this post was submitted on 05 Feb 2025
116 points (94.6% liked)
Open Source
41087 readers
117 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 6 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
$20 to unlock the API killed it for me. If it has a built in way yo lock it down, it's not an open platform and is a great way for bugs to brick a device.
Charging a one time fee for the API seems like a decent way to ensure continued operation.
But if you don't like it, you can run your own server
Problem for me is that there is some kind of restriction on accessing the device's API at all and you pay extra for the key that will get created when you unlock it. This may mean that some kind of lock is in place on the device that has to have a key for it created. Even if they give you a key, what happens if an update removes that key's validity, even unintentionally. I've had this happen with products in the past. A bug will restrict access to things or worst case, will totally brick the device because the lock is stuck in place.
Not saying this device has that problem, but the concept of a lock existing means it could intentionally for profit, maliciously by hacking, or unintentionally end up locked later, so I'm just against the concept in the first place. It's a potential point of failure for no good reason but profit on a device that is supposed to be open. I'd happily accept if they changed a little extra for a device that had no lock at all. Just I don't want a device with a lock on it.
Also, I'm not sure how having my own server helps here, in fact that's my plan in the first place as I want to get the thing to interface with my own internal systems. Maybe I'm misunderstanding the implementation, but my understanding from the very brief information available is that you get on your device, connect to their server to pay a fee, and then a key is created for you and then you can access the endpoints running on the device either through the server or directly with REST calls. The alternative is to teardown the device and build your own custom firmware that uses different authentication mechanisms. I don't really have the interest to mod the firmware and then have to maintain a fork for getting official updates. I just want to be able to be able to interface any servers I have with the device as I choose.
OK, I see. They decoded not to have the device respond to requests. It's not that the device has endpoints, it's that it's hard coded to connect to a specific endpoint and you have to build your own firmware in order to get it to connect to your own server.
That's still a deal-breaker for me. It's just that the connection is flipped. I don't want to have to build and maintain firmware to use the device in addition to maintaining the server. Why can't this be a setting on what server it connects to?
Checked the site quickly and didn't find the information, but judging by the top-level comment, they don't charge you if you want to use their cloud service, but if you want to "unlock" the ability to use someone else's.
No, with home assistant they have a cloud server that has additional functionality that you can use or not. Home Assistant doesn't restrict access to the software on device it's running on.
With this, the device itself will not allow you to access its API endpoints without having a key that you need to purchase. And though they say it's a one time purchase, who's to stop them from releasing a critical security patch that invalidates the keys, even accidentally, or includes making the keys a monthly subscription going forward. Or what happens if that key gets exposed and you need them to generate a new one? Do you need to pay for that or is the device permanently compromised unless you build your own custom firmware?
You're allowed to modify the firmware to use a self hosted server for that functionality without violating the license, which is better than nothing, but then it's up to you to maintain your fork of the firmware. Why not just only require the key if you're connecting to their server and allow you to select your own server without needing to modify and maintain a fork of the firmware?
I think you're not seeing my point. This is in the hardware. It's simple to have a setting that defaults to connecting to the company's server and then have that setting allow for changing the sever target. Why do I need to build firmware to do that?
And, no, it's not acceptable to require forking, regardless of the ease of merging. It still means you won't get critical security updates without manual intervention.
And finally, it's requiring trust. If the company decides to change the license, you are out of luck. And again, the documentation and policies are already lacking, like what happens if your API key is compromised? Do you need to pay for a new one to be generated. These are on your local device.
And no, home assistant doesn't require self-hosting. It requires hardware to put the central system on, but doesn't require an external server for web services. This device is putting the lock inside the hardware you are purchasing. If I purchase hardware, I want it to be mine. Not subject to a license of what you can put on it, even if that license is initially very open. It's my hardware.
Home assistant does sell hardware that is totally open with no license on what software you can put on it. Most people put it on their own hardware. This is totally separate from the cloud service they offer which is for interacting with the sever over the internet and some other stuff. That cloud functionality is totally optional and you aren't required to modify the home assistant code base in order to NOT use the cloud. So it's not at all equivalent.
But were talking about firmware here. My computer also has firmware and an OS. I never have to touch that. Home Assistant is an application that I run on a computer. And I don't have to modify the code in Home Assistant to get it to connect to another device. I just configure it.
I also install Linux on my laptop. Is that self hosting, too? We're not talking about a server or a "host" other than the hardware device itself that lives in the house. If I want the server functionality, sure that's self hosting the server software. Firmware and operating systems are generally not referred to as self-hosting since all devices need those things. Self-hosting refers generally to cloud-based applications, not standalone hardware firmware/OS.
This is a hardware device that is hard coded to connect only to a specific server that you have to pay to access if you want any API functionality. If I want to use my own I have to learn the programming language, figure out how to modify the Firmware, and then maintain a fork of that firmware indefinitely including making sure that there are no automatic updates since that would overwrite the modifications.
This is a really bad way to look at an Open Source project. Want an API for free? Host your own, they have a server you can run. They are providing that service as a hosted platform, that they pay for, so you don't get that part for free. That's not what FOSS is.
Two issues I have:
You can compile whatever you want into the firmware and load it on the device.
The server is configurable, by loading new firmware. It's just like flashing an ESP32, which you could also build your own TRMNL out of.
In other words, those are not real issues.
But i have no desire to compile and maintain a fork of software just to set a URL and auth token. And again, this is a license to modify the firmware, so they could at some point decide to revoke the license to modify the firmware or stop publishing security updates on their git repo to allow for merging into the fork I have to maintain. Probably won't if they are reputable and don't get acquired, but still a risk. It's just not worth it for me for any open product I purchase.
You should probably stop complaining about FOSS if you don't understand how it works.
So? Then don't, but don't claim the $20 is your issue. Firmware is easy, you just don't want to learn it.
Nope. They need approval from all contributors to change, and even if they got that, anyone could fork from the time of the current license. This is how FOSS works. Lemmy itself could do the same thing.
What open products are you purchasing that you think don't follow this pattern?
I said from the beginning it's a deal breaker for me. You're the one trying to convince me it's not the issue I think it is.
And I'm not talking about the license to modify the firmware software itself. I'm talking about the EULA of the device itself. Pretty much any device you own that has any kind of software on it is not owned by you outright to modify as you wish. This website doesn't show the agreement, but if it has a paid feature to unlock, it has to have one somewhere.
https://usetrmnl.com/terms
Pretty standard stuff.
That's for use of the website. Not the device.
That's because that's all they have terms for. This is a company who's FAQ shows you how to take the device apart and how to flash the firmware. It's as open as it gets.
Damn. I would really love one of these, to show off books, show my daily tasks, etc. Really unfortunate its locked down.
Most apps stated in their website if not all are closed source