Release source code for AirSendWebService

[sbraz]

Hello @jouralexandre,
Could you please release the source code for AirSendWebService? I am not very comfortable running closed source binaries in my Home Assistant instance.

hass_airsend-addon/addons/airsend/Dockerfile

Line 21 in 04a0bef

RUN mkdir -p /home && cd /home && wget http://devmel.com/dl/AirSendWebService.tgz && tar -zxvf AirSendWebService.tgz && chmod -R 777 bin

My understanding is that AirSendWebService somehow translates HTTP requests to your own UDP-based protocol to communicate with the AirSend device?

Thanks a lot for creating the AirSend, it's really useful.

[sbraz]

Hello @jouralexandre, is there any chance to get the binary open-sourced? AFAIK It's the only closed-source binary in my Home Assistant instance.

[remi-angenieux]

Hi,

The result of a quick reverse engineering

AirSendWebService is the component responsible for all RF communication.
In practice, it converts something like “open this Intel-branded shutter with ID XYZ” into an RF frame.
The hardware box itself is essentially a pass-through device: it only executes what AirSendWebService instructs it to do.
This design avoids the need to update the device firmware whenever new AirSend‑compatible equipment is added.
All updates are handled through the AirSendWebService binary or its cloud equivalent.

My home automation setup is also 100% offline. I work in IT and networking, so I tend to be naturally cautious.
Home automation systems are a common attack vector.

That said, I do not see how Devmel could release the source code, since it represents their core expertise.
It also contains implementations that rely on vulnerabilities in certain protocols.
Publishing all of that in a single place would not be very responsible either.

What I can recommend, however, is isolating the AirSend device as much as possible.
This is the approach I use:

• My AirSend is connected to a switch on a dedicated VLAN.
  It can only communicate with my home automation server.
• I run a dedicated Docker DHCP container just for it.
• I also run a Docker container for the Home Assistant plugin.
  I had to fork the official repository because it does not work in standalone mode.

You can find my fork here:
https://github.com/remi-angenieux/hass_airsend-addon/tree/main

I submitted a PR, but I could not verify that there were no regressions since I do not have a non‑Docker Home Assistant setup.
I believe it should work. I was a bit surprised by the staff’s response, considering I am using the same base Docker image.
But I already contributed code to a for‑profit company, which I consider fair enough, and I did not want to spend more time on it.
It is unfortunate that none of the improvements were integrated.

My container with the custom AirSend Home Assistant plugin image is connected to both:

• the VLAN network (to reach the AirSend box)
• the Home Assistant network (since Home Assistant makes REST calls to the plugin)

I am using Docker Swarm, so network management is simple but sufficient (no firewall based on port).

In the end, the AirSend box is isolated at Layer 2 (Ethernet).
It only sees my home automation server, not even my internet router.
The plugin container only sees Home Assistant and the AirSend box, and it has no internet access.

If you want a secure system, whether the code is proprietary or open source but you cannot audit it yourself, isolation remains the safest approach.

If you have any questions, feel free to ask.

Have a nice day.

[sbraz]

In practice, it converts something like “open this Intel-branded shutter with ID XYZ” into an RF frame.

I was not aware of that. It would be nice if that were stated somewhere as an explanation of why the binary is closed-source.

I submitted a PR, but I could not verify that there were no regressions since I do not have a non‑Docker Home Assistant setup.
I believe it should work. I was a bit surprised by the staff’s response, considering I am using the same base Docker image.

Submitted a PR where, what staff response?