• 3 Posts
  • 25 Comments
Joined 1 year ago
cake
Cake day: July 9th, 2023

help-circle



  • Just updated and it looks like this one fixed the log spam:

    json_loads was called from hacs, this is a deprecated function which will be removed in HA Core 2025.8. 
    Use homeassistant.util.json.json_loads instead, please create a bug report at https://github.com/hacs/integration/issues
    

    It’s a little weird they don’t have a download update button on the new HACS dashboard for an individual repository, now you have to go to Settings > Updates. I also wish I could hide new and available repositories and only show the ones I have installed (you can’t seem to select Pending Restart, Pending Update, and Downloaded at the same time.)


  • There’s two main ways of doing geo-based load balancing:

    1. IP Any-casting - In this case, an IP address is “homed” in multiple spots and through the magic of IP routing, it arrives at the nearest location. This is exactly how 1.1.1.1 and 8.8.8.8 work. It works fine for stateless packets like DNS, however it has some risks for stateful traffic like HTTP.
    2. DNS based load balancing. A server receives a request for “google.com”, looks at the IP of the DNS server and/or the EDNS Client IP in the DNS query packet and returns an IP that’s near. The problem is that when you’re doing Wireguard, it goes phone -> pi-hole (source IP is some internal IP) -> the next hop (e.g. 1.1.1.1 or 8.8.8.8), which sees the packet is coming from your home/pi-hole’s public IP. Thus it gets confused and thinks you’re in a different location than you really are. Neither of these hops really knows your true location of your phone/mobile device.

    Of course, this doesn’t matter for companies that only have one data center.



  • I have Wireguard and I forward DNS and my internal traffic from my phone over the VPN to my pi-hole at home. All other traffic goes directly over the Internet, not the VPN. So that means only DNS encounters higher latency.

    However, because a lot of companies do DNS based geo load balancing that means even if I’m on the east coast all my traffic gets sent to the West Coast because my DNS server is located there. That right there has the biggest impact on latency.

    It’s tolerable on the same continent, but once I start getting into other continents then it gets a bit slow.










  • One of the problems with the cloud-polling integrations is that they will frequently poll the back-end APIs to get the current status of that device. A normal user might only open up the app once or twice a day and call the APIs, but these integrations will go 24/7 every 10s-5m. That can add up to a non-trivial amount of traffic. If there’s 100 users opening it up once a day, that’s not a lot of traffic, but 10 users polling every 1 minute is equivalent to 15k people doing something once a day.

    I actually saw one of my integrations I used defaulted to updating every 10 seconds. I decreased that because I didn’t want to draw attention to it.

    A business will look at their usage and ask why there’s more than expected traffic. They could be running their server on a potato. They could go back and support Matter, that costs money, requires skilled engineers, and cuts into profit margins.

    While it sucks, that is something they could point to in a court about “economic harm”.







  • Attestation depends on a few things:

    1. The website has to choose to trust a given attestation provider. If Open Source Browser Attestation Provider X is known for freely handing out attestations then websites will just ignore them
    2. The browser’s self-attestation. This is tricky part to implement. I haven’t looked at the WEI spec to see how this works, but ultimately it depends on code running on your machine identifying when it’s been modified. In theory, you can modify the browser however you want, but it’s likely that this code will be thoroughly obfuscated and regularly changing to make it hard to reverse engineer. In addition, there are CPU level systems like Intel SGX that provide secure enclaves to run code and a remote entity can verify that the code that ran in SGX was the same code that the remote entity intended to run.

    If you’re on iOS or Android, there’s already strong OS level protections that a browser attestation can plugin to (like SafetyNet.)