They were basically fine, but they are hardcoded to your Virgin Media service so can't be used for anything else. I eventually swapped to a different router and they became useless. Virgin refuse to collect them (despite repeatedly promising to) so I decided to crack one open.

I was hoping there would be a reset pin or something in there - but I can't find any easy way to jailbreak them. Anyway, here are the photos.

A spludger around the edges was enough to pop off the plastic cover.

There's a huge heat-sink and a small fan. The plastic casing comes away easily.

The fan is easy to unscrew and the power connector pops off.

Once that's off, the heatsink can be removed by unscrewing it and prising it off.

Splodges of pink gunk - which I assume is thermal paste rather than reconstituted meat - is present. Pulling the main circuit board out shows the power board.

That's tough to remove without damaging the live and neutral contacts. Once done, you can see the capacitors.

There you go. Nothing stunningly interesting or useful for debugging.

If you have a big home, put a pod in every room and you'll have fast WiFi broadcast everywhere. Well, that's the theory.

Limitations

The big limitation is that both your 2.4GHz and 5GHz WiFi SSIDs need to have the same name and password. I usually split the names so that I always know which network I'm connected to. Virgin will remotely log in to your SuperHub and forcibly rename your 5GHz network to be the same as your 2.4GHz one. That means you will need to manually reconnect things which used the old name.

I kinda get why they do this - better to connect to a slow but stable 2.4GHz than a flaky but fast 5GHz - but it is annoying for those of us who rely on segregated names. Some of my IoT kit gets really confused by this. You may find that some equipment roams onto the 2.4GHz network because it is marginally stronger and never connects to the faster 5GHz network.

It is a Mesh system. The way it works is simple - the VM supplied SuperHub broadcasts 5GHz and 2.4GHz WiFi. This pod plugs into a power socket and listens for WiFi signals from the hub. It then rebroadcasts them - using the same name and password. So your phone or laptop will seamlessly connect to one network without you having to fiddle around with anything. But, of course, if the pod doesn't have a great connection back to the hub, it won't be able to give you a decent connection.

There are double Ethernet sockets on the Pod. They connect back through the WiFi; there's no PowerLine functionality. Additionally, there's no plug pass-through, so this will take up a socket in your home. It's also quite large - and might block the plug next to it.

The pod can get warm, there is a fan on the back of it which makes a light whirring noise. Nothing too loud, but you probably don't want to place it near where you sit.

Despite being rebranded Plume devices (see below) you cannot use the Plume app to manage them.

Speed Test

If I plug an Ethernet cable directly into the SuperHub, my laptop gets these speeds. I pay for 500Mbps and I get it. Nice!

If I'm next door to the Hub, and on 5GHz WiFi, I get these speeds: Pretty good!

At the bottom of my garden, without the pod, this is what I get on 5GHz: And on 2.4GHz

Pretty crappy! The 5GHz barely connects and the 2.4GHz is a bit wobbly.

So, the big test! When I plug the pod in halfway between the garden and the hub, this is the speed I get at the bottom of my garden:

Finally, plugged into the pod's Ethernet:

Initial thoughts

As a basic WiFi extender, they work. Naturally, the speed is limited to whatever the pod can negotiate with the hub. If you can get / afford multiple pods, they should form a mesh network to create a higher throughput backhaul.

But it does seem to come with a cost. Some of my gadgets get confused when there are multiple networks with the same name. They'll stick to a stronger 2.4GHz network rather than the faster 5GHz one. A couple of devices kept losing connectivity completely. And, because the networks insists on putting all the SSIDs on the same frequency - I've noticed an overall slowdown in my WiFi speeds.

Whereas before my top speed was over 500Mbps on WiFi, it has now dropped to about 480Mbps.

WiFi and Internet speeds are fickle beasts. I ran each test a few times at the same time of day. My maximum speed has dropped, but that's a fair sacrifice for vastly improved speeds elsewhere.

Tech Specs

These are rebranded Plume SuperPods.

WiFi INTERFACES

• 4×4 MIMO 802.11a/n/ac 5GHz
• 2×2 MIMO 802.11b/g/n 2.4GHz
• Dual-band, dual-concurrent radio operation
• 5GHz MU-MIMO with Beamforming

CHANNEL BANDWIDTH

• 5GHz 20/40/80 MHz
• 2.4GHz 20/40MHz

CHANNELS

• 5GHz 36 to 48, 149 to 161
• 2.4GHz 1 to 13

DFS CHANNELS

52 to 64, 100 to 144, Region Dependent

ETHERNET

Dual 100/1000Base-T Ethernet with autosense WAN or LAN configuration

IoT RADIOS

Bluetooth Low Energy

Other Features

They're also meant to come with ad-blocking and speed-testing. But those features are unavailable. Similarly, I couldn't find a way to access the BLE functionality.

You can read about how the Plume adaptive WiFi works in their whitepaper.

Hackability

Basically none. They are paired with the Virgin SuperHub. They don't seem to work with other ISPs, and there's no management interface to factory reset them.

Virgin send the pods out preconfigured. Which means they log into your SuperHub, and copy your SSID and password to the pod. Hope you didn't use the password for anything sensitive!

Port 53 is open on the device - but doesn't seem to respond to anything.

Verdict

They work! But, I'll be honest, I think Virgin are a bit cheeky to charge extra for these. If they sourced a decent hub with external antenna - rather than the crappy Arris product they use - their customers would have better WiFi without the need to pay for more gadgets.

They're going to be £5 per month for up to 3 pods. That's £60 per year. At which point, it may be more cost effective to buy a decent router or your own mesh system.

I'm also not sold on the mesh concept. The domestic airwaves are already saturated with WiFi signals from your neighbours. Is adding yet another broadcast to the mix such a great idea?

