I feel like Cloud means something now, and as part of the general lexicon, it's okay to use it for what it means. At this point, Cloud kind of means that it's a service hosted somewhere on the Internet, that you don't control directly, usually that you pay for. Sounds like they're still doing that.
Changing the name to distance yourself from AWS and Google Cloud is fine, but "Link" doesn't really tell you anything about where it's hosted or that you still have to pay for it. In fact, by announcing this change with the specific goal of distancing yourself from Big Tech it kind of implies that you're no longer a paid service that happens in some remote data center.
But whatevs. Words don't actually mean anything anymore anyway.
Changing the name to distance yourself from AWS and Google Cloud is fine, but "Link" doesn't really tell you anything about where it's hosted or that you still have to pay for it.
But in this case it’s a misnomer. The Home Assistant instance is not in the cloud, but local. The core service of Nabu Casa Cloud is making it remotely accessible. So Link is actually a better name.
But you don’t have to pay for it. It’s an optional service that provides a secure internet facing link to your HA instance.
You’re more than welcome to host your own or use a vpn or stick it behind cloudflare.
Cloud does mean something in home automation, and that meaning is generally: you must pay a monthly subscription or the product is degraded or doesn't work at all (looking at you wink). This isn’t that.
> I feel like Cloud means something now [...] Cloud kind of means that it's a service hosted somewhere on the Internet, that you don't control directly
Hasn't it meant that for many decades now? Originating as a cloud symbol on network diagrams, but not long after used as a word when people wanted to talk about said diagrams. I certainly remember using it in the 90s, so it has meant that for at least that long. You make it sound like we've only recently come to this determination.
I remember when "cloud computing" was stuff like SETI@Home where a bunch of decentralized, distributed nodes all contributed computing power. But I think that's called the Blockchain now?
I know it only feels like 15 years, but the 90s was, at very least, 26 years and some months ago. Although I suspect the usage goes back even further than that. The internet suggests it was used as far back as the 1960s.
The cloud symbol on network diagrams originally referred to any unspecified network whose details didn't matter to the diagram in question.
"Cloud" today is typically used with a more specific meaning, to refer to services such as IaaS or PaaS, which didn't exist in the 90s.
I don't remember encountering the word "cloud" in the 90s used in the way you describe. The cloud could be a symbol for a telephone network, a packet-switched network (including the internet), a company WAN, etc. Typically you'd refer to whatever the cloud symbol was supposed to represent, it wouldn't be called "the cloud" unless I suppose you were discussing the diagram itself.
> whose details didn't matter to the diagram in question.
Exactly. Hence why services like AWS were said to be cloud services. The details not mattering was the value proposition being sold.
> PaaS, which didn't exist in the 90s.
It did, except we called it time-sharing back then.
> The cloud could be a symbol for a telephone network, a packet-switched network (including the internet), a company WAN, etc.
While you are right that the parent did specifically say internet, I am not sure there is a meaningful distinction anymore. Telephony, packet-switched networks, WANs, etc. are all, for the most part, a part of the internet now. The exceptions are exceptional and thus can be ignored.
Nabu Kasa keeps ignoring the elephant in the room of security and permissions. They have no native ability to set user groups and permissions. There is no serious RBAC. I guess it doesn't sell cloud subscriptions. I cant keep my children from affecting devices they shouldn't. I ended up replacing my automation with mqtt
I think they're reading their audience and making the correct product choice.
Home Assistant users are the power users of the home automation world, but even among their user base I think the number of users who would use a full set of groups and permissions controls in their home is very small.
This is a feature that would take a lot of engineering effort and only make the product more complicated for most of their users. The part of their user base that did use it would probably never be happy because they wanted something even more specific.
Their basic permissions and control structure covers most of the common use cases. Going further would be 100X more work for something that would only be used by a very small minority of users.
I think a lot of people have a wrong perception of how "complicated" authorization systems need to be, most likely because they've been confrontend with badly built ones their whole career.
These days if you build it with a central policy engine, e.g. on top of Open Policy Agent with Rego as a policy language, and stick to a (actor, object, action) triple system, you can build an extensible and powerful authorization system that usually also is less polluting to the codebase as many other approaches. For HA specifically, where you have a quite low numbers of actors and objects, most of the headaches that could come with such a system in terms of scaling also fall away.
I had to check that this wasn’t sarcasm when the post went from this
> I think a lot of people have a wrong perception of how "complicated" authorization systems need to be,
To this
> These days if you build it with a central policy engine, e.g. on top of Open Policy Agent with Rego as a policy language, and stick to a (actor, object, action) triple system,
This is the complexity that makes it not worth the effort. That’s a lot to develop, test, document, maintain, create UX for, and continue educating people about for something so few people would ever use.
I’m not saying it can’t be done. I’m saying doing it would be more effort than the upside. It’s into the part of the curve where you’re spending 10X the developer time as other features to cater to 1 in 1000 users who aren’t going to be happy anyway because it’s not exactly what they imagined they wanted.
> I think a lot of people have a wrong perception of how "complicated" authorization systems need to be
It depends what the authorization requirements are. For consumer-grade security, you're right. But when you start getting into the requirements of large, security-sensitive organizations, there's a lot of unavoidable complexity.
But those contexts often influence the development of security systems, so some of the complexity you're referring to relate to requirements most users don't have.
I disagree that that leads to a huge amount of unavoidable complexity. I am (and have been) building systems that are deployed into exactly those security sensitive organizations, with exactly the stack I described above. The only main requirements that those systems usually have is audit logging, which is becomes easy with a centralized policy engine.
Most complexity that usually plagues authorization systems comes from complex authentication requirements, and can thus be largely isolated there. That's also where many (often legacy systems) lay a bad foundation, because they from the get-go tangle authentication & authorization into thing.
