Related discussion: https://news.ycombinator.com/item?id=27505277
a) five years ago
b) nothing to be ashamed of, honestly
c) dumb drama
This is bad faith. You could reference it in good faith as context, but that is not what you are doing.
As someone whose smart home need is minimal -- I just use it to turn on/off lights with voice -- I'd rather have nothing than support such behavior.
Edit: I'm sure a greater good argument can be made. I just don't think they are making it in a way that justifies the invasiveness.
On the one hand, it's understandable. No amount of documentation changes will fix the issue.
On the other hand, it's a pretty abrasive response. It wouldn't have taken any more effort to be a little more helpful and direct OP to the right repo: "Sorry, this is the wrong place for this to be addressed. Please bring it up here instead [link]."
I have a great deal of sympathy for them refusing to engage; decisive software creators are far less palatable to an entitled swarm of disagreement, and that same decisiveness is what makes the best software. Perhaps in U.S. culture, refusal with a smile and a reassurance that “We’re Listening” is something folks feel entitled to, but in other areas of the world, demanding a stranger change their mind once it’s made up earns only mockery or pity. To those cultures, this GitHub is a comedy-farce, and I laughed out loud upon reading it — not because I necessarily agree with the project’s decision, but because I agree culturally with their tone and handling of what some view as blatant immaturity: a final flat refusal, closing the door, and getting back to work.
>Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a
just wanted to add an outsider perspective here, not trying to add wood to the fire
but i don’t think it’s inappropriate or ‘a threat’ to let the dev know the user can stop using the software.
It was a clear attempt to sway with intimidation. It was done politely but that doesn’t change what it was. (The dev had already closed as won’t fix, too, so they had preemptively answered.)
Yeah, I agree with the maintainer, this strikes me as outrage theater over any actual problem, no?
And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer.
Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.
In this case, frenck most certainly backtracked because they realized they were on the front page of HN and did not want the heat.
what a petty answer. "just fork it bro".
It's pretty clear that the maintainer should've handled it better but I'd be lying if I said I never felt like telling a petulant user off. The problem is he didn't handle it professionally.
Leaving that aside, even if you diagree with it you (the user) are not entitled to anything, especially not entitled to have an attitude.
Just think about it differently, what do you think would happen if you do the same in the real world?
I'm pretty sure in the best case scenario you may be asked to leave and in the worst case scenario you may be "escorted" out of the premises.
A little bit of politeness goes a long way.
My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue.
As it turns out, the check can already be turned off after all:
It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now.Only the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/super...
Our documentation should have explained all of this, including how to turn it off. We'll get that updated.
You might have a heart of gold, and just be having an off day due to reasons, so I hope people cut you some slack, but if I were you I'd update this feature to be opt-in and conspicuous, immediately
I'm not exactly sure why, but the stuff that happens tells that story (to me at least).
Barking at frenck on a Friday at 11.30PM like this is probably not the right thing to do.
But you are right, it is time to head downstairs for a beer with Mrs. Frenck.
../Frenck
I've used 1Password's Watchtower for so many years that I assumed the breached password check was just part of it. After your reply I looked it up and learned it's actually a setting in their privacy preferences, so my comparison was off.
../Frenck
I’m curious what made you change your mind, perhaps seeing this getting traction on hn?
Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'.
Some would consider phoning home to a remote server to be worrisome. It's home assistant not cloud assistant.
Problem solved!
>My replies there were more dismissive than they should have been
What about this one?