Powerline networking is great - but I get that it struggles to reach the speeds offered by cable modems.

The dual Ethernet means that they can be wired in directly to your cable modem. So run a patch cable down to your shed, plug it into the Pod and you have a WiFi extender.

But, yeah, if you need WiFi in your attic or shed, they'll do. Obviously, if your walls block WiFi, there's a limit to what the pods can do. But the basic tech works.

Join Virgin Media and get £50 bill credit

Here's my referral link

Some of my devices have consolidated. My Eufy security cameras have a hub - so despite having more cameras, They're using fewer IP addresses. Similarly, I've replaced most of my LIFX bulbs with Zigbee which also use a hub-and-spoke model.

So these are the devices I currently have connected:

1. Video Doorbell
2. Solar Battery
3. LIFX bulb in external light
4. Security camera
5. EInk display
6. Alexa
7. Robot vacuum cleaner / mop
8. TV
9. Android TV box
10. Amazon Fire TV stick
11. Chromecast
12. Internet Connected Record Player (yes! Really!)
13. PS4
14. Nintendo Switch
15. AV Amplifier
16. Another Alexa
17. Home server
18. Eufy Cameras Hub
19. Philips Hue Light Hub
20. Internal LIFX bulb
21. Smart heating control
22. Office TV
23. Wife's work laptop
24. Wife's personal laptop
25. Wife's phone
26. My work laptop
27. My personal laptop
28. My phone
29. My tablet
30. Power strip
31. Lifx lamp
32. Internet connected plasma ball
33. Gym TV
34. Another robot vacuum cleaner
35. Internet connected electric blanket (my side)
36. Internet connected electric blanket (her side)
37. Solar panel inverter

We have a lot of smarthome kit! I've probably forgotten some. And I haven't counted my various Raspberries Pi and obsolete computers. But we're only a family of two. Larger families are likely to have more phones, tablets, and many other devices.

Is the future the "hub" model? Most of these devices don't need a power-hungry WiFi connection. Keep the airwaves clear for high-bandwidth devices and move everything to ZigBee or similar?

Either way, the number of devices in a typical home is only going to increase. What do we need to do to prepare for that?

This allows anyone with a Virgin Media account to connect to your WiFi! Virgin have been moderately sensible with their design of this - users get a separate IP address, so their activity cannot be commingled with yours. But what about your bandwidth?

Here, Virgin have been clever / annoying. If you're paying for the 350Mbps service (as I am) your cable modem is actually provisioned for a faster speed! But you can't access it.

My router's download speed shows: Max Traffic Rate 402,500,089

And upload speed shows: Max Traffic Rate 38,500,089

I get about 350Mbps down and 30Mbps up. So how to get access to the "reserved" bandwidth Virgin uses for their hotspot? Normally, you'd need access to their app - but there's a sneaky way around it.

EAP

You can login directly to the hotspot network! But it uses the EAP login protocol, which is a little more complicated.

Your computer or phone's login screen is going to look different to mine, so here's the basic details that you need:

• Identity is vmedwifi/you@example.com - use the email address you use to log in to my.virginmedia.com.
  • You must put the vmedwifi/ at the start.
• Password is the same as you use for my.virginmedia.com
• EAP method is TTLS
• Phase 2 Authentication is MSCHAPV2
• No certificate is needed

I've successfully connected via a Linux laptop and an Android phone.

My download speed on the segregated network was 40Mbps and my upload was 4.6Mbps. That's about 10% of my normal speeds

Limitations

You cannot connect to two WiFi networks at once. So if you want to use the full 400Mbps on one machine, you'll need to connect via both ethernet and WiFi, and bridge the network.

But if you have some 4K streaming happening on a couple of TVs, and a PS5 downloading an update, and a partner on a video call, while your your machine struggles to get any throughput - then you can connect your laptop to this "bonus" network and enjoy congestion free surfing.

Thanks to Dave for the tip.

The app mostly reflects the options in the web UI - but adds one piece of new functionality.

Pause Connection

It lets you, the admin, temporarily suspend the Internet access of a device. Useful! But the only way to do this is from the app.

Rather irritatingly, you can't snoop on the connection as it goes via AWS. So packet capture is out. I tried decompiling the app but got nowhere.

The email addresses and travel details of about 10,000 people who used free wi-fi at UK railway stations have been exposed online.

The database, found online by a security researcher, contained 146 million records, including personal contact details and dates of birth.

It was not password protected.

BBC News

There's a really easy way to protect yourself from being a victim. Lie.

When a WiFi provider asks for your email address, lie. When someone who doesn't need to validate your age asks for your date of birth, lie. When you're asked to provide your name in order to register for a service, lie.

Obviously, don't lie to the police, tax inspectors, or your doctor. Don't lie to people who need accurate data about you.

Eight years ago, I was at a Parliamentary conference about online privacy. I tweeted:

Terence Eden is on Mastodon

@edent

#PICONF12 Andy Smith says "never use your real details online" - Martin Hewitt not looking best pleased. Nor the other MP in the room.

---

Which led to this story being published:

I think that recommendation still stands. Giving away your personal details puts you at risk.

Whenever a free WiFi provider asks me for my details, I'm usually nononono@example.com. My date of birth is 1900-01-01. And my phone number is from the fake range provided by OfCom.

Here's a list of all the times that has caused me problems:

• ...

Oh. None.

Every time I give out a real email address or phone-number, it inevitably starts to receive spam. Every week we see news stories about companies behaving irresponsibly with our data. Exposing us to risk.

Stop giving out your information to people who have no need for it.

Your personal safety is more important than a company's desire for a better marketing database.