In a model as described above, that just turns into a slightly different `actor`. With that you can also handle things like context-aware authorization without littering your codebase.
> These days if you build it with a central policy engine, e.g. on top of Open Policy Agent with Rego as a policy language, and stick to a (actor, object, action) triple system, you can build an extensible and powerful authorization system that usually also is less polluting to the codebase as many other approaches.
...and if they forget that, they can just edit the source code in command.com!
Are you saying the other comment is describing something impractical for average users? But they're talking about a way to build good authorization, not how users would interact with it. The implication is that the approach would be easier for users.
I don’t know, this seems like a pretty basic feature that I would expect all the mainstream smart home ecosystems to support. Do they not? Is it possible with Alexa/Google Home/ etc. for anyone to say “turn off all the lights in the house” into any smart speaker? I’d honestly expect the defaults to only allow commands to apply to the devices in the same room/group as the smart speaker.
Basically the only people I could imagine that'd actually want a complex user permission group is someone with 1 or more Airbnbs that wants to have an overarching view of their properties but also wants to give "guest" access.
What about giving different agents varying sets of tightly scoped permissions? Is there a good way to achieve that today? If not, it might warrant the effort down the road
The thing is there are tons of "passive" automations that you still might want.
For instance, I left my garage freezer door open, in summer, once. The loss of food almost made me cry (just from the pure waste of it all). I have temp monitors now (external, with probes into fridges and freezers) as well as door sensors. If I am dumb and leave them open, or if they break I'm going to get a notification.
Windows/doors open, and it starts raining, alert... I have a whole set of alerts on when to open the windows too based on season and inside vs outside temp. I have seen a savings on my bills for heating and cooling.
Reminders of all kinds when it's not optimal to run the oven, or appliances because of power costs.
Is it really an Elephant in the Room situation? Are there upvoted ticket/issues or community threads asking for it? I don't really know, it's an honest question.
As somebody with a pretty extensive Home Assistant based home automation system AND kids, I've never once felt the need for this. I can certainly see the utility of it, but Home Assistant is already complicated enough. I'd prefer effort be spent improving the UX, simplifying the system, improving reliability and adding more (optional) integrations.
I don't understand, why is it a joke? HA permissions are just to lock certain users or groups out of controlling certain things. You wouldn't be randomly giving out accounts to people you don't know or trust. It's the controls to your smarthome after all, not a shell account on an open sign-up server.
> HA permissions are just to lock certain users or groups out of controlling certain things
Yes, but only very coarsly granular things.
- Permissions only work with entities. There are about ten different kinds of objects besides entities, that would also benefit a lot from being part of a uniform permission system.
- Permissions can only be defined for groups, not users, which is quite annoying if you want granular permissions
- With permissions only acting on groups, it also isn't possible to base permissions on user attributes. So you ultimately always have to model a permission set as a group, and then essentially have to have a synchronization mechanism that ensures that the right people are in the right groups
- This also makes scoped integration access impossible. You can't grant a third party app access to e.g. only your energy sensor data.
Their ethos is that Home Assistant should be deployed in a non-complicated way and that many things that "IT people" want to do with HA are not actually necessary. I can't find the source but I recall frenck (one of the lead devs) explaining that people ask him about stuff like setting up HA using Terraform and he just wonders why someone would want that.
That the default should be non-complicated isn't necessarily in conflict with features for power users, and I feel like in the HA forums it often is portrayed as an unresolvable conflict, when it isn't.
I do think the maintainers are getting better about it. The releases over the past year have reworked a lot of things to be more intuitive for casual users while also being more flexible for power users, but there is still a lot of ground left to cover.
I think with the growing popularity, and expansion of fields of use, this is something they'll ultimately have to reckon with. I've seen quite a few posts on the the HA subreddit, where it's being used for controls in e.g. hotels or other bigger buildings, because it has a great feature set and prevents vendor lock-in. There is no harm in also catering to those people & organizations.
I need to see end-to-end encryption on this service before I am in any way interested, it should be a "rendezvous service" connecting clients with servers only, with full end-to-end encryption between them, and Nabu Casa should have zero ability to control the server.
That is something not required in a domestic setting, that is what HomeAssistant is designed for. I don't know why your children needs to have access to HA (or the internet afterall).
You can choose whether to make a user an admin, and you can specify certain dashboards to be admin only. My wall panels are all logged in with a non-admin user specific to that panel, set to show only what I want anyone to access.
Some of us in the family are logged into dashboards on our phones with different users, which update depending on which room we are in.
If you want to gate access to certain functionality on a dashboard designed for a common area, you would need to route to a different dashboard upon providing some kind of authorisation, e.g. an onscreen PIN pad.
Guys, you don't have to use it. That's the _entire_ point. Every comment in here is some version of "But it's still a cloud". Sure. But if the entire thing can be replaced with a Tailscale free account, or a Cloudflare tunnel, or a port forward at your router (in descending order of "should you do it"), is it really the same thing? Hence the name change.
Link/Cloud gets you some more things than just the Remote Access part.
Nabu Casa also hosts e.g. STT/TTS services for a HA to use. Again this is easy to replace with something else and entirely optional to begin with, but since I trust Nabu Casa more than, say, Google and don't have the hardware for local models I like to use them.
It's not really a cloud service, maybe some of the add on features are but the major feature is the tunnel. I signed up for the trial and it didn't really give me anything I actually needed. The tunnel makes things simpler but I already had tailscale on another box so what's the point? Plus, I so rarely ever need to access my HA dashboard. I don't really want to pickup my phone to turn a light on. The whole point of HA is automation, not bypassing a vendor's app. Once things are operating how I want, I don't need to fiddle with it so why do I need to pay money to fiddle with it remotely?
