Frenck here, I'm the one who replied on that issue.
My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue.
As it turns out, the check can already be turned off after all:
ha security options --pwned=false
It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now.
It sounds like the dev's reason for rejecting the issue is that the issue was opened on the documentation repo rather than the code repo.
On the one hand, it's understandable. No amount of documentation changes will fix the issue.
On the other hand, it's a pretty abrasive response. It wouldn't have taken any more effort to be a little more helpful and direct OP to the right repo: "Sorry, this is the wrong place for this to be addressed. Please bring it up here instead [link]."
It's pretty clear that the maintainer should've handled it better but I'd be lying if I said I never felt like telling a petulant user off. The problem is he didn't handle it professionally.
(For missing context from this bare link to an issue with no context provided by the submitter — Home Assistant apparently integrated the same Have I Been Pwned safe scanning process that many other password managers have.)
I have a great deal of sympathy for them refusing to engage; decisive software creators are far less palatable to an entitled swarm of disagreement, and that same decisiveness is what makes the best software. Perhaps in U.S. culture, refusal with a smile and a reassurance that “We’re Listening” is something folks feel entitled to, but in other areas of the world, demanding a stranger change their mind once it’s made up earns only mockery or pity. To those cultures, this GitHub is a comedy-farce, and I laughed out loud upon reading it — not because I necessarily agree with the project’s decision, but because I agree culturally with their tone and handling of what some view as blatant immaturity: a final flat refusal, closing the door, and getting back to work.
Giving the home assistant core developers the benefit of the doubt, I am sure there are good intentions here. But if they are interested in adding new security features, adding support for phishing-resistant multi factor authentication (passkeys) would be much more valuable. Users have been asking for it for some time, and even submitted patches, which were rejected.
That makes it even worse. A leak is still a leak even when you haven't notice it.
Personally I use HIBP but I would still be annoyed to learn a system I installed mainly for privacy was sending private data to a third party by default.
You may find this unasked for scan humiliating, but we can mathematically prove we're not humiliating you. Any feelings of discomfort or humiliation are therefore invalid and should be set aside.
Edit: I'm sure a greater good argument can be made. I just don't think they are making it in a way that justifies the invasiveness.
What, do you not include links to every single one of your social media accounts in every single post you make on GitHub? I think this is a very cool and normal thing, and not a concerning red flag about narcissistic tendencies at all.
I wouldn't be surprised if that integration is outright illegal in EU due to GDPR, thus putting HIBP in trouble for ingesting PII without any legal legitimacy.
And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer.
Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.
I have another tab open where I am about to buy a home assistant green and start a journey of probably-pointless automations. This is giving me pause. Not about sending hashes to haveibeenpwned, but about the response this got on github.
Frenck here, I'm the one who replied on that issue.
My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue.
As it turns out, the check can already be turned off after all:
It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now.Only the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/super...
Our documentation should have explained all of this, including how to turn it off. We'll get that updated.
>As it turns out, the check can already be turned off
Problem solved!
>My replies there were more dismissive than they should have been
What about this one?
Toxic developers turned me off Home Assistant. The same developer is the star of this issue: https://github.com/NixOS/nixpkgs/pull/126326
Related discussion: https://news.ycombinator.com/item?id=27505277
It sounds like the dev's reason for rejecting the issue is that the issue was opened on the documentation repo rather than the code repo.
On the one hand, it's understandable. No amount of documentation changes will fix the issue.
On the other hand, it's a pretty abrasive response. It wouldn't have taken any more effort to be a little more helpful and direct OP to the right repo: "Sorry, this is the wrong place for this to be addressed. Please bring it up here instead [link]."
And that kids is a clear example of how not to interact with people online.
Yeah not a good look. This is probably the worst way to handle community feedback.
I mean, none of them behaved like an adult.
It's pretty clear that the maintainer should've handled it better but I'd be lying if I said I never felt like telling a petulant user off. The problem is he didn't handle it professionally.
Maybe he shouldn’t be accessing people’s passwords. If you start looking into someone’s wallet you can expect an abrasive response.
(For missing context from this bare link to an issue with no context provided by the submitter — Home Assistant apparently integrated the same Have I Been Pwned safe scanning process that many other password managers have.)
I have a great deal of sympathy for them refusing to engage; decisive software creators are far less palatable to an entitled swarm of disagreement, and that same decisiveness is what makes the best software. Perhaps in U.S. culture, refusal with a smile and a reassurance that “We’re Listening” is something folks feel entitled to, but in other areas of the world, demanding a stranger change their mind once it’s made up earns only mockery or pity. To those cultures, this GitHub is a comedy-farce, and I laughed out loud upon reading it — not because I necessarily agree with the project’s decision, but because I agree culturally with their tone and handling of what some view as blatant immaturity: a final flat refusal, closing the door, and getting back to work.
Giving the home assistant core developers the benefit of the doubt, I am sure there are good intentions here. But if they are interested in adding new security features, adding support for phishing-resistant multi factor authentication (passkeys) would be much more valuable. Users have been asking for it for some time, and even submitted patches, which were rejected.
This feature has been around for 5 years... https://github.com/home-assistant/home-assistant.io/blob/cur...
That makes it even worse. A leak is still a leak even when you haven't notice it. Personally I use HIBP but I would still be annoyed to learn a system I installed mainly for privacy was sending private data to a third party by default.
The feature is not the problem.
You may find this unasked for scan humiliating, but we can mathematically prove we're not humiliating you. Any feelings of discomfort or humiliation are therefore invalid and should be set aside.
Edit: I'm sure a greater good argument can be made. I just don't think they are making it in a way that justifies the invasiveness.
>>please let us know so we can uninstall and fork
>Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a
just wanted to add an outsider perspective here, not trying to add wood to the fire
but i don’t think it’s inappropriate or ‘a threat’ to let the dev know the user can stop using the software.
The dev comes as self-serving. Not what you’d expect to see. Calls it heated when he himself caused it with their tone deaf response… it’s next level.
The same dev doest even like others packaging his open source libs.
https://github.com/NixOS/nixpkgs/pull/126326
> The dev comes as self-serving
What, do you not include links to every single one of your social media accounts in every single post you make on GitHub? I think this is a very cool and normal thing, and not a concerning red flag about narcissistic tendencies at all.
Tough one. I get the intention but this should've been opt-in.
I wouldn't be surprised if that integration is outright illegal in EU due to GDPR, thus putting HIBP in trouble for ingesting PII without any legal legitimacy.
And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer.
Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.
I have another tab open where I am about to buy a home assistant green and start a journey of probably-pointless automations. This is giving me pause. Not about sending hashes to haveibeenpwned, but about the response this got on github.
Awfully tone deaf responses
> If this is all reason for you to uninstall and fork... So be it, it is open source after all.
what a petty answer. "just fork it bro".
Working on a fork already: Lets spend some tokens! :)