Here's a video of me controlling them from my Amazon Alexa:

The latency seems a little slow - hard to tell if that's Amazon only relying on US data centres for Alexa skills, or the connection to my home. Once set up, it works well. Oh... but the set up experience...

Set Up

I'll be honest - configuring a smarthome for voice control is still a pain in the arse. This is mostly Amazon's fault - but it doesn't help that all the kit I use has non-standard interfaces.

Here's the long journey I took to install the skill, configure it, and finally use it.

1. Read the eWeLink tutorial on setting up Alexa.
2. I'll assume you've already set up your Alexa, connected it to the WiFi, and configured the app.
3. In the Amazon app, go to Settings.
4. Select Skills
5. Search for eWeLink (not Sonoff!)
6. Select "eWeLink Smart Home Fan".The "fan" refers to the fact that this is not an official app, not that it only controls fans.
7. Enable the skill.
8. This takes you to the web browser which then redirects to the "coolkit" site.Usually I would tell you to be wary of putting your password into a random site - but this is, apparently, the same company as eWeLink and Sonoff. Confusing, isn't it?
9. Log in with your email address and password and you're eventually redirected back to Amazon
10. Close the browser and return to the Alexa app.
11. Ignore the fact that it is still asking you to enable the skill, exit this page and go back to the home screen of the app.
12. Go to menu, Smart Home. Then click on the Smart Home Skills.
13. Click on the EweLink skill.
14. That just gives you reviews. Because Amazon don't bother with usability testing their apps.
15. Go back and click on the icon for eWeLink.
16. Now "Manage Devices in Smart Home".
17. Oh, we're back here again! Select "Devices"
18. Scroll all the way to the bottom and select "Discover".
19. Wait. And marvel at how crap Philips Hue must be to need extra support text.
20. Hopefully the new eWeLink devices will be displayed.
21. You can exit the app and use voice control.

Bloody hell! No normal person is going to bother going through that many steps, are they?

Oh, and that's not even the worst part! When I first set up the lamp, it wouldn't work. Why? Because I already had an Alexa group called "lamp". There's no feedback in the app - and it's impossible to rename device in Alexa. The Echo just pathetically says that there's a problem - but not how to solve it. So you have to delete the devices, rename them in the eWeLink app, then re-add them.

Alexa is a UX disaster. If you deviate a millimetre from the happy path, you'll be lost in the woods without hope.

This is not the future.

Kit used in this demo

• Sonoff POW review - buy it.
• Sonoff S20 WiFi plug - buy it
• WisQo smart lightswitches - buy them

This is the Sonoff Pow - a WiFi enabled in-line power switch.

Set Up

Wiring up the Pow is relatively easy. The cover to the terminal block is secured with a simple screw.

I found the opening a little cramped - but it's easy to open up the entire unit. Which gives us a full view of the circuitry. There's an unpopulated header on the bottom left - yup - this thing is hackable!

A reminder, working with electricity is dangerous - if in doubt, consult with a trained professional.

The latches on the terminal block are stiff, but that's probably a good way to stop the leads from falling out.

Once wired up, and power applied, the LED starts flashing.

From there, you can install the Android app and connect the Pow to your WiFi.

In Action

Your system doesn't support WEBM video.

Cost

You can buy the Sonoff Pow on Amazon UK for £14.

Buying direct from the manufacturer is around $11 + $4 shipping

If you splash out, you can buy the Sonoff G1 - which has a GSM modem built in. Add a SIM card and it will connect to GPRS. Only $20!

Hacking

As with other Sonoff products, this is built on the ESP8266. As the manufacturer says:

Apart from traditional consumers, Sonoff Pow is a very exciting product for those into hacking, since four program ports have been reserved for burning external firmware. Now, isn’t that thrilling?

There are a range of firmwares available on GitHub, and YouTube videos showing how to take control of the device. There's a burgeoning community of bloggers with some great tutorials - see Tinkerman and CNX Software.

Verdict

As with the S20 plug, this is a great little unit. It's easy to set up, the app works reasonably well, and it is dead cheap.

The power monitoring seem fairly accurate - it picked up the exact wattage of my lightbulb - and the timers worked.

As with the S20, its usefulness depends on the electronics you have at home. If you have devices which regularly need turning on and off from the mains, this is perfect. The addition of monitoring makes it useful for anyone energy conscious.

The app is adequate - not brilliant. There's no public API - which is a shame - but you can rewrite the firmware if that bothers you.

Amazon's Echo Smart Home doesn't work natively with the Sonoff. There is a 3rd-Party Alexa skill - called eWeLink Fan. It's not as easy to set up as a normal smart-home device, and judging from the comments on the Sonoff website suffers from some problems.

If you're handy with wire strippers, it's a great little gizmo. Ideally it would be built into appliances - but as a way to add IoT smarts to an old device, it's pretty good buy.

You can get the Sonoff Pow on Amazon UK for £14.

Buying direct from the manufacturer is around $11 + $4 shipping

This fills the same niche as the Belkin WeMo but with one crucial difference - it's about half the price.

Direct from Sonoff it's US$13 - from Amazon UK the smartplug is £15. The cost of the WeMo is £40.

How does it compare to the Belkin WeMo?

Both are compatible with IFTTT, have 2.4GHz WiFi, and have buttons and status LEDs. The both also have time schedules so you can automate when the plug switches on and off. They basically have identical features - with two small differences.

The WeMo works with Alexa, the Sonoff doesn't. Alexa is still in its early days - but if small companies like WisQo are able to make Alexa compatible light switches, then I would expect the same from Sonoff.

There is a 3rd-Party Alexa skill - called eWeLink Fan. It's not as easy to set up as a normal smart-home device, and judging from the comments on the Sonoff website suffers from some problems.

Where the S20 realy comes into its own is its hackability!

Hackable?!

