doing it or not.

cladmonitor commented 4 years ago
  1. Lets be honest with ourselves about the Homebridge ecosystem, its a community driven project and with that we all need to understand that A) people are donating their freetime to maintain these and B) Unexpected changes could occur at any time. If tonesto was hit by a bus (god forbid) things would probably suffer for a time until somone else picked things up and carried on or it would at some point be obsolete. Speaking as a long time user of homebridge, I've never been burnt by a plugin becoming abandoned, the ones that have had no changes still operate to this day. Second, this is all a hack and we are all hoping it continues to work, the more likely case is Apple screws us all by making a fundamental change to the OS which is the most likely outcome.
  2. Send commands locally means the commands are coming from the HB instance and not being sent from the Smart Things cloud, this is a faster solution for near real time changes. You can see the time delay by unchecking the option and operating a device (contact sensors or buttons), I see a wait of up to 30 seconds if its disabled. (really screws you with buttons and switches)

Troubleshooting HB, I highly suggest using config-ui-x and learning how to uninstall and modify your config to exclude plugins from operating to try and setup the least amount of items to see if you can fault a specific item to blame for this problem, also in insecure mode you can manipulate the accessories from a webui so if you see "unresponsive" itemson your iDevice you can look at the web and see if the item responds correctly (or if you cant reach your HB specifically, i.e a network issue) Secondly, make certain you have an iPad or AppleTV(Preferable and wired if you can) connected to your network. Many times I've helped others troubleshoot this cause its becuase of wifi issues and devices transitioning to LTE/Cellular and not being able to communicate back to their home network. Good Luck!

tonesto7 commented 4 years ago

@cladmonitor You shouldn't see any more than a 1-second difference between using local and not. All device change events from ST side to HB come via local no matter what. I'm not sure what's been happening on my Hub lately but suddenly local commands are being ignored by my hub

scoobaspeaz commented 4 years ago

@cladmonitor yep to item 1) I can understand that point of view. However it doesnt hurt to ask what the impact is from a development point of view. Meaning it does appear its not a standalone plugin that does the work but also requires his app. I am just wondering what the impact is if the project were suddenly stopped, for whatever reason, would it still be able to function or would we need to have someone else jump in and maintain before it worked again through the app etc. Personally I do not fully grasp how this plugin, the app, and devices all tie in to homebridge to be able to guess. Maybe I will have to dig more or perhaps @tonesto7 can explain :D

As for the rest I do use the config-ui-x out of simplicity but im not afraid of vi and the console. I actually find working on the console much quicker for me since I have been using some version of a *nix since 99.

The issue I am having that im trying to figure out is certainly an odd one and hard to pin down. It might just be a homebridge issue for all I know. How I know that homebridge is disconnecting when this is happening is simply by cheating and checking the accessory ID status (homebridge) in the Eve app when I notice the devices unresponsive. It fails when I have the issue and says successful when its working fine. Normally if I leave it alone within a few mins it comes back and works fine.

What made me start looking at plugins as a culprit was because I once seen this issue with this plugin when I was trying to use this to add my Samsung TV that was connected to my SmartThings Hub. It would start up and be connected but then after a bit would have the same disconnected issue. I found removing that TV, but leaving the lightbulbs resolved the issue. I also later figured out that adding the TV through this plugin isnt supported and, since the TV has its own built in hub that works through the cloud directly, its not actually tying into my SmartThings Hub but just tied into the SmartThings App for control.

