silverton38 Posted November 11, 2021 Posted November 11, 2021 2 minutes ago, MrBill said: You made me go look it up..lol Telenet is actually 52 years old... introduced in 1969! Someone with their head inserted deeply within will never be able to see light tho, so we might as well quit repeating ourselves. Email is almost as old. That does not make it bad. Again it is not telnet itself it is how Lutron uses it that matters.
DAlter01 Posted November 11, 2021 Posted November 11, 2021 1 minute ago, silverton38 said: At this time this is no known instance of hacking Lutron through its telnet interface but if you understand how they implement telnet you would see how hard it is to hack. Telnet runs as a separate process and only allows access to the switches themselves. So basically they give access telnet for anything that you can manually turn on and off or dim in the home. Their telnet implementation does not allow you to have account access or even install a new switch. It is completely open but only for what a physical person can do in the home. I have faith that Lutron knows what it is doing and will continue to use them. Maybe they will continue the feature in RA3 or maybe not but I will work with them as long as they allow third party access that works for me. Agreed. It seems Lutron thinks it is time to move on from Telnet on their new products. I understand your point about it being "hard to hack". However, that really isn't good enough for some corporate/business/government environements. And, they may have plans to do more with their products to have them more fully integrated with other processes and, if so, they need to make sure the security standards are consistent across product lines so they can talk to each other.
silverton38 Posted November 11, 2021 Posted November 11, 2021 Just now, DAlter01 said: Agreed. It seems Lutron thinks it is time to move on from Telnet on their new products. I understand your point about it being "hard to hack". However, that really isn't good enough for some corporate/business/government environements. And, they may have plans to do more with their products to have them more fully integrated with other processes and, if so, they need to make sure the security standards are consistent across product lines so they can talk to each other. You can worry about any platform being hacked, they are no different then anyone else. I trust them and will continue to use them. They seem to have the most reliable platform out there; which is what really matters.
DAlter01 Posted November 11, 2021 Posted November 11, 2021 9 minutes ago, MrBill said: You made me go look it up..lol Telenet is actually 52 years old... introduced in 1969! Someone with their head inserted deeply within will never be able to see light tho, so we might as well quit repeating ourselves. Yeah, I really don't think Lutron views this as just a light switch and that is all it will ever be. The technology needs to be scalable and standardized enough to make it secure as part of a much larger automation landscape that is surely coming in the next few years. As an integrator, I'm suprised there isn't a recognition that continuing to use Telnet hamstrings a wider adoption and integration of the equipment and impedes progress towards automation. 1
silverton38 Posted November 11, 2021 Posted November 11, 2021 Lutron passes my "forget me" test. I can do a Lutron setup and come back a year later and it will be working just as I left it.
DAlter01 Posted November 11, 2021 Posted November 11, 2021 Just now, silverton38 said: Lutron passes my "forget me" test. I can do a Lutron setup and come back a year later and it will be working just as I left it. It is great stuff, no question on that. And, seems to be getting better.
DAlter01 Posted November 11, 2021 Posted November 11, 2021 12 minutes ago, silverton38 said: Email is almost as old. That does not make it bad. Again it is not telnet itself it is how Lutron uses it that matters. Computers and the internet are older than email. They are not bad either. But, both have gone through monumental improvements to make them more secure, as has email. Telnet, not so much. LEAP is that evolution to make the process more secure. It was inevitable that it would be superseded.
silverton38 Posted November 11, 2021 Posted November 11, 2021 Just now, DAlter01 said: Yeah, I really don't think Lutron views this as just a light switch and that is all it will ever be. The technology needs to be scalable and standardized enough to make it secure as part of a much larger automation landscape that is surely coming in the next few years. As an integrator, I'm suprised there isn't a recognition that continuing to use Telnet hamstrings a wider adoption and integration of the equipment and impedes progress towards automation. Lutron does believe in proprietary protocols, which have served them well in the past. They will probably never use standardized protocols for their lighting. Lutron has only basic automation because it favors reliability over features. Having a separate hub that can do the "hard stuff" and that is the opening for the ISY; in my opinion.
silverton38 Posted November 11, 2021 Posted November 11, 2021 Just now, DAlter01 said: Computers and the internet are older than email. They are not bad either. But, both have gone through monumental improvements to make them more secure, as has email. Telnet, not so much. LEAP is that evolution to make the process more secure. It was inevitable that it would be superseded. Email still runs the same protocols for decades. I wish they would revise it but they do not.