I'll wait for someone to do a network call audit before I trust something like this
I've been working on a small project running mitmproxy on a lot of 'privacy-focused' baby-tracking apps and only one of the ones I've tested doesn't send back a bevy of analytics data (none of which they openly promise to anonymize)
some of the worst culprits had things like the Facebook SDK and Google Ads installed and sending data in spite of literally promising not to generate an Ad ID and three (Baby+, Nanit, and Pregnancy+) straight up had Microsoft Clarity sending data (ie basically screen recordings and full input logs)
one open-source, locally hosted one (that's slightly inconvenient if you don't have a home server that can sync logs) - https://github.com/babybuddy/babybuddy
one caveat is that I haven't done anything like longterm use testing - just account setup and a handful of inputs like a specific feed time and amount, etc. if these apps are firing off data with delayed intervals, I wouldn't have captured it
re Nanit, yes, it sent a request to https://r.clarity.ms/collect with a 1.1KB payload after only a few seconds of use. everything I've read about MS Clarity and MS in general around their data practices makes me extremely wary that such a popular app collects this much data
From a pure branding perspective, I think there is something to this. We are building a new "cloud" at exe.dev (everything from racking machines, building a global load balancer, and new APIs onto VMs) and yet it is very hard to bring ourselves to use the word cloud. We don't really want to be associated with the experience or mindset that "cloud" implies. I certainly wish there were a better way to describe this.
The product shape we built at my company is similar to yours and we chose to market capability/value-add rather than "cloud". Didn't really work. I'm bearish on the "sandbox" myself, I just instantly think "either a more expensive vm, or a thing in a less expensive datacenter" (also, my personal experience suggests that people don't want to sandbox things, but there are things they want that need to have sandboxes).
I don't even think Cloudflare has a name for theirs, I remember hearing it called their developer platform but after checking just now, they seem to mostly just call it "products".
Devtools marketing to consumers feels pretty impossible to me. I think you either need to be absolutely massive and have existing credibility + tons of resources to throw at every possible marketing channel, or figure out how to get people to truly love your product/brand. You're basically selling trust/professional identities in most cases rather than compute or APIs.
If I were to do it again I would either pick a different vertical or put 90% of my effort into community-building, events, PR/tech-influencer stuff, and flashy demos. You only need to fall back to widely known framings like "cloud" when nobody knows about you.
Rebranding is the right thing and way over due. I honestly hadn't checked them out before but this has made me read through the site a bit. I am intrigued by their privacy claims. I will definitely be looking into them more if those claims hold up.
OpenHAB cloud is free, https://www.myopenhab.org/, but I think for most technical people, just reverse proxy what you have (HA, OH, etc...) and put something like vouch proxy or oauth2-proxy in front of the endpoint. I don't want any cloud standing in the way of my door lock opening.
That's a lot of unnecessary words to just say they're renaming that feature.
Not to mention it's a highly unused feature. Most will use HASS on a home LAN in a self-hosted environment with no directly connectivity (unless you're insane), behind a VPN, which is the only correct way to do it.
> [..] the name just didn’t feel right. For example, there were times when Paulus, founder of Home Assistant and President of the Open Home Foundation, was on stage saying “don’t buy products that require the cloud to work,” then in the next breath having to explain how Home Assistant Cloud is different, despite the name.
They tried to solve the problem "How can Paulus keep saying all clouds are bad except ours?", but Nabu Casa remains a Cloud service with different clothes. At least they're doing the right thing by focusing on why Nabu Casa currently champions different ethics.
Huh? I am using cloud compute for 15 years now, I haven't noticed anything being 'ruined' about it. You pay some people money and they run your workloads, it mostly works, same as with local compute.
Not sure why they dramatise it so much. Want a corporate rebrand, have at it. The like changing things, I get that.
They’re talking about consumer products that are cloud-based. You buy a security camera, for example, and you find out all functionality relies on the cloud and all your data is in the cloud. When the cloud isn’t available, your product doesn’t work. When the cloud is available, it’s spying on you.
We are talking about what the cloud means to an entirely different segment of the population to you and me.
To me, a "cloud" always felt like it should be describing something decentralized. So I recently made an alternative to the Big Tech clouds, and I'm giving it away as open source. Anyone can use it on their site, to have their site's members store data in their browser tabs, it's like IPFS pinning, but far more efficient and easy to use: just open a tab and that's it.
Drops - this is regular normies opening a tab
Jets - this is people running a node to route requests
Client - this is what's embedded in iframes etc.
Oh, and one more thing. It encrypts everything end-to-end, supports streaming video (!) and lets you share specific intervals or chunks if you want, so that the decryption happens only of those intervals. You can sell content that many people around the world store encrypted, and don't know what they're storing.
I loved it! 4 years ago I built a platform for robotics and one portion of it was a cloud side, we got into the discussion what kinda name to have, silly names catchy names etc., but eventually after none was selected, I went with the “XYZ link” name, because indeed the actual function was a link between operator and a robot in the field, and I think it also fits home assistant as well. Love HA been using it for around 2years now and integrating everything into it!
The post mentions bare metal so it’s possible they found a partner to collocate with in a few of the big regions globally.
Regardless, they also call out that what they offer is only an enhancement and if you use it as the only way to access your smarthome then you are not really using the software as intended.
We will see in 12 months if the migration was worth it. Nabu Casa is starting to push harder into B2C so we shall see if the product can keep up with the demand.
You’re missing the point entirely. Some other home automation platforms require a cloud/subscription to function at all. It has nothing to do with running on AWS or Azure or insert hyperscaler.
Link is completely optional and does not affect the functionality of home assistant. You can run completely offline without a subscription of any kind on your own hardware if you so choose.
I find the downvotes without comment fascinating. Everything I posted was relevant and completely factual. I can only assume it’s people that have literally no idea what home automation is and what cloud is in this context. Cloud doesn’t and has never meant hyperscaler, and where it is hosted is completely irrelevant to the discussion.
Sadly way overpriced for what you get. You can achieve the same for free with a Cloudflare tunnel. It’s great that this service supports the development of home assistant but the pricing is just silly.
In addition to dedicated support, as part of their free Cloudflare tunnels.
Sorry for being snarky, but given the tone/point of the announcement is anti-big tech it's funny to complain that the pricing is so high compared to big tech.
Taken on its own, for the price of a nice coffee a month you also support Home Assistant development and get something in exchange. Pretty good value.
Cloudflare offers 10GB of free R2 storage. HA has a backup plugin for Cloudflare R2.
HA already has many plugins for doing voice processing locally or through other cloud providers (freely or cheaply)
A cloudflare tunnel would also give you direct access to WebRTC streams, just like being at home. HA Cloud just offers relay servers so you don't have to directly connect.
If you want to give HA money, go ahead but there's nothing truly compelling it offers that I couldn't get elsewhere for much less.
Given the predatory pricing model the "cloud" has become, this makes perfect sense.
Azure and AWS have become practically a racket. I haven't seen a single "cloud native" company yet that is not leaking hundreds of thousands of dollars per month to the US digital monopolists.
We're going to take back the internet and own tech forever.
I know I have a few anti-AI haters on HN, but hear me out. I'm currently using Opus 5.5 to create 100% pure-Rust, immediate mode rendering, open source implementations of Adobe's entire suite:
I got bit by the dark pattern "cancellation fee" one too many times.
AI lets us take back tech and set the clock back to the pre-shitty era. But now you can just create 1:1 functional equivalents, clean room, that are highly performant and cross-platform. Nothing is stopping you.
We'll replace Google Search, we'll build our own smartphones, we'll build better infra. We'll remove all the ads and de-enshittify the entire tech world.
Big tech sowed the seeds of their own commodification with AI. It's all going to come down now that we can rebuild everything without toiling for years to even get close to scaling software capability moats.
The internet is going to reset to 1990-2004 (pre-facebook / "web 2.0" era). The indie web era. Everything is going to be reborn as open source.
> For example, there were times when Paulus, founder of Home Assistant and President of the Open Home Foundation, was on stage saying “don’t buy products that require the cloud to work,” then in the next breath having to explain how Home Assistant Cloud is different, despite the name. That created unnecessary friction.
You can’t install Home Assistant without DockerHub, and it fetches all sorts of stuff from cloud hosters during use.
HA is offline first, but they don’t really take privacy or data hygiene seriously; it shouldn’t talk to the internet at all until and unless you configure it to do something that needs internet. That isn’t the case today, you can’t even install it without internet.
I feel like Cloud means something now, and as part of the general lexicon, it's okay to use it for what it means. At this point, Cloud kind of means that it's a service hosted somewhere on the Internet, that you don't control directly, usually that you pay for. Sounds like they're still doing that.
Changing the name to distance yourself from AWS and Google Cloud is fine, but "Link" doesn't really tell you anything about where it's hosted or that you still have to pay for it. In fact, by announcing this change with the specific goal of distancing yourself from Big Tech it kind of implies that you're no longer a paid service that happens in some remote data center.
But whatevs. Words don't actually mean anything anymore anyway.
Changing the name to distance yourself from AWS and Google Cloud is fine, but "Link" doesn't really tell you anything about where it's hosted or that you still have to pay for it.
But in this case it’s a misnomer. The Home Assistant instance is not in the cloud, but local. The core service of Nabu Casa Cloud is making it remotely accessible. So Link is actually a better name.
That's fair. The distinction wasn't clear to me. Guess that's why they decided to change the name
I agree. It’s closer to a jump box than it is a SaaS offering.
But you don’t have to pay for it. It’s an optional service that provides a secure internet facing link to your HA instance.
You’re more than welcome to host your own or use a vpn or stick it behind cloudflare.
Cloud does mean something in home automation, and that meaning is generally: you must pay a monthly subscription or the product is degraded or doesn't work at all (looking at you wink). This isn’t that.
>Words don't actually mean anything anymore anyway.
They never did.
Well, except in France, they get really mad about that.
The announcement is a marketing stunt to direct people to their website.
> I feel like Cloud means something now [...] Cloud kind of means that it's a service hosted somewhere on the Internet, that you don't control directly
Hasn't it meant that for many decades now? Originating as a cloud symbol on network diagrams, but not long after used as a word when people wanted to talk about said diagrams. I certainly remember using it in the 90s, so it has meant that for at least that long. You make it sound like we've only recently come to this determination.
I mean, 15 years is relatively recent.
I remember when "cloud computing" was stuff like SETI@Home where a bunch of decentralized, distributed nodes all contributed computing power. But I think that's called the Blockchain now?
I don't know. I usually live under a rock.
I know it only feels like 15 years, but the 90s was, at very least, 26 years and some months ago. Although I suspect the usage goes back even further than that. The internet suggests it was used as far back as the 1960s.
The cloud symbol on network diagrams originally referred to any unspecified network whose details didn't matter to the diagram in question.
"Cloud" today is typically used with a more specific meaning, to refer to services such as IaaS or PaaS, which didn't exist in the 90s.
