The other replies answer this question, but it’s worth mentioning the public suffix list which contains a list of domain suffixes that have subdomains that are controlled by different people. E.g github.io, wordpress.com

Browser use this list to prevent cookie shared between sites using the suffixes on the list. E.g evil.github.io will not receive cookies from nice.github.io, or any other .github.io origin, regardless of the SameSite attribute

Some of United's own aircraft are over 30 years old [1]. If you can rely on a well-maintained 30+ year-old aircraft to fly you halfway accross the world I think you can rely on a similar-aged car to drive across the country.

[1]: https://www.planespotters.net/airframe/boeing-767-300-n641ua...

No, because unlike a password you never provide the private key for a passkey to the site you’re logging into, which is how many password breaches occur.

Or putting `|> dbg()` at the end and let it print the value at every step of the chain

It's not clear text by default, it's just not end-to-end encrypted. Messages are still encrypted between client and server.

I agree about considering alternatives though.

> Messages are still encrypted between client and server.

This is just a clever way of saying they use TLS, which I would be shocked if any mainstream app is not using.

Don't look under the hood at sms then

SMS is never claiming to be E2E nor is any army of SMS defenders online talking about how some virtue of SMS is almost same as E2E. While I don't like Telegram I will happily admit it is better than SMS, but how is that an argument for anything.

SMS isn't an app, it's a protocol that was created in 1992.

Ok so theyre plaintext on the server, encrypted in transit just means https

Is the server -> FSB connection encrypted?

I wonder if it would be possible to figure out which pins are connected to what on the device's board and just flash the thing completely with ESPHome and write a custom yaml config for it, rather than adapting the existing vendor firmware.

It's certainly possible. Tracing the MCUs IO lines to LEDs/buttons/relays etc on a PCB is usually pretty straightforward.

I have just finished doing this and writing replacement firmware for the Aqara E1 series of Zigbee switches, after getting fed up with them not supporting basic Zigbee binding functionality.

Amazing. I have the Aqara Z1s and it has the SI labs MG24 chip. Ive always wanted to reflash it because I believe it supports thread at a hardware level.

It would be really easy. I'm not sure why the author has gone through so much effort to hide what filter this is, but I'm assuming J2 is the blower power output and J3 is touchpad controls.

I've done exactly this on my own air filter, and it's about 200 lines of config. The hardest part is mapping binary outputs to a percentage:

    switch:
      - platform: gpio
        pin: GPIO21
        id: fan_low
        interlock_wait_time: 250ms
        interlock: &interlock_group [fan_low, fan_mid, fan_high, fan_turbo]
      - platform: gpio
        pin: GPIO25
        id: fan_mid
        interlock_wait_time: 250ms
        interlock: *interlock_group
      - platform: gpio
        pin: GPIO22
        id: fan_high
        interlock_wait_time: 250ms
        interlock: *interlock_group
      - platform: gpio
        pin: GPIO17
        id: fan_turbo
        interlock_wait_time: 250ms
        interlock: *interlock_group
    output:
      - platform: template
        id: fan_speed_output
        type: float
        write_action:
          - lambda: |-
              id(fan_low).turn_off();
              id(fan_mid).turn_off();
              id(fan_high).turn_off();
              id(fan_turbo).turn_off();
              auto light = ((AddressableLight*)id(status_light).get_output());
              for (int i = 6; i <= 9; i++) {
                light->get(i).set(Color::BLACK);
              }

              if (state < 0.24) {
              } else if (state < 0.26) {
                id(fan_low).turn_on();
                light->get(6).set(Color(255,0,0,0));
              } else if (state < 0.51) {
                id(fan_mid).turn_on();
                light->get(7).set(Color(255,0,0,0));
              } else if (state < 0.76) {
                id(fan_high).turn_on();
                light->get(8).set(Color(255,0,0,0));
              } else {
                id(fan_turbo).turn_on();
                light->get(9).set(Color(255,0,0,0));
              }
              light->schedule_show();

    fan:
      - platform: speed
        name: "Filter Speed"
        output: fan_speed_output
        speed_count: 4
        id: my_fan

On top of that, it looks like it would be relatively easy to spoof the cloud server and make the device believe that there is a firmware update available to then feed it esphome, a bit like the switchbota hack.

That would've been my go-to, and has been with most of the other "smart" devices in my house.

You get more heat out of using a given quantity of gas to generate electricity which is used to to power a heat pump than you do by burning the gas directly for heat, even when considering generation and transmission losses etc.

Given that even during a time of low output from renewables we still only rely on 53% gas for electricity generation it's still much more beneficial environmentally to use a heat pump.

The monetary cost is another story though, and I agree we do need to work on weaning ourselves off gas.

In areas with moderate outdoor temperatures. Anywhere that the heatpump is going through defrost cycles, that statement is likely false because the COP is likely 1 or less when that starts happening.

Then on the generation side, its worse if the NG generation isn't a modern combined cycle plant. which also tends to nix places with a lot of renewable generation because the NG plants are just peaker gas turbines with much lower efficiency than plants designed for continuous use. So, its all situational, but at the same time if one has the choice for cheap NG using that as a second stage and setting the crossover heatpump temperature at the cost/BTU intersection between the heatpump and NG second stage is a rough approximation of the enviromental costs as well as the actual cost.

> In areas with moderate outdoor temperatures. Anywhere that the heatpump is going through defrost cycles, that statement is likely false because the COP is likely 1 or less when that starts happening.