You'll find lots of articles on the web about how to rewrite the firmware in these devices - Nathan Chantrell has an excellent guide on his blog.

The S20 uses the ESP8266 - a ridiculously common WiFi chip. Versatile and hackable. Perfect for tinkering.

There are loads of 2866 projects on GitHub for you to build with. There are several websites dedicated to hacking these controllers.

There are several variations of this plug - so pay attention when following the tutorials.

Finally, electricity is dangerous. Make sure you know what you are doing before you start unscrewing and fiddling.

Security and API

The app uses SSL - so your connection to the Sonoff mothership should be secure. There's no certificate pinning, so your calls can theoretically be intercepted or disrupted. That's still better than most IoT kit.

There is an API available, but it is undocumented. It also needs to go through the manufacturer's servers. I wish more IoT makers would follow Lifx's lead and offer a fully documented API which works over a LAN. I don't don't want to be locked out of my gear if my Internet goes out, or the manufacturer goes bust.

As I've mentioned, these devices are easily flashable - so can be repurposed if needed.

Downsides

While the hardware is great, the software is a slight letdown.

The Android App doesn't get great reviews - it's quicker to start than the WeMo app, but doesn't look as nice. Registration is a bit complicated, as is sending WiFi passwords.

Terence Eden is on Mastodon

@edent

Replying to @edentAlso, it's 2017 - why is the only way of getting an IoT gadget onto your WiFi to install an app & manually type in password? pic.x.com/hkkwpmzwey

---

As with most domestic IoT devices, it's ideally suited to a single person household. It is possible to share control with another user, but it is a little cumbersome.

There's no energy monitoring - although other Sonoff products provide that service.

Finally, is this actually useful? I've only got a few electrical items which I turn on and off from the plug socket - lamps, electric heaters, ... ummm... a hair-drier? I'm using mine on a cool air fan which sits across the room from me.

Verdict

In terms of speed - this blows the WeMo out of the water. The weird Alexa integration is a minor annoyance - but it makes up for it by being so hacker friendly.

The plug is small and sized well for going on a multi-socket. The software needs an overhaul, but it does the job.

You can buy the Sonoff S20 from Amazon UK for around £15.

Thanks to Sonoff for sending me the review unit. If you'd like me to review your gear, please get in touch.

A brief recap:

Back in 2015, Virgin Media announced plans for a WiFi sharing network. A user's router would broadcast a separate WiFi network and other Virgin customers could roam on to it via an app. By default, all customers were opted-in to this service.

Like most of Virgin's plans, it was marred by delays and technical problems. I was on the trial for their new SuperHub3 - and it seems they were unable to get their router manufacturer to supply stable software. Faced with buggy routers and dreadful app reviews it looked like they had abandoned their plans.

Until last week - when I noticed that my hub had suddenly started to broadcast a new WiFi network without my permission.

Let me explain what's happening here. I have a main network, a guest network I've set up for demonstration purposes, and a "Virgin Media" SSID that I don't control.

Notice a pattern?

This signal is on the same channel, with the same signal strength, and a virtually identical MAC. This is coming from my router.

OK, let's try to opt-out. Oh. You can't. Virgin offer an opt-out screen at https://my.virginmedia.com/my-profile/view - but it doesn't work.

A day after opting-out, the router was still sharing my WiFi. I called customer services who admitted that the form doesn't work properly(!) but that they would manually mark my account as opted-out.

24 hours - and several reboots - later, nothing had changed.

A few points to note.

Virgin's illegitimate WiFi uses EAP security. That's not an option which is available to customers via the hub's GUI.

There's no way I could have accidentally set up this rogue network.

Virgin's customer service on Twitter was predictably poor. They don't know about the service:

Terence Eden is on Mastodon

@edent

Replying to @virginmedia@virginmedia you offer WiFi sharing - so I can roam onto other people's wifi connections. I chose to opt-out. My hub is still sharing.

---

Virgin Media ❤️

@virginmedia

Replying to @edent@edent We don't currently offer WiFi sharing, Terence. It's a feature that we have planned for the future, but isn't currently active. ^ZR

---

But still advise that it can be disabled:

Terence Eden is on Mastodon

@edent

Replying to @virginmedia@virginmedia fine. Whatever. How do I stop my hub broadcasting your unauthorised SSID?

---

Virgin Media ❤️

@virginmedia

Replying to @edent@edent As advised, you should be able to opt out via your online account. If this isn't working for whatever reason, try a different...

---

Is this a useful service?

No. The UK has excellent mobile phone coverage - it is particularly good around residential areas.

Virgin's routers have fairly limited range. In order to connect to the shared signal, someone would have to be literally standing outside my front door. Creepy.

As I've discussed before, sharing your WiFi connection may have legal consequences. Are you confident that someone committing a crime via your connection wouldn't be traced back to you? Do you think the police will understand the difference between a device on your network and a device on your shared network?

If you're sensible, you'll turn off Virgin's WiFi sharing. But that seems like Virgin aren't competent enough to make that possible.

What Next

Virgin have known about the problem for over a month but refuse to fix it.

Frankly, I'd move away from them - but they're the only company in my area offering 200Mbps speeds.

If you're affected by this, I suggest three actions

1. Call up and complain to them until they fix this. The number is 0345 454 1111.
2. Disable your 2.4GHz network. You will still be sharing a connection on 5GHz, but the range is weaker and less likely to leave your home.
3. Buy a separate router. With the hub in Modem Mode, no WiFi is broadcast and you can regain complete control of your network.

Virgin Media really need to sort this out. It is unacceptable to hijack a customer's connection without consent.

After complaining on Virgin's forum, they've fixed the problem for me. I don't know how many other people are unwittingly sharing their service.

This morning, I glanced bleary-eyed at my phone.

