• 3 Posts
  • 14 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle


  • How can Apple got this wrong? Pretty much all meteorological data are sourced from the same set of weather forecasting data produced from running weather simulations on weather agencies supercomputers using satellites and ground observation data. The forecasting models will pretty much produce almost similar results when fed with the same data, which is why weather reports are usually pretty similar even though they’re produced by different weather agencies.

    Does Apple actually run their own weather simulations here? Probably for their hyper local next-hour weather prediction feature? Or could it be that Apple is using some “AI” for their weather forecasting and the AI conjured some number out of its ass instead of running full physics simulation?




  • Edit: looks like it’s a 2012 retina MBP, which means it has an SSD with property connectors. Check out this ifix guide on how to disassemble them and what enclosure you can use to mount the drive in another computer: https://www.ifixit.com/Guide/MacBook+Pro+13-Inch+Retina+Display+Late+2012+SSD+Replacement/12823

    Those 2012 MBPs are using standard 2.5" SATA drives, so you can use any USB3 SATA adapter that supports 2.5" drives. Remember, always use USB3 sata adapter. Somehow there are still USB 2.0 sata adapters sold online right now, probably for legacy stuff so be sure to not accidentally buy them.

    The drive itself is usually formatted in APFS partition, so you’ll need to connect the drive to another mac in order to use. If it’s encrypted, the encryption key is probably stored in the apple account associated with the broken macbook.

    Your main concern is probably whether the disk got water damage or not. If the disk is damaged and unreadable, you’ll probably can still recover it by paying a data recovery specialist in your area. They’re expensive but can literally revives the drive as long as the platters are not damaged.

    Good luck!




  • If you want some peace of mind, there is nothing wrong to keep your home assistant instance locked up behind your lan. You can still access it externally using a VPN, or zerotier/tailscale. If you need notification support, just configure sms or email notification so HomeAssistant can still send you alert via SMS or email.

    If you’re ok with not being able to use HomeAssistant mobile app, then you can add some extra security by putting your home assistant instance behind an authenticating proxy. This means your home assistant will be protected by two login pages when you attempt to access it from outside your network.

    Some authenticating proxy options are Cloudflare Access or OAuth2 Proxy.

    If you’re already using Cloudflare, then using Cloudflare Access might be no brainer. If you’re already have experience with setting up your own OIDC providers using keycloak, auth0, okta, or Google oauth2 provider, then putting your home assistant instance behind OAuth2 Proxy might be a good option. Those auth providers usually have stricter login pages and you usually can add even stricter rules to the login page (e.g. disallow login from certain countries, rate limit, add captcha in addition to 2fa, etc). How strict your extra login security will be is entirely up to you.

    For Google assistant integration, you’ll need to enable the API in your GCP account as mentioned in this page. But it does require your home assistant url to be publicly routable from GCP servers so Google assistant can reach it, which means you can’t put your instance behind an authenticating proxy or keep it behind your lan. You might still be able to whitelist certain path from the authenticating proxy (e.g. the /api/google_assistant endpoint), but I haven’t tried it yet.




  • Security is a rabbit hole and you can go very deep depending on your risk model (an ordinary middle class people has different cybersecurity risk than, say, a CEO of a major bank). Let’s say you are an ordinary lemming that don’t have to be worry about being specifically targeted by a hacker group or a nation state, you just don’t want some botnets get into your network and take over your IoT stuff, I think the following is reasonable enough:

    • by deploying your HA instance using docker or VM, if it somehow got compromized by an automated botnets / malware, the infection will be contained and you can easily wipe it off and start again. Real hackers might be able to escape the sandbox but run of the mills botnets that always scan the internet for exploits usually don’t.
    • setup OTP: https://www.home-assistant.io/docs/authentication/multi-factor-auth/
    • you can max out security level of HA login page (or the entire HA) using cloudflare’s firewall rule: https://developers.cloudflare.com/firewall/cf-dashboard/create-edit-delete-rules/ . This should stop most bots from trying to bruteforce your login page.
    • assuming you’re using cloudflare tunnel, you aren’t actually exposing your entire machine to the internet, but just the homeassistant port. That being said, it’ll be nice if you take some precaution and disable root ssh login and perhaps disallow password login too, just for peace of mind.





  • It’s written using Symphony framework and seems to be using the latest best practice. Nothing to worry about here. PHP has its warts, which are being addressed since PHP 7.x. Modern frameworks like Symphony go even further by encouraging best practices when developing PHP WebApps, unlike the dark old days of PHP WebApps full of SQL injections and XSS issues (still is though in the WordPress plugins ecosystem).

    I’m mostly a Python guy and used to look down on PHP, but changed my tune since the release of PHP 7.x. If Python has JIT half as good as PHP these days, I would die happy.