MrBill Posted November 11, 2021 Posted November 11, 2021 23 minutes ago, silverton38 said: Telnet runs as a separate process Single Example of Many: Use the telnet protocol with the speed of modern day computers and connections, open as many connections as the device will accept, throw millions of random extended characters and see if the separate process continues to run, when the separate process fails.. it has failed, so it can't close the connection, now use code injection to replace the existing telnet process. the device is now hacked. The hackers purpose is not to control the owner of the devices lighting controls.. the hacker doesn't care what the device really does, and they let it continue to work as a lighting controller, but they also have a new point of presence for their botnet. By the way, I never said they will disable telnet on old devices, in fact I stated to the contrary they they probably can't because it would break too many integrations. What I said was to release NEW product in 2021 that still uses and outdated and insecure product would be insanity.
silverton38 Posted November 11, 2021 Posted November 11, 2021 12 minutes ago, MrBill said: Single Example of Many: Use the telnet protocol with the speed of modern day computers and connections, open as many connections as the device will accept, throw millions of random extended characters and see if the separate process continues to run, when the separate process fails.. it has failed, so it can't close the connection, now use code injection to replace the existing telnet process. the device is now hacked. The hackers purpose is not to control the owner of the devices lighting controls.. the hacker doesn't care what the device really does, and they let it continue to work as a lighting controller, but they also have a new point of presence for their botnet. By the way, I never said they will disable telnet on old devices, in fact I stated to the contrary they they probably can't because it would break too many integrations. What I said was to release NEW product in 2021 that still uses and outdated and insecure product would be insanity. Lutron is huge and I would assume they have been targeted by the security guys and all these tests have already happened. For example; Insteon had such a test and failed. I would recommend trusting that Lutron knows what it is doing.
MrBill Posted November 11, 2021 Posted November 11, 2021 24 minutes ago, silverton38 said: I would recommend trusting that Lutron knows what it is doing. Which is exactly why they are not enabling telnet is RA3. (which is where this conversation began) 1
silverton38 Posted November 11, 2021 Posted November 11, 2021 43 minutes ago, MrBill said: Single Example of Many: Use the telnet protocol with the speed of modern day computers and connections, open as many connections as the device will accept, throw millions of random extended characters and see if the separate process continues to run, when the separate process fails.. it has failed, so it can't close the connection, now use code injection to replace the existing telnet process. the device is now hacked. The hackers purpose is not to control the owner of the devices lighting controls.. the hacker doesn't care what the device really does, and they let it continue to work as a lighting controller, but they also have a new point of presence for their botnet. By the way, I never said they will disable telnet on old devices, in fact I stated to the contrary they they probably can't because it would break too many integrations. What I said was to release NEW product in 2021 that still uses and outdated and insecure product would be insanity. 4 minutes ago, MrBill said: Which is exactly why they are not enabling telnet is RA3. (which is where this conversation began) We will see when it is released. They have not said one way or the other.
lilyoyo1 Posted November 11, 2021 Posted November 11, 2021 1 hour ago, silverton38 said: We will see when it is released. They have not said one way or the other. Actually they did! https://support.lutron.com/us/en/product/radiora3/article/integration/Lutron-s-LEAP-API-Integration-Protocol 1
silverton38 Posted November 12, 2021 Posted November 12, 2021 (edited) 7 hours ago, lilyoyo1 said: Actually they did! https://support.lutron.com/us/en/product/radiora3/article/integration/Lutron-s-LEAP-API-Integration-Protocol That refers to their protocol. It is not known if they are going to have the Telnet protocol as well. This article does not even refer to Telnet at all. Edited November 12, 2021 by silverton38
silverton38 Posted November 12, 2021 Posted November 12, 2021 1 minute ago, silverton38 said: We can continue to debate but we should wait and see. Either way Caseta is not going anywhere anytime soon so Telnet will be around for a while even if RA3 does not use it.
silverton38 Posted November 12, 2021 Posted November 12, 2021 Why did Lutron Develop LEAP? For many years, most Lutron systems communicated using a Telnet-based protocol over TCP/IP. While Telnet integration with other systems proved to be very capable and deployed on thousands of projects, technology in the industry has continued to advance in addition to the needs of the client. This is where LEAP comes in to play. Secure – Instead of just utilizing a username and password for security, LEAP uses a pairing process with the 3rd party device that requires both verification of physical access as well as certificate-based authentication over a Transport Layer Security (TLS) connection. This helps provide peace of mind for the client. Dynamic – As opposed to the Telnet integration with a static configuration file, created when the database was transferred into the system, LEAP is more dynamic and allows for configuration reads during setup or runtime, depending upon what is best for the 3rd party system. One thing that is certain, reading the Lutron configuration has never been easier for a 3rd party system and this all leads to an efficient deployment for the integrator, reducing time consuming, error prone and costly double entry of data.
silverton38 Posted November 12, 2021 Posted November 12, 2021 (edited) The question is will they have Telnet available as well as Leap to be compatible with existing integrations? It will be interesting to watch when it is released. I am not saying they will, I am just saying it is possible. Again this is not Caseta which most of us use. Edited November 12, 2021 by silverton38
lilyoyo1 Posted November 12, 2021 Posted November 12, 2021 1 minute ago, silverton38 said: The question is will they have Telnet available as well as Leap for to be compatible with existing configurations? It will be interesting to watch when it is released. They've answered that. You just refuse to see the answer. 1
DAlter01 Posted November 12, 2021 Posted November 12, 2021 1 minute ago, silverton38 said: The question is will they have Telnet available as well as Leap for to be compatible with existing configurations? It will be interesting to watch when it is released. I'll wager it will not be there. It would be a security mistake and defeat the purpose of having the more secure LEAP coms. Like you say, Ra2 and Caseta will be around for a while, that seems to be the product you need to use for your legacy Telnet installs. 1
silverton38 Posted November 12, 2021 Posted November 12, 2021 Just now, lilyoyo1 said: They've answered that. You just refuse to see the answer. I will see when it is released. They may very well not have it but we will see upon release.
silverton38 Posted November 12, 2021 Posted November 12, 2021 Just now, DAlter01 said: I'll wager it will not be there. It would be a security mistake and defeat the purpose of having the more secure LEAP coms. Like you say, Ra2 and Caseta will be around for a while, that seems to be the product you need to use for your legacy Telnet installs. I agree with you that Caseta will be around for a long time so this is a mute point.
lilyoyo1 Posted November 12, 2021 Posted November 12, 2021 7 minutes ago, silverton38 said: We can continue to debate but we should wait and see. Either way Caseta is not going anywhere anytime soon so Telnet will be around for a while even if RA3 does not use it. There's nothing to wait and see about. Outside of you, no one on here is talking about what Lutron is doing with Caseta. This posting and subsequent posts are all about Ra3. Only you keep going back to Caseta which is geared towards diy. 2
silverton38 Posted November 12, 2021 Posted November 12, 2021 Just now, lilyoyo1 said: There's nothing to wait and see about. Outside of you, no one on here is talking about what Lutron is doing with Caseta. This posting and subsequent posts are all about Ra3. Only you keep going back to Caseta which is geared towards diy. We will wait and see. In the mean time I will continue my installations with Caseta using Telnet.
lilyoyo1 Posted November 12, 2021 Posted November 12, 2021 (edited) 25 minutes ago, silverton38 said: We will wait and see. In the mean time I will continue my installations with Caseta using Telnet. No. You will wait and see. lutron was explicitly clear with the direction they intend to take. You're free to use caseta as you please. The system integrators who actually use lutron dealer lines will probably move towards RA3 until whatever future date they decide to sunset Ra2 (and potentially Caseta for Caseta 2) Edited November 12, 2021 by lilyoyo1 1
Recommended Posts