OH FUCK! THE HOUSE IS ON FUCKING FIRE AND MY FUCKING NEST ISN'T WORKING!

I sniffed the air. I couldn't smell anything strange. Perhaps it is deadly Carbon Monoxide.

I frantically clicked the email to see if I was about to be incinerated or gassed to death.

Oh. It's a marketing email. Nest wants me to buy another of their crappy products.

Now, perhaps I should have been more alert - but when I see an email which says "Nest. Smoke Alarm. Critical. Only if working" my first thought isn't "Golly! I sure could do with a few more smoke alarms!" My first thought, genuinely, was that there was an emergency.

To say that I'm upset with Nest is an understatement. The company has a troubled history with their products and their repeated inability to deliver a competent experience is leading me to junk their smoke alarm.

If you are making domestic IoT devices, remember you are being invited into someone's home. You are a guest and must behave with respect. To send a deliberately sensationalist email in the early morning is a gross breach of trust.

During the rescue efforts, the Italian Red Cross sends this tweet:

Croce Rossa Italiana

@crocerossa

#Terremoto, per favorire comunicazioni e operazioni di soccorso vi invitiamo a togliere la password della rete wi-fi pic.x.com/U9baz8F7WG

---

It says "To facilitate communications and rescue operations we invite you to remove the password of the wi-fi network".

Should you do this?

No.

Let me be clear.

No no no no no no no!

I sound like a curmudgeonly killjoy. I sound heartless. I sound nasty. I hate that. But this is incredibly dangerous advice. Both to citizens and rescuers.

In disasters there are always criminals looking to take advantage of the good-natured. I'm not saying the the Red Cross are criminals - I'm saying that they're creating an environment which makes it very easy for for criminality to flourish.

Why Is This A Bad Idea?

Imagine if they said "please hand any spare cash over to people dressed as firefighters" or "give your telephone to anyone in a red jacket" or "we need blood supplies - please invite in anyone who knocks on your door". You'd be crazy to follow that advice. It's similar for unprotecting your WiFi.

What could a malicious user do while connected to your network? They could, potentially...

• Send illegal communications using your IP address.
• Download illegal material.
• Break in to all the computers on your network.
• Control any Internet connected devices and/or hack them.
• Monitor all of your communications traffic.

But, suppose you did open your WiFi. And suppose you were malicious. When a Red Cross worker - or anyone else - connected to your WiFi, you could...

• Monitor their communications.
• Redirect them to malicious websites.
• Attempt to hack their computers.

I would hope that every emergency worker immediately fires up a VPN before transmitting sensitive data - but I bet you that they don't.

What Should I Do?

Assuming that your Internet connection is still up, there are three sensible things to do.

1. Set up a guest network. Most modern equipment will allow you to do this. It will give you protection from most hackers using your network. It doesn't protect you against illegal usage of your connection, nor does it protect people who connect to it.
2. Disconnect every single piece of equipment from your network first - including WiFi devices. Once the disaster has passed, reset your router and set everything up again. That may sound paranoid, but it is the only way to be sure nothing evil is lurking on there.
3. Let your friends and family know you are safe, and then switch your phone to aeroplane mode. Stop clogging up the airwaves and give the rescuers priority.

Aren't You A Little Paranoid?

Perhaps. Are there really gangs of criminal hackers rushing to disaster zones in order to exploit people? Probably not.

Does a little Italian village contain enough uber-hackers to break in to the Red Cross and cause havoc? Again, doubtful.

It is human nature to help out people in distress. It's the most natural thing in the world to offer comfort, food, and shelter to those who have lost everything.

But we have to stop training people to think that security is merely an inconvenience. That security can be disposed of during times of crisis when it is needed most. We have to provide tools which will let people help in an emergency but not leave themselves vulnerable.

In the meantime, may I please encourage you to donate to Télécoms Sans Frontière - they do an incredible job providing emergency communications infrastructure in disaster zones.

You can read my further thoughts in Wired. There is a dissenting view from Dr Joss Wright on the BBC

As I've explained previously, swapping out all my existing light bulbs with Smart Bulbs would be hugely expensive and has the disadvantage of not working when the switches are off at the wall.

A WiFi light switch (theoretically) allows me to control the lights from my phone - and anyone else to use the physical buttons on the wall. That helps avoid this scenario:

Cate

@c8ters

When you're house sitting for millennials and ask how the lights work pic.x.com/xli7zdzehw

---

WiFi built into the switch means I don't need to use a hub to control my devices - I can connect directly to them and not have to worry about hardware incompatibilities.

The UK has a unique way of wiring houses which doesn't lend itself well to automated control. The switches which work in the USA and EU, simply won't work in a UK set up. This makes switches rare and expensive.

I've gone for the Lanbon WiFi Light Switch - £50 on Amazon - or around £35 direct from China. For more technical information (although not much) take a look at the L5-HSGT1's product page.

What's In The Box

The switch itself is pretty good looking:

The back is slightly weird - this is obviously a fairly generic design which can be re-purposed for multiway switches.

As for the rest of the kit...

Yup! A pair of mounting screws - that's it! No fitting instructions, no glossy leaflet, nothing! Oh well, how hard can this thing be to install...

Wiring In

Working with electricity is dangerous. Remember to switch off the power to your lights at your consumer unit. If in doubt, get a qualified electrician to help. I followed this guide to replacing UK light switches.

Wiring the switch is trivial - as long as you can remember which wire is which. There's just one small problem... The depth of the pattress box is insufficient to contain the switch! Obviously microchips aren't quite a tiny as necessary yet.

OK, I can try drilling that deeper later - let's power up this baby and see if it works!

Blinken lights! Touching the light icon provides a satisfying "clunk" somewhere inside the switch, but didn't change the state of the lights. Perhaps it needs to be set up first?