Modern heat pumps have a COP close to 2 at 5F/-15C while still delivering 50k+ BTUs. Here's one example: https://ashp.neep.org/#!/product/68628/7/25000/95/7500/0///0

While heating, That isn't even a particularly efficient unit (EER 9), and not all all unusual for r410 (which is basically banned for new sales in the USA since jan 1st)

But it has a 150W pan heater, but I don't think that is its primary defrost mode, at least its not going to be at 50k btu at those temperatures unless its also really dry. The pan heater is probably to just assure that the coil melt water doesn't build up in the base pan.

For most of the forced air systemms in the USA, the deforst mode is as I mentioned triggered via outdoor coil temp/runtimes and somewhere below an ambient of ~30F, which will be a coil temp of ~20F. The exact algorithm changes from AC unit to unit, but you get say 20 mins of heating, and then it will flip to 5 mins of AC while not running the oudoor fan, where an electric (or maybe gas) furance will heat the indoor air after it flows over the indoor coil which is cooling the air. So its a double wammy, its taking 5+ mins of operation back at an even higher wattage.

AKA the COP goes negative for 5 minuites... Which will pull the SEER numbers down pretty hard, and that unit actually has pretty poor numbers for being variable speed compressors/etc.(edit: should be SCOP, since SEER(2) is just the ac side, that unit looks to be optimized for heating. Either way, depending on which efficienty spec you pay attention to, the 'problem' tends to be that the SCOP/HSPF/etc numbers are calculated using 'moderate' temp data, so below freezing temps are a minority of the calculation)

I poked around a bit looking for the install/service guide for that unit but didn't find one detailing the defrost algorithm.

Not your parent. We had a Fujitsu AOU15RLS3 installed ~10 years ago. 25.3 SEER apparently, EER 13.9. Also r410A. We mainly got it for AC in summer but we'll take the heating of course. Pretty cold winters here.

    Minimum Outdoor Temperature for Heating: -5°F

Yeah that's about as cold as it's right now actually. During the day!

We'll definitely use the propane fireplace in winter, especially when the power goes out, which has happened more frequently in recent years, as "proper winter" has given way to more freeze / thaw type stuff with ice storms.

Can you elaborate on the statement in the first para? Is it a guess, calculation, or there are real-world data?

A heat pump can be well over 100% efficient based on the energy input for equivalent resistive / chemical heating. E.g. your heat pump could use 100w of electricity to move 400w worth of heat (if generated resistively) from the outside to inside.

There have been multiple studies done that show that current generation heat pumps are quite a bit more efficient for a given volume of gas to burn it in an electrical generation plant and use a heat pump than it is to burn it in the house / building.

I see, but it's still mostly a theory unless we count in all small nuances. Like for a place where winters are really frosty heat-pump usually can't help enough (my own experience), and it seems they come with resistive heating built-in nowadays. Which may change the picture. Also, I'm not a specialist, but my guess is that delivery (or how they call it in the industry) of electricity can be priced in potentially wide range.

Yup, that was all accounted for in what I read (well over a year ago, can't find the link...sorry). It was also for a northern climate country (possibly the UK, maybe Norway, memory is failing me here), so it was not "best case" for heat pumps. They took into account losses from generation, transmission, number of days so cold that it is acting as close to a resistive heater (100-120% efficiency), etc. It was pretty comprehensive.

It was from a "what is the best way to lower our use of fossil fuels" perspective, and acknowledged that switching out all boiler systems for heat pumps would be a high cost, but it wasn't really a study on the economics of it. Just a resource usage perspective.

Hinckley point C is under construction in the uk and on track for 2026 opening

Edit: potentially delayed by some years

Definitely delayed to at least 2031 and probably beyond. It was never really on any track other than for the inevitable delays and budget overruns.

It's a shame that some sites are abusing this potentially useful feature to try and increase engagement on their site.

The correct (IMO) way to use this is to request permission after a user initiates it. E.g. clicking a button somewhere in the UI that says "Enable notifications" whilst being in some context where it makes sense to potentially want to enable them.

This is how the web share API works. Calling `navigator.share()` without user interaction will fail as it requires "transient activation"[2]

[1]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Share_A... [2]: https://developer.mozilla.org/en-US/docs/Glossary/Transient_...

Firefox requires both that the user initiates the action that enables the push, and that the user then accepts to receive the notifications in a dialog from the browser itself.

That question is quite old. Nowadays nobody have that kind of problem.

yesn't social engineering and people not understanding anything about technology are a thing, I had to disable notifications for an older person before

but at least no one who potentially is on HN should have that problem ;=)

> It's a shame that some sites are abusing this potentially useful feature to try and increase engagement on their site.

First time on the internet?

Any browser feature that allows sites to pop up any sort of dialog will be used to harass people, usually for ads. That might as well be a law of the internet.

I don't think customers not caring is a valid reason to not do this. Compromised IoT devices don't only cause harm to their owners, but also external networks and the internet as a whole.

A compromised doorbell, or lightbulb etc can be used as part of a botnet to perform DDoS attacks or other nasty activities.

An analogy is like saying we shouldn't work on reducing the pollution emmitted by motor vehicles because the users of these vehicles don't care about how much pollution they cause and would buy them regardless. It's the negative externalities that we need to consider.

I haven't thought through the externality argument very much. If I do I will come back and respond. I'm sure there are people more thoughtful than me who have said something about it.

Something to keep in mind though, government regulation itself is an externality.