I don't remember encountering the word "cloud" in the 90s used in the way you describe. The cloud could be a symbol for a telephone network, a packet-switched network (including the internet), a company WAN, etc. Typically you'd refer to whatever the cloud symbol was supposed to represent, it wouldn't be called "the cloud" unless I suppose you were discussing the diagram itself.
> whose details didn't matter to the diagram in question.
Exactly. Hence why services like AWS were said to be cloud services. The details not mattering was the value proposition being sold.
> PaaS, which didn't exist in the 90s.
It did, except we called it time-sharing back then.
> The cloud could be a symbol for a telephone network, a packet-switched network (including the internet), a company WAN, etc.
While you are right that the parent did specifically say internet, I am not sure there is a meaningful distinction anymore. Telephony, packet-switched networks, WANs, etc. are all, for the most part, a part of the internet now. The exceptions are exceptional and thus can be ignored.
Nabu Kasa keeps ignoring the elephant in the room of security and permissions. They have no native ability to set user groups and permissions. There is no serious RBAC. I guess it doesn't sell cloud subscriptions. I cant keep my children from affecting devices they shouldn't. I ended up replacing my automation with mqtt
I think they're reading their audience and making the correct product choice.
Home Assistant users are the power users of the home automation world, but even among their user base I think the number of users who would use a full set of groups and permissions controls in their home is very small.
This is a feature that would take a lot of engineering effort and only make the product more complicated for most of their users. The part of their user base that did use it would probably never be happy because they wanted something even more specific.
Their basic permissions and control structure covers most of the common use cases. Going further would be 100X more work for something that would only be used by a very small minority of users.
I think a lot of people have a wrong perception of how "complicated" authorization systems need to be, most likely because they've been confrontend with badly built ones their whole career.
These days if you build it with a central policy engine, e.g. on top of Open Policy Agent with Rego as a policy language, and stick to a (actor, object, action) triple system, you can build an extensible and powerful authorization system that usually also is less polluting to the codebase as many other approaches. For HA specifically, where you have a quite low numbers of actors and objects, most of the headaches that could come with such a system in terms of scaling also fall away.
I had to check that this wasn’t sarcasm when the post went from this
> I think a lot of people have a wrong perception of how "complicated" authorization systems need to be,
To this
> These days if you build it with a central policy engine, e.g. on top of Open Policy Agent with Rego as a policy language, and stick to a (actor, object, action) triple system,
This is the complexity that makes it not worth the effort. That’s a lot to develop, test, document, maintain, create UX for, and continue educating people about for something so few people would ever use.
I’m not saying it can’t be done. I’m saying doing it would be more effort than the upside. It’s into the part of the curve where you’re spending 10X the developer time as other features to cater to 1 in 1000 users who aren’t going to be happy anyway because it’s not exactly what they imagined they wanted.
> I think a lot of people have a wrong perception of how "complicated" authorization systems need to be
It depends what the authorization requirements are. For consumer-grade security, you're right. But when you start getting into the requirements of large, security-sensitive organizations, there's a lot of unavoidable complexity.
But those contexts often influence the development of security systems, so some of the complexity you're referring to relate to requirements most users don't have.
I disagree that that leads to a huge amount of unavoidable complexity. I am (and have been) building systems that are deployed into exactly those security sensitive organizations, with exactly the stack I described above. The only main requirements that those systems usually have is audit logging, which is becomes easy with a centralized policy engine.
Most complexity that usually plagues authorization systems comes from complex authentication requirements, and can thus be largely isolated there. That's also where many (often legacy systems) lay a bad foundation, because they from the get-go tangle authentication & authorization into thing.
In a model as described above, that just turns into a slightly different `actor`. With that you can also handle things like context-aware authorization without littering your codebase.
> These days if you build it with a central policy engine, e.g. on top of Open Policy Agent with Rego as a policy language, and stick to a (actor, object, action) triple system, you can build an extensible and powerful authorization system that usually also is less polluting to the codebase as many other approaches.
...and if they forget that, they can just edit the source code in command.com!
Are you saying the other comment is describing something impractical for average users? But they're talking about a way to build good authorization, not how users would interact with it. The implication is that the approach would be easier for users.
I don’t know, this seems like a pretty basic feature that I would expect all the mainstream smart home ecosystems to support. Do they not? Is it possible with Alexa/Google Home/ etc. for anyone to say “turn off all the lights in the house” into any smart speaker? I’d honestly expect the defaults to only allow commands to apply to the devices in the same room/group as the smart speaker.
Basically the only people I could imagine that'd actually want a complex user permission group is someone with 1 or more Airbnbs that wants to have an overarching view of their properties but also wants to give "guest" access.
What about giving different agents varying sets of tightly scoped permissions? Is there a good way to achieve that today? If not, it might warrant the effort down the road
> I think the number of users who would use a full set of groups and permissions controls in their home is very small.
In the age of agents everywhere this is no longer true or viable.
It's going to be hard for them to do it, for historic and legacy code reasons. But it's long past being a choice and now becoming a need.
Or, you know, just don't automate your home to begin with (as the vast majority of people don't) and it isn't a problem.
No matter how crazy smart AI gets it's not going to be able to hack my doors, lights or thermostat.
The thing is there are tons of "passive" automations that you still might want.
For instance, I left my garage freezer door open, in summer, once. The loss of food almost made me cry (just from the pure waste of it all). I have temp monitors now (external, with probes into fridges and freezers) as well as door sensors. If I am dumb and leave them open, or if they break I'm going to get a notification.
Windows/doors open, and it starts raining, alert... I have a whole set of alerts on when to open the windows too based on season and inside vs outside temp. I have seen a savings on my bills for heating and cooling.
Reminders of all kinds when it's not optimal to run the oven, or appliances because of power costs.
Is it really an Elephant in the Room situation? Are there upvoted ticket/issues or community threads asking for it? I don't really know, it's an honest question.
As somebody with a pretty extensive Home Assistant based home automation system AND kids, I've never once felt the need for this. I can certainly see the utility of it, but Home Assistant is already complicated enough. I'd prefer effort be spent improving the UX, simplifying the system, improving reliability and adding more (optional) integrations.
> Are there upvoted ticket/issues or community threads asking for it? I don't really know, it's an honest question.
Many, going back years.
This is false. https://developers.home-assistant.io/docs/auth_permissions/
https://community.home-assistant.io/t/wth-no-rbac-role-based...
This thread is relevant. Their permissions system is just on entities, and isn't a real EBAC system.
I'm usually not one to jump quickly to that, but that's a joke of a permission system.
I don't understand, why is it a joke? HA permissions are just to lock certain users or groups out of controlling certain things. You wouldn't be randomly giving out accounts to people you don't know or trust. It's the controls to your smarthome after all, not a shell account on an open sign-up server.
> HA permissions are just to lock certain users or groups out of controlling certain things
Yes, but only very coarsly granular things.
- Permissions only work with entities. There are about ten different kinds of objects besides entities, that would also benefit a lot from being part of a uniform permission system.
- Permissions can only be defined for groups, not users, which is quite annoying if you want granular permissions
- With permissions only acting on groups, it also isn't possible to base permissions on user attributes. So you ultimately always have to model a permission set as a group, and then essentially have to have a synchronization mechanism that ensures that the right people are in the right groups
- This also makes scoped integration access impossible. You can't grant a third party app access to e.g. only your energy sensor data.
Their ethos is that Home Assistant should be deployed in a non-complicated way and that many things that "IT people" want to do with HA are not actually necessary. I can't find the source but I recall frenck (one of the lead devs) explaining that people ask him about stuff like setting up HA using Terraform and he just wonders why someone would want that.
That the default should be non-complicated isn't necessarily in conflict with features for power users, and I feel like in the HA forums it often is portrayed as an unresolvable conflict, when it isn't.
I do think the maintainers are getting better about it. The releases over the past year have reworked a lot of things to be more intuitive for casual users while also being more flexible for power users, but there is still a lot of ground left to cover.
I think with the growing popularity, and expansion of fields of use, this is something they'll ultimately have to reckon with. I've seen quite a few posts on the the HA subreddit, where it's being used for controls in e.g. hotels or other bigger buildings, because it has a great feature set and prevents vendor lock-in. There is no harm in also catering to those people & organizations.
I'd guess that most of the Home Assistant user base is "IT people".
I don't see HA as a consumer established product, as much as Nabu Kasa would like otherwise.
Then again, this is just my guesswork. I have 0 clue the demographics of Home Assistant users
I'd like to prevent my children from viewing / modifying certain parts of the home. Is that so niche?
It's a hacky solution, but someone built a permissions system that shims in front of the API to restrict access for different users
https://www.reddit.com/r/homeassistant/comments/1vxw5pu/acce...
I need to see end-to-end encryption on this service before I am in any way interested, it should be a "rendezvous service" connecting clients with servers only, with full end-to-end encryption between them, and Nabu Casa should have zero ability to control the server.
Build that and I'll be interested.
That's exactly how it's build. Nabu Casa has never been able to see any user data. You can read more about it here https://support.nabucasa.com/hc/en-us/articles/2650888200758...
That sounds like an Enterprise Team Plan offering, available only with the SSO tier.
Apparently they're saying this is the wrong way to run a cloud.
That is something not required in a domestic setting, that is what HomeAssistant is designed for. I don't know why your children needs to have access to HA (or the internet afterall).
Ok so i am wrong to want interface panels to control things with Home Assistant because I have kids?
You can choose whether to make a user an admin, and you can specify certain dashboards to be admin only. My wall panels are all logged in with a non-admin user specific to that panel, set to show only what I want anyone to access.
Some of us in the family are logged into dashboards on our phones with different users, which update depending on which room we are in.
If you want to gate access to certain functionality on a dashboard designed for a common area, you would need to route to a different dashboard upon providing some kind of authorisation, e.g. an onscreen PIN pad.
Happy to discuss.
I'll send you $1 in a crypto coin of your choice if you can think of one good use case that would benefit from this
> That is something not required in a domestic setting
We didn't know you'd declared this. I hope there are temporary solutions available while your declaration is communicated to everybody else.
Guys, you don't have to use it. That's the _entire_ point. Every comment in here is some version of "But it's still a cloud". Sure. But if the entire thing can be replaced with a Tailscale free account, or a Cloudflare tunnel, or a port forward at your router (in descending order of "should you do it"), is it really the same thing? Hence the name change.
Link/Cloud gets you some more things than just the Remote Access part.
Nabu Casa also hosts e.g. STT/TTS services for a HA to use. Again this is easy to replace with something else and entirely optional to begin with, but since I trust Nabu Casa more than, say, Google and don't have the hardware for local models I like to use them.
It's not really a cloud service, maybe some of the add on features are but the major feature is the tunnel. I signed up for the trial and it didn't really give me anything I actually needed. The tunnel makes things simpler but I already had tailscale on another box so what's the point? Plus, I so rarely ever need to access my HA dashboard. I don't really want to pickup my phone to turn a light on. The whole point of HA is automation, not bypassing a vendor's app. Once things are operating how I want, I don't need to fiddle with it so why do I need to pay money to fiddle with it remotely?
I thought the same. However, you are also supporting their open source development and so I didn't cancel my subscription :)
Same here. I _think_ I use the TTS stuff? Not sure. I just subscribe to support the project.
Concur. I've kept my subscription primarily as a way to support the project.
I'll wait for someone to do a network call audit before I trust something like this
I've been working on a small project running mitmproxy on a lot of 'privacy-focused' baby-tracking apps and only one of the ones I've tested doesn't send back a bevy of analytics data (none of which they openly promise to anonymize)
some of the worst culprits had things like the Facebook SDK and Google Ads installed and sending data in spite of literally promising not to generate an Ad ID and three (Baby+, Nanit, and Pregnancy+) straight up had Microsoft Clarity sending data (ie basically screen recordings and full input logs)
This has been around for years. It's just a rename. The code is open source and you or anyone else can go look at it (and many have).
Which one didn't send back a ton of analytics?
Also, surprised with Nanit, Microsoft Clarity was found on the phone app?
With the whole LG fiasco I wouldn't be surprised if the camera itself was doing network fingerprinting and data collection.
one open-source, locally hosted one (that's slightly inconvenient if you don't have a home server that can sync logs) - https://github.com/babybuddy/babybuddy
and a really obscure and clearly vibe-designed one (that still works fine) that only fired off a single Firebase call noting an install: https://play.google.com/store/apps/details?id=com.mimiapp.mi...
one caveat is that I haven't done anything like longterm use testing - just account setup and a handful of inputs like a specific feed time and amount, etc. if these apps are firing off data with delayed intervals, I wouldn't have captured it
re Nanit, yes, it sent a request to https://r.clarity.ms/collect with a 1.1KB payload after only a few seconds of use. everything I've read about MS Clarity and MS in general around their data practices makes me extremely wary that such a popular app collects this much data
(H)ome (A)ssistant (L)ink.
Might as well add 9000 at the end of it.
If it operated on port 9000 by default it would be perfect.
And it's the thing responsible for opening your doors...
I'm afraid it can't do that. I'm sorry, Marcosdumay. /s
this is just the first iteration.
HAL 1?
From a pure branding perspective, I think there is something to this. We are building a new "cloud" at exe.dev (everything from racking machines, building a global load balancer, and new APIs onto VMs) and yet it is very hard to bring ourselves to use the word cloud. We don't really want to be associated with the experience or mindset that "cloud" implies. I certainly wish there were a better way to describe this.
The product shape we built at my company is similar to yours and we chose to market capability/value-add rather than "cloud". Didn't really work. I'm bearish on the "sandbox" myself, I just instantly think "either a more expensive vm, or a thing in a less expensive datacenter" (also, my personal experience suggests that people don't want to sandbox things, but there are things they want that need to have sandboxes).
I don't even think Cloudflare has a name for theirs, I remember hearing it called their developer platform but after checking just now, they seem to mostly just call it "products".
Devtools marketing to consumers feels pretty impossible to me. I think you either need to be absolutely massive and have existing credibility + tons of resources to throw at every possible marketing channel, or figure out how to get people to truly love your product/brand. You're basically selling trust/professional identities in most cases rather than compute or APIs.
If I were to do it again I would either pick a different vertical or put 90% of my effort into community-building, events, PR/tech-influencer stuff, and flashy demos. You only need to fall back to widely known framings like "cloud" when nobody knows about you.
Rebranding is the right thing and way over due. I honestly hadn't checked them out before but this has made me read through the site a bit. I am intrigued by their privacy claims. I will definitely be looking into them more if those claims hold up.
OpenHAB cloud is free, https://www.myopenhab.org/, but I think for most technical people, just reverse proxy what you have (HA, OH, etc...) and put something like vouch proxy or oauth2-proxy in front of the endpoint. I don't want any cloud standing in the way of my door lock opening.
That's a lot of unnecessary words to just say they're renaming that feature.
Not to mention it's a highly unused feature. Most will use HASS on a home LAN in a self-hosted environment with no directly connectivity (unless you're insane), behind a VPN, which is the only correct way to do it.
Big Tech didn't ruin the cloud, they just turned it into a landlord business. We are making it a home again.
The Verge also has an interview with Paulus about this https://www.theverge.com/tech/1003936/home-assistant-says-bi...
> [..] the name just didn’t feel right. For example, there were times when Paulus, founder of Home Assistant and President of the Open Home Foundation, was on stage saying “don’t buy products that require the cloud to work,” then in the next breath having to explain how Home Assistant Cloud is different, despite the name.
They tried to solve the problem "How can Paulus keep saying all clouds are bad except ours?", but Nabu Casa remains a Cloud service with different clothes. At least they're doing the right thing by focusing on why Nabu Casa currently champions different ethics.
It's still a proprietary SaaS, whatever they call it.
What was the cloud before big tech?
Someone else's computer
Virtual private servers and shell accounts.
Only the cloud they ruined? :-)
Huh? I am using cloud compute for 15 years now, I haven't noticed anything being 'ruined' about it. You pay some people money and they run your workloads, it mostly works, same as with local compute.
Not sure why they dramatise it so much. Want a corporate rebrand, have at it. The like changing things, I get that.
They’re talking about consumer products that are cloud-based. You buy a security camera, for example, and you find out all functionality relies on the cloud and all your data is in the cloud. When the cloud isn’t available, your product doesn’t work. When the cloud is available, it’s spying on you.
We are talking about what the cloud means to an entirely different segment of the population to you and me.
To me, a "cloud" always felt like it should be describing something decentralized. So I recently made an alternative to the Big Tech clouds, and I'm giving it away as open source. Anyone can use it on their site, to have their site's members store data in their browser tabs, it's like IPFS pinning, but far more efficient and easy to use: just open a tab and that's it.
https://safebots.github.io/Safecloud
It has three types of participants:
Oh, and one more thing. It encrypts everything end-to-end, supports streaming video (!) and lets you share specific intervals or chunks if you want, so that the decryption happens only of those intervals. You can sell content that many people around the world store encrypted, and don't know what they're storing.Here is an article about it in a security magazine: https://www.helpnetsecurity.com/2026/06/19/safecloud-browser...
I loved it! 4 years ago I built a platform for robotics and one portion of it was a cloud side, we got into the discussion what kinda name to have, silly names catchy names etc., but eventually after none was selected, I went with the “XYZ link” name, because indeed the actual function was a link between operator and a robot in the field, and I think it also fits home assistant as well. Love HA been using it for around 2years now and integrating everything into it!
Unless they have their own data centers, they are still hosting it on top of AWS or something.
I get that they are trying to market this but it is a bit disingenuous.
The post mentions bare metal so it’s possible they found a partner to collocate with in a few of the big regions globally.
Regardless, they also call out that what they offer is only an enhancement and if you use it as the only way to access your smarthome then you are not really using the software as intended.
We will see in 12 months if the migration was worth it. Nabu Casa is starting to push harder into B2C so we shall see if the product can keep up with the demand.
What "migration"? This is just a rename.
Article does mention they improved their backend stuff by using bare metal servers so that "you connect to the closest server".
You’re missing the point entirely. Some other home automation platforms require a cloud/subscription to function at all. It has nothing to do with running on AWS or Azure or insert hyperscaler.
Link is completely optional and does not affect the functionality of home assistant. You can run completely offline without a subscription of any kind on your own hardware if you so choose.
I find the downvotes without comment fascinating. Everything I posted was relevant and completely factual. I can only assume it’s people that have literally no idea what home automation is and what cloud is in this context. Cloud doesn’t and has never meant hyperscaler, and where it is hosted is completely irrelevant to the discussion.
At a glance it looks like they're using OVH servers for the relays, so they're on dedicated bare metal
Sadly way overpriced for what you get. You can achieve the same for free with a Cloudflare tunnel. It’s great that this service supports the development of home assistant but the pricing is just silly.
I didn't realize Cloudflare also offered:
- Offsite Backups
- Voice control (Alexa & Google Home)
- Voice Processing (STT/TTS)
- Better media streaming (video/audio)
In addition to dedicated support, as part of their free Cloudflare tunnels.
Sorry for being snarky, but given the tone/point of the announcement is anti-big tech it's funny to complain that the pricing is so high compared to big tech.
Taken on its own, for the price of a nice coffee a month you also support Home Assistant development and get something in exchange. Pretty good value.
Cloudflare offers 10GB of free R2 storage. HA has a backup plugin for Cloudflare R2.
HA already has many plugins for doing voice processing locally or through other cloud providers (freely or cheaply)
A cloudflare tunnel would also give you direct access to WebRTC streams, just like being at home. HA Cloud just offers relay servers so you don't have to directly connect.
If you want to give HA money, go ahead but there's nothing truly compelling it offers that I couldn't get elsewhere for much less.
I think the "supporting HA development" argument is really not a bad one. HA is so much better than anything else by such a wide margin.
I'm happy to subsidize HA development
£65/year is overpriced? It's this choosing beggars mentality that ends up in projects being abandoned.
...so they're naming it "HAL"? Really?
Stanley Kubrick must be chortling in his grave.
Given the predatory pricing model the "cloud" has become, this makes perfect sense.
Azure and AWS have become practically a racket. I haven't seen a single "cloud native" company yet that is not leaking hundreds of thousands of dollars per month to the US digital monopolists.
Cloud capitalism at its finest..
We're going to take back the internet and own tech forever.
I know I have a few anti-AI haters on HN, but hear me out. I'm currently using Opus 5.5 to create 100% pure-Rust, immediate mode rendering, open source implementations of Adobe's entire suite:
https://github.com/storytold/photocraft (Photoshop)
https://github.com/storytold/vectorcraft (Illustrator)
https://github.com/storytold/filmcraft (Premiere)
https://github.com/storytold/lightcraft (Lightroom)
https://github.com/storytold/printcraft (Acrobat Pro)
https://github.com/storytold/effectcraft (After Effects)
https://github.com/storytold/designcraft (InDesign)
I got bit by the dark pattern "cancellation fee" one too many times.
AI lets us take back tech and set the clock back to the pre-shitty era. But now you can just create 1:1 functional equivalents, clean room, that are highly performant and cross-platform. Nothing is stopping you.
We'll replace Google Search, we'll build our own smartphones, we'll build better infra. We'll remove all the ads and de-enshittify the entire tech world.
Big tech sowed the seeds of their own commodification with AI. It's all going to come down now that we can rebuild everything without toiling for years to even get close to scaling software capability moats.
The internet is going to reset to 1990-2004 (pre-facebook / "web 2.0" era). The indie web era. Everything is going to be reborn as open source.
We're going to own it all.
> We're going to own it all.
We don't even own the AI that is building all of this.
One day, RAM prices will settle again, and the USA-China race will probably keep giving us fresh models to self-host (weights only, but still.)
That's not too far from owning it.
> For example, there were times when Paulus, founder of Home Assistant and President of the Open Home Foundation, was on stage saying “don’t buy products that require the cloud to work,” then in the next breath having to explain how Home Assistant Cloud is different, despite the name. That created unnecessary friction.
You can’t install Home Assistant without DockerHub, and it fetches all sorts of stuff from cloud hosters during use.
HA is offline first, but they don’t really take privacy or data hygiene seriously; it shouldn’t talk to the internet at all until and unless you configure it to do something that needs internet. That isn’t the case today, you can’t even install it without internet.
Oh the glory of virtue signaling...