The App

Remember when I said that the package didn't come with any instructions? That wasn't quite true - there are some QR codes on the side:

A quick scan and...

Hmmm... Do I really want to download an app from China over HTTP? Guess I don't have a choice!

Interestingly, the Lanbon website offers a more recent version of the app to download. This obviously isn't an organisation set up with high-quality "it just works" in mind.

I prepared to install the app - when I was hit by this:

Terence Eden is on Mastodon

@edent

My WiFi light switch has arrived!
No instructions in the box. How hard can it be?
lanbon.cn/product_show.a… pic.x.com/9dtnupqhzb

---

Terence Eden is on Mastodon

@edent

Replying to @edentThese are the permissions my Light Switch app is requesting…!
Think I'll install on a dummy device first! pic.x.com/dxvuepdj0u

---

Those are some ridiculously scary permissions! I can understand wanting microphone access (voice control) and maybe GPS (turn lights on when I get home) - but why does this want to send SMS or place calls? Why does it need my contacts and the ability to take photos?

A quick virus scan showed nothing overtly malicious - but I decided to offer up a sacrificial tablet to run the app on. No way am I risking my main device with this software!

The software is of the usual sub-standard quality I've come to expect from cheap electronics. No set-up wizard, just dumped into a complicated screen.

Pressing the "User Manual" button gave this monstrosity:

I held down the light switch button until the WiFi indicator started flashing. I then connected my tablet to the WiFi (a separate network - I didn't want to risk sticking this on the same network as everything else yet). I clicked the "Auto Search" button and, somehow, the tablet found the switch and set it the network's details. Result!

The app presents this rather lazily designed screen. Only the blue icon on the left works as a switch.

Let There Be Light!

And, dear reader, can you guess what happened when I clicked it?

Terence Eden is on Mastodon

@edent

Replying to @edentOK, switch wired in, connected to WiFi, responding to commands but - crucially - not actually turning the light on. pic.x.com/gsmkhdhasr

---

Terence Eden is on Mastodon

@edent

Replying to @edentWell, here's the light switch in all its "glory". Going to try another socket tomorrow during daylight hours! pic.x.com/k4ikrttbnt

---

Yup - the square-root of bugger-all!

Under The Covers

Before trying it on another socket, I thought I'd crack it open to see what's going on inside. As I suspected, it's a generic unit which can be used for 1-, 2-, or 3-gang switches. No LEDs are soldered on to the spare ports. Interesting to note a different part number printed on the inside - L5 HSCL LB v16.

Remaining Neutral!

I made a telephone call to Prad - the Amazon seller who supplied me with the switch - he was incredibly helpful but sadly confirmed that the switch requires a neutral wire. Something which had unfortunately been left out of his listing.

It turns out that this lack of neutral wiring is a common problem.

The WiFi Plug Glass has this fairly prominent warning:

And Vesternet have an excellent page explaining the challenges of fitting smart switches to UK homes.

Short of rewiring parts of my house, it looks like the switch will be useless to me. So back it goes.

Decompiling the Software

Part of the problem with the software is that it is designed to work with a suite of products. It contains references to security cameras, home alarm systems, infrared controllers, fans, curtain controllers, and half-a-dozen other things.

There's no widget support - which is crucial for a lighting app. No one wants to find an app, wait for it to open, find the right light etc. I just want to put a simple toggle on my homescreen - in exactly the same way Lifx does.

As far as I can tell, there's nothing malicious in the software - it's just poorly constructed. Well… in this version.

Of course, with Android Lollipop's new permission model, I can deny the app access to anything that I'm uncomfortable with. During my brief use of the app it didn't ask for anything other than WiFi access.

API

As I didn't get the switches working, I didn't dive too deeply into the API. I did spot this curious activity though.

When the light switch wasn't connected to the WiFi, the app assumes that it is on a different network to the switch and tries to communicate over a cloud service.

That IP is hard-coded into the app.

whois 58.96.172.115? An unknown server in Hong Kong! The venerable nmap reckons the server is running Microsoft Windows Vista Home Premium SP1, Windows 7, or Windows Server 2008. Ok...

Right, it's communicating on port 80 - but let's see what incredibly secure authentication it is performing...

Hmmm... Some of those numbers look familiar...

Ah. So it sends a packet with the light switch's ID number in it. That appears to be all. I assume that the switch makes a similar persistent connection to that IP address so it can listen out for instructions. I was too scared to port scan the light switch.

I'm guessing, with a small amount of effort, you could toggle strangers' lights to your heart's content.

Verdict

It looks like I'm going to have to go for the hub and spoke model of smart switches. That is, a light switch which trickles enough electricity to power an RF receiver while keeping the lights off - controlled by a WiFi connected hub.

Hopefully one which is more secure than this!

Onwards!

Here's the email being sent to subscribers - followed by some commentary on what this means and whether it's a good idea for you to opt-out.

Let's ignore them mispelling my name - and concentrate on the technical details. From September, you'll be able to connect to any domestic Virgin Media SuperHub in the country. You'll be able to surf the web from your phone & tablet as though you were on your home connection. All without slowing down the owner's download speeds.

So, a quick Q&A.

Will this slow down my broadband?

No. Virgin's top speed is 152Mb down/12Mb up. However, I've spotted them trialling a 322Mbps service which seems to work quite well.

What I suspect they'll be doing is adding additional download and upload channels which can only be used by other customers.

Given their woefully inadequate upload speeds, it would be nice if they upped the owner's speeds as well.

However, if you like in an area with particularly congested WiFi, it is likely that extra users will interfere with your connectivity.

Depending on how many devices try to connect, it could knock some of your devices off your network.

Will visitors get on my LAN and access my computers?

Not if they've done this correctly. Virgin already offers a "Guest Mode" WiFi option which routes all traffic onto a different subnet.

Hopefully, they're sensible enough to do the same for strangers sharing your connection.

If someone breaks the law using my connection - am I responsible?

Possibly. However, one would hope that Virgin issues a separate IP address to sharers.

Virgin should also know the details of everyone who connects via your WiFi. If someone does something naughty - it hopefully won't come back to bite you.

Will this crash my SuperHub?

Probably. I was on the SuperHub 2AC trial earlier this year. While the hardware is much improved, there are still dozens of reported software bugs which still haven't been fixed. Adding this extra functionality is unlikely to help matters.

Will this cost me more money?

Yes. Your router will be working harder, transmitting more data, and flashing its lights a little faster. That will increase your electricity consumption?

When Comcast started deploying this functionality across their US Internet customers, some people estimated an additional cost of up to $20 per year!

In reality, unless you live in an extremely popular area and have people constantly using your WiFi, the cost is likely to be below £10 per year.

Can I Opt-Out?

Yes. This is the (somewhat) sneaky part. You are opted-in by default. If you do nothing, the service will automatically go live.

To opt-out, visit virginmedia.com/myvirginmedia

How do I log in to someone else's WiFi

It looks like you'll need to use a dedicated app. Virgin's current app gets fairly bad reviews - so let's hope they improve it before launch!

An app means that you'll only be able to log on with a phone or tablet - it's unlikely to work on a laptop.

Is this a good deal?

You get free WiFi. In return, you are paying with...

• Your location data. Virgin know where you go and when you go there. Every time you log in to a WiFi hotspot, they learn a little more about you.
• Your device data. Virgin will know what phone and tablet you have. All the better to target you with adverts.
• Your electricity. The power bill is unlikely to cost you much - although it is a non-zero sum.
• Your bandwidth. Virgin could choose to raise your upload and download speed. Instead they're giving them away to other users.
• Your privacy. People walking by your home will know who your ISP is. That's also true if you haven't changed your default WiFi network name - but for security conscious folk, it's not sensible information to broadcast.
• Your security. Virgin and Netgear (the SuperHub manufacturer) have a chequered history when it comes to securing their WiFi routers. Will sharers be able to access your network? When you access a shared network, will the owner be able to see what you are doing?

Overall...

I'm not convinced. We'll need to see just how well they implement this. But they can't escape the fact that a typical indoor router simply doesn't have a huge range - usually 50 metres. Domestic routers, by their nature, are usually installed in residential areas.

Just how often do you need WiFi when walking past a row of houses? How comfortable do you feel lingering outside someone's home when you want to check your email?

I'll give it a go - perhaps with more hotspots in town centres, fantastic app, and rock solid security, it will be a useful addition to my connectivity options.

Do you think this is a good deal? Let me know in the comments.

Nestled at the bottom of the annoucement is this curious specification.

That seems... low. Doesn't it? I did a quick tally of all the devices my wife and I have which use WiFi.

1. My phone
2. Wife's phone
3. My ebook
4. Wife's ebook
5. My laptop
6. Wife's laptop
7. My work laptop
8. PS4
9. Xbox 360
10. Wii U
11. 3DS
12. Media Player
13. Onkyo Amplifier
14. Smart TV
15. Original Xbox
16. Home server
17. Lifx Lightbulb (only the one so far!)
18. IP Security camera (internal)
19. IP Security camera (pointing the other way)
20. IP Security camera (external)
21. IP Security camera (PTZ)
22. IP Security camera (internal upstairs)
23. Roomba!
24. Raspberry Pi environmental monitoring station
25. WeMo plug socket
26. WeWo IR Blaster
27. Solar panels
28. nCube IoT Hub
29. Car dashcam
30. Google Glass (meh, someone has to keep the dream alive!)

That doesn't include all the odd phones I trial, nor the couple of Raspberry Pi's I fiddle with.

Admittedly, we're a fairly high-tech couple - and being child-free means there's more money for gadgets - but I don't think we're that unusual. Over the next few years, I'd expect us to get more WiFi lightbulbs, and plug sockets, and probably doorbells, washing machines, thermostats, and an Internet fridge.

We're a two person family. A typical UK family is likely to have 4 people. So that's double the amount of phones and laptops, more TVs, probably more handheld consoles, baby monitors, pet trackers, and and neural implants.

128 devices looks like an achievable limit for a modern family home.

For those of you young enough not to get the reference in the title, computer companies have a habit of self-limiting their technology.

I would hope that OnHub will receive updates to make it useful past the year 2020. Given Google's record with Android updates, I suspect we'll all just have to buy a new router. Plus ça change!

Enter the Thinking Cleaner - it's a replacement faceplate for Roombas which adds WiFi and a sweet hackable API.

This post looks at how the unit performs - its good points and its flaws - and how the API works.

Let's take a step back. The Roomba 620 is iRobot's entry level vacuum cleaning robot. Unlike the more expensive models, the 620 doesn't have any scheduling - you have to manually set the Roomba to clean. The Thinking Cleaner is a cheap way of adding a brain and extra connectivity to an otherwise simple robot.

A few days after ordering, the package arrived from the Netherlands.

The instructions say that you should carefully remove the cover from the Roomba. To be honest, I was a little nervous about this. The plastic feels fragile and tightly clipped on. That said, it pealed off easily without breaking.

The whole process really was as quick as this video demonstrates :

The replacement cover is delightful gunmetal grey - I think it looks better than the white original. Although the WiFi unit protrudes from the surface, it doesn't seem any taller than the Roomba's sensor.

Incidentally, flipping the cover over reveals the WiFi unit. I may be wrong, but the casing looks 3D printed.

The cover also has a sticker with the MAC address on it.

Clipping the new cover on took seconds. Resulting in a little flashing LED on the unit.

Set Up

Ok, here's where things went a little awry. The Thinking Cleaner needs to connect to a WiFi network. To set this up, you need to connect to the Roomba via an app. When I initially installed it, the Android App didn't yet work on Lollipop. I had to dig out an old Android tablet to get it connected. Literally two hours afterwards the Android app updated - whereupon it worked flawlessly with Lollipop!

The unit only works on 2.4GHz WiFi - not a huge problem. If you're in the US, the unit won't work on channels 12 and 13.

The App is simple enough to use - allowing you to set the Roomba cleaning, drive it yourself, set up a schedule, and get alerts from the cleaner.

It will also send you notifications when something interesting happens to your robot.

The Web Interface

The app doesn't tell you the IP address which the Roomba is using. This is an annoying oversight. You'll need to pop on to your WiFi router and see what it has been assigned.

There is a basic web interface but there is no security available - not even a username and password. Any one who has access to your your WiFi network will also have full access to your Roomba. Make sure that when any friends come round, you give them access to a guest WiFi network - and try to make sure that your WiFi and LAN are as secure as possible.

There is currently no way to set a user name and password.

The web interface is basically fine - it doesn't look brilliant, and the colours are a bit intense - but it allows you to control the Roomba and set up scheduling.

It also works well on mobile web browsers :

That's pretty handy if you're inside your house - but what if you want to get notifications or control it while you are away?

Remote Access

In order to access your device when about and about, you need to sign up for a free ThinkingSync. That's a safer and easier option than teaching users how to set up Port Forwarding and getting them to punch holes in their firewalls - they have a detailed privacy page which explains their reasoning.

To connect to your Thinking Cleaner when you are not at home without modifying your home network settings, you need a (free) account on Thinkingsync server. Thinking Cleaner will periodically contact the server and check for updates. Maximum delay is approximately 1 minute. You can log in or sign up here.

For push notifications on your smartphone you need an account. Without an account you can only use the app when your are connected to the same wifi network as your Thinking Cleaner.

Firmware updates are only possible when logged in to your account. Documentation

There are two main problems I have with this :

1. Availability. I've no control over the uptime of their server. If it breaks, or they decide to stop offering the service, or want to charge for it - I'm out of luck. They have indicated that they're willing to allow people to run their own servers. I'll have to give that a go!
2. Registration is not done over https! I don't like sending passwords in clear text which then allow access to a robot operating inside my house! Call me a paranoid hacker - but it just doesn't feel safe.

I think it's time to put my Roomba on it's own VLAN!

There is only one account available per Roomba. I guess this makes sense - although I'm not quite sure if I can have cleaning alerts sent to my phone, while my wife's phone only gets low battery alerts.

If you're out of the house, the app doesn't seem to be able to access the remote driving, nor the scheduling. Again, probably sensible. You don't want to be driving blind.

The API

If you don't fancy getting your hands dirty Thinking Cleaner have some pre-built API integrations - allowing you to connect your Roomba to a variety of existing home automation services and the Pebble smart watch!

For those of us who like to fiddle, there's a (mostly) REST API with comprehensive documentation. This spits back JSON so should be fairly easy to work with.

Once again, there's no authentication - so anyone with access to your network can force your Roomba to commit suicide.

The API allows you to take manual control of your Roomba, driving it wherever you like. You can alter its schedules and access some basic information about the unit.

Sadly, there's no way yet to get the Roomba to tell you what it is doing. In order to find out whether it has started cleaning, you would need to continually poll the API and notice when it changes state. I would like it if the unit were to make an HTTP call to a server of my choosing - then I could, say, get it to tweet when it finished cleaning.

Incidentally, a quick nmap shows that only port 80 is open.

Wish List

I've been a little harsh on the unit. For €99 it's an exceptionally good bit of kit. There are still a few bugs and kinks to work out, but for day-to-day usage it is excellent. Here's what I'd like to see in future versions of the software.

• HTTPS everywhere! It appears that their servers do support secure connections, but it doesn't seem to be mandated. I'd be much happier if all the communications went over a secure channel.
• Authentication! Yes, even HTTP Basic Digest would be nice. Just something to prevent people on the network fiddling where they shouldn't! If you have a kids in your house, you don't want them playing with the robot's settings.
• A push API. Let me define an HTTP request for the Roomba to make when it has finished cleaning.
• Open Source firmware. I'd love to be able to tinker with the look and feel of the website. At the moment they say

  The firmware running inside the Thinking Cleaner module is not going to be open source. This is because the module has to be certified and certification includes the firmware.

  
  I can understand that the radio module has to obey local laws. I just wish there were a way to separate the radio logic from the web server. Perhaps the code could be made open source but have the unit only accept signed versions from the manufacturer?
• Play sounds or voices. At the moment, the software only lets the Roomba play one "jingle". It would be great if it were possible to make it play different sounds - or even get it to speak some of its stock phrases.
• Mapping. This is one I think I can build myself! It would be great to be able to draw a map of the route taken by the Roomba on its travels.
• More diagnostic information. Adding WiFi signal strength, for example, would make for an easy way to map your network propagation.
• Twitter integration :-) I guess I'll have to build that myself as well!

Conclusion

The Thinking Cleaner upgrades even the cheapest Roomba into a WiFi connected, super cleaner. I love the fact that I can get schedule cleaning while I'm away, and play with an API. There are some minor issues, which I'm sure will be fixed as the software matures.

The Thinking Cleaner is available for €99 plus shipping (€14 to the UK). It's a fantastic little unit and I hope to write some more blog posts showing you all the cool things it can do.

And, if this blog doesn't convince you, perhaps this cheesy video will!