I will note that, since I have disabled "Send HomeKit Commands locally", I have not noticed the issue. Doesnt mean im not having the issue but just means I haven't caught it yet. I too though agree with Tonesto, I dont really notice a delay at all with it off or a difference in response with it on to be honest so im just leaving it disabled. Also it was only ever unresponsive on the HomeKit side. On the homebridge its fine so that tells me maybe some plugin or homebridge itself is sending something to HomeKit periodically that it doesnt like so it puts it in time out or something for a bit :)

I dont use many plugins and this one is certainly the most complex one that is on there. The others are just the UX one, Samsung Tizen (to control my tv), and mqtthing. It could be any one of those but I started here :)

I also have plenty of hubs for it to choose from. 6 Apple TV 4s and 2 HomePods are here to help with that. ;)

tonesto7 commented 4 years ago

@scoobaspeaz I've been working on this plugin and the v1 before for almost 3 years and I'm not going anywhere. In fact, I'm just getting started. The only way I quit is if I die or Apple, ST stops letting us interface (Which won't be apple because they just released the open-source SDK for HomeKit)

scoobaspeaz commented 4 years ago

@tonesto7 from a security point of view, since IoT things are always under attack, could you explain how this works exactly and what privacy we are giving up using this plugin? Meaning how does it all tie together and what do you have access to yourself?

I am assuming this works the following way: Smartthings portal we configure the SmartApp section to pull your latest code for the app (homebridge v2). Smartthings app then, with our account being logged in to the app, allows us to see the SmartApp we just synced over (homebridge v2) to the Smartthings portal. *Homebridge v2 app has its own unique local app id and access token that homebridge needs so the app and homebridge plugin can link together.

I am not saying by any means you are malicious at all. Im just wanting more info on how it all ties together to know what im opening up my IoT devices to here at home.

Hope no offense is taken..im just very security cautious :)

JJJ commented 4 years ago

@scoobaspeaz your problem sounds a lot like my problem, which is unrelated to Homebridge or this plugin completely, and I’ve narrowed down to having multiple HomeKit hubs.

Multiple Apple TV’s and HomePods is supposed to be a good thing (that helps mesh your smart home things together) but in my experience the opposite is true.

When I have multiple plugged in and enabled, things go fine for a few days and then the primary hub switches for no reason and my entire home becomes unstable.

I’ve tested everything consumers and developers have access to, across 2 homes for 6 years, to try and figure out WTF is going on, and I’ve come to this conclusion only after unplugging and resetting everything and rebuilding my smart-house multiple times. As soon as I introduce a second HomeKit hub, a few days later, reproducibly, random devices will begin to misbehave.

scoobaspeaz commented 4 years ago

@JJJ could be but in my test case its always showing the same primary hub when the issue is happening. Also its only happening to homebridge itself. All normal, apple approved, HomeKit devices still work perfectly when this is happening.

I have had this very plugin cause this to happen before when adding a TV above. It would add, look like its working, HomeKit would hate the way the TV is being presented to it, so it would reject homebridge. Once I removed the TV through the plugin then all went back to working fine. I ended up using samsung-tizen plugin for my tv instead. This isnt the issue im having though now and im not even trying to troubleshoot this because after reading up about TV and Smartthings hub its kinda dumb for what it tried :)

Now as for the random disconnects I have noticed I dont see the issue now that I disabled "Send HomeKit Commands locally". I dont know if I just haven't caught the issue again yet or if that was the issue. Sadly it doesnt disconnect like clockwork and logs, even with debug enabled, doesnt show any reason for this.

Areson commented 4 years ago

If @tonesto7 gets hit by a bus, then I'll try and pick up as much slack as I can. I've love this plugin and have been working and developing with it for a while, so I can help with some things.

@tonesto7 Sorry for being absent! I was clearing out my spam folder today and somehow all GitHub notifications had been going to spam! I thought it was strange that I hadn't heard anything but I figured that it was just the holidays. I'm still here!

tonesto7 commented 4 years ago

@scoobaspeaz Sorry I haven't replied I've been traveling for work. When I get some time over the next few days I will try to explain how this works. I can tell you now that as long as you don't share your and smart app id and access_token then nobody can access anything.

tonesto7 commented 4 years ago

Wow, I can't believe another 6 days have passed... I will try to reply when I have some time, but I'm not sure when :(