Legal threats and lockouts against open-source device integrations

Independent developers have deleted or disabled their free device-control software after Mazda & Haier threatened them with legal action, & after Sleep Number phoned a developer demanding a takedown. Owners of Chamberlain, TP-Link, & Logitech products separately lost local control of hardware they had already paid for when those companies blocked or disabled the same integrations through a server change or a firmware update. The integrations let people run cars, appliances, garage doors, smart plugs, beds, & home-theater hubs from local platforms such as Home Assistant & Homebridge, outside the manufacturer's own cloud app. The developers, who could not afford to defend a lawsuit, generally complied; Mazda's developer said he could not afford the financial risk of a hobby project.

Cloud ecosystems versus local control

Home Assistant & Homebridge are open-source home-automation platforms that connect devices from different manufacturers and let owners control them, in Home Assistant's case by preference over the local network without sending data to a company's servers. Home Assistant describes local communication as important for privacy & speed: it is important that home automation devices communicate locally, without data leaving the network.

Manufacturers increasingly route the same devices through their own cloud. Chamberlain Group operates a paid partner program in which, as Home Assistant put it, the partner companies pay Chamberlain Group for the privilege of letting MyQ owners control their own garage doors.

The Electronic Frontier Foundation calls the practice of building a product that plugs into an existing one without the maker's permission adversarial interoperability, & lists third-party printer ink, alternative app stores, or independent repair shops as historical examples. The EFF argues that companies now discourage it, describing digital rights management as a way to create legal obligations to use the products you purchase in ways that benefit shareholders at your expense.

Companies have used two distinct methods against these integrations. Some send legal threats, a copyright takedown or a cease-and-desist letter aimed at the developer's code. Others change the device or its cloud after purchase, closing a local port or blocking the software so the integration stops working.

Legal threats

Mazda Connected Services

Brandon Rothweiler, who used the GitHub handle bdr99, wrote the Python library pymazda & a Home Assistant integration that connected to the same cloud service as the official MyMazda app, letting owners check fuel level & lock status & send commands such as remote start. On October 11, 2023, Mazda North American Operations sent him a cease-and-desist letter, & filed a takedown under the DMCA with GitHub requesting removal of the code & all forked copies.

In the DMCA notice, Mazda claimed that certain Mazda Information, including proprietary API information, was used to create code & that the integration provides functionality same as what is currently in Apple App Store and Google Play App Store.

Mazda's DMCA takedown notice filed with GitHub, stating that proprietary API information was used to create the code and that the integration provides functionality same as the official App Store and Google Play apps.

Rothweiler complied, & Home Assistant removed the Mazda Connected Services integration in its 2023.10.2 patch on October 12, 2023. Home Assistant said it was disappointed that Mazda's first recourse was not to reach out to us and the maintainer but to send a cease and desist letter instead. This case is documented separately at Mazda DMCA takedown of Open Source Home Assistant App.

Haier hOn

German developer Andre Basche reverse-engineered the protocol used by Haier's hOn app & published the hon & pyhOn projects, which let Home Assistant control washing machines, air conditioners, & other appliances sold under the Haier, Candy, Hoover, & GE Appliances brands. In mid-January 2024 the Haier Europe Security & Governance Department sent Basche a takedown notice. It read, in part:

We are writing to inform you that we have discovered two Home Assistant integration plug-ins developed by you ... that are in violation of our terms of service ... Specifically, the plug-ins are using our services in an unauthorized manner, which is causing significant economic harm to our Company.

The letter demanded that Basche immediately cease and desist all illegal activities related to the development and distribution of these plug-ins.

The Haier Europe takedown notice sent to the plugin developer, stating that the plug-ins were causing significant economic harm to the company.

Basche said he was considering pulling the repositories because of the cost of defending against the cease-and-desist. The code stayed online: BleepingComputer reported that the projects had been forked 228 times, many occurring since the news of the legal threats.

Sleep Number SleepIQ

A Homebridge plugin by the developer DeeeeLAN exposed Sleep Number smart beds to Apple HomeKit through the company's SleepIQ cloud service. Unlike Mazda & Haier, Sleep Number did not send a formal letter. On November 14, 2020, the developer wrote that the company had telephoned him:

I received a call from Sleep Number requesting I take down this plugin as it is overwhelming their network and making the SleepIQ experience worse for everybody, and it is a direct violation of their User Agreement.

The homebridge-sleepiq developer's November 14, 2020 post reporting a call from Sleep Number requesting he take down the plugin as it was overwhelming their network.

The developer warned users that if they did not update, Sleep Number will likely blacklist your IP Address. He shipped an update that removed all functionality, asked the company to provide a proper API with local network access in the future, & later archived the repository.

Technical lockouts

Chamberlain myQ

The Chamberlain myQ integration, added to Home Assistant in February 2017, polled the myQ cloud to report & operate Chamberlain & LiftMaster garage door openers. Through late 2023 Chamberlain blocked third-party access, & the integration broke repeatedly. The company's chief technology officer, Dan Phillips, confirmed the decision in a public statement:

Chamberlain Group recently made the decision to prevent unauthorized usage of our myQ ecosystem through third-party apps. This decision was made so that we can continue to provide the best possible experience for our 10 million+ users, as well as our authorized partners who put their trust in us.

Chamberlain Group chief technology officer Dan Phillips confirmed the company decided to prevent unauthorized usage of the myQ ecosystem through third-party apps.

Phillips later said the blocked traffic at times constituted a substantial DDOS [distributed denial of service] event. The block came a year after Chamberlain had discontinued its Apple HomeKit support, & was reported by The Verge & Forbes in November 2023. Home Assistant removed the myQ integration in its 2023.12 release on December 6, 2023, & recommended ratgdo, a local circuit board that wires directly to the door opener, as a replacement.

TP-Link Kasa

TP-Link's Kasa HS100 & HS110 smart plugs originally accepted commands on a local network port, which Home Assistant used for offline control. In November 2020 a firmware update removed that local access. TP-Link's UK account gave a security rationale:

There were security vulnerabilities on the plug for the local management, the latest firmware version fixed these security issues. It is suggested to use the TP-Link official App KASA to manage the plug.

Home Assistant noted that the security reason has not been verified and this reason has been given before when removing interoperability, & that buyers bought the plugs assuming the local API was a feature. After a week of complaints, TP-Link reversed course, saying on November 26, 2020 that it was creating a Beta firmware that'll enable people to continue to use third-party smart home software & platforms using local APIs.

Home Assistant's report that a November 2020 TP-Link firmware update removed the local API on the HS100 and HS110 plugs, and that TP-Link then committed to a beta firmware restoring local API access.

Logitech Harmony Hub

The Logitech Harmony Hub, a home-theater remote control, had exposed a local XMPP interface since at least 2013 that Home Assistant used for offline control. By December 17, 2018, Home Assistant reported that firmware version 4.15.206 had disabled it. Logitech said it had removed the local interface after a report from the security firm Tenable, & a Logitech representative wrote that the company had no plans to reenable access to private APIs.

The reversal came within days. Home Assistant reported on December 21, 2018 that Logitech had introduced an XMPP Beta Program that reinstated the local interface, & that the company was now committed to maintaining their local XMPP API.

Related restrictions on owned hardware

The same pattern reaches beyond home-automation accessories. In January 2025, 3D-printer maker Bambu Lab began rolling out firmware for its X1 series that added mandatory authentication for network printing, requiring a proprietary tool called Bambu Connect for third-party software such as the open-source slicer OrcaSlicer. The change & the community response are documented at Bambu Lab Authorization Control System.

Interoperability and copyright law

Whether these integrations infringe any copyright is contested. Reporting on the Mazda takedown, The Drive noted that one GitHub user highlighted that they weren't able to locate any copyrighted code in Rothweiler's work, & that the Electronic Frontier Foundation believes that reverse engineering for the purposes of interoperability can qualify as fair use. In each of these disputes the developer's decision turned on the cost of a defense rather than a ruling on the merits. Rothweiler described that asymmetry, telling Ars Technica:

My options were to either comply or open myself up to potential legal risk. Even if I believe that what I'm doing is morally correct and legally protected, legal processes still have a financial cost. I can't afford to take on that financial risk for something that I do in my spare time to help others.

Why developers comply rather than litigate

None of the developers in these cases tested the manufacturers' claims in court. Rothweiler deleted his Mazda libraries rather than accept the cost of a defense. Basche weighed removing his Haier projects for the same reason before the community forked them out of reach. The Sleep Number developer disabled his plugin within the same message that reported the phone call. In each case the software came down without a court ever ruling on the manufacturer's claim, & the owners who relied on it lost the ability to run devices they had purchased without the manufacturer's cloud.

The technical lockouts show a different outcome. Where Chamberlain held its position, owners were left to buy separate local hardware such as ratgdo. Where TP-Link & Logitech faced sustained public pressure, both restored the local access they had removed.

See also

• Right to repair
• Planned obsolescence
• End-user license agreement
• Mazda DMCA takedown of Open Source Home Assistant App
• Bambu Lab Authorization Control System