IdeaWell

Project ideas from Hacker News discussions.

I never authorized an integration that scans my secrets

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1 – Privacy concerns & desire for an opt‑in setting
Many commenters objected to the feature sending any password‑related data to a third party by default, arguing it should require explicit user consent.
- “Tough one. I get the intention but this should've been opt‑in.” – TavsiE9s
- “Personally I use HIBP but I would still be annoyed to learn a system I installed mainly for privacy was sending private data to a third party by default.” – janice1999
- “The feature is not the problem. … It should be opt‑in.” – flapperdeflip

Theme 2 – Developer tone and dismissiveness
Critics felt the maintainer’s replies were abrasive, condescending, or poorly handled community feedback.
- “And that kids is a clear example of how not to interact with people online.” – l-albertovich
- “Yeah not a good look. This is probably the worst way to handle community feedback.” – zephyreon
- “My replies there were more dismissive than they should have been. My apologies.” – frenck

Theme 3 – Open‑source expectations: threats to fork, uninstall, or demand change
The discussion highlighted the tension between user ultimatums (forking or abandoning the project) and the maintainer’s stance that open source owes no obligations.
- “If this is all reason for you to uninstall and fork… So be it, it is open source after all.” – flanz_10
- “Working on a fork already: Lets spend some tokens! :)” – flapperdeflip
- “An ultimatum is a threat. That’s literally the definition.” – dpark (referring to statements like “we will uninstall and fork if you don’t fix this”).

🚀 Project Ideas

Generating project ideas…

HA Privacy Switch

Summary

  • Provides a simple, discoverable add-on that exposes opt-in toggles for all privacy‑sensitive Home Assistant integrations (e.g., HIBP password checks, telemetry, cloud sync) with clear explanations.
  • Core value: puts users back in control of what data leaves their home, turning invasive defaults into explicit consent.

Details

Key Value
Target Audience Home Assistant users who prioritize privacy and want easy UI controls
Core Feature Centralized switchboard to enable/disable data‑sharing features per integration
Tech Stack Python (HA add‑on), HTML/CSS/JS for UI, uses HA's add‑on framework
Difficulty Low
Monetization Hobby

Notes

  • HN users complained about “sending hashes to HIBP without opt‑in” and “the developer's tone‑deaf response”; this add‑on would let them flip a switch and avoid the issue entirely (see comment: “This feature should be opt‑in”).
  • Enables discussion about default‑opt‑out designs in open‑source projects and could be adopted by other HA integrations as a pattern.

HA Network Monitor & Alert

Summary

  • A lightweight sidecar that runs alongside Home Assistant (container or OS) to sniff outbound traffic, log connections to known third‑party APIs (HIBP, analytics, cloud services), and send alerts when unexpected contacts occur.
  • Core value: gives users visibility and real‑time awareness of any data leaving their HA instance, rebuilding trust through transparency.

Details

Key Value
Target Audience Privacy‑conscious HA admins who want to verify no hidden phone‑home
Core Feature Real‑time traffic inspection, allow/block list, push notifications (e.g., via mobile app or email)
Tech Stack Go or Rust for eBPF‑based packet filter, Prometheus exporter for metrics, optional React dashboard
Difficulty Medium
Monetization Revenue-ready: SaaS $8/mo per instance (hosted dashboard & alerting)

Notes

  • Commenters asked “Is it scanning my computer for passwords?” and wanted to “set up firewalls between HA and my internet”; this tool would answer that with concrete logs (see comment: “If I feel like I need to start setting up firewalls… I'm more likely to look towards alternatives”).
  • Provides a concrete way to verify claims about data flows, fostering informed discussion and practical utility for both self‑hosters and hosted HA offerings.

LocalBreachDB for HA

Summary

  • An offline, regularly updated breach‑password database (using k‑anonymity or Bloom filter) that Home Assistant can query locally, eliminating the need to send any hash prefixes to HaveIBeenPwned.
  • Core value: delivers breach‑detection functionality without external network calls, satisfying privacy‑first users while keeping security benefits.

Details

Key Value
Target Audience HA users who want breach detection but refuse any third‑party data sharing
Core Feature Local lookup of password breach status via a distributed, updatable database bundle
Tech Stack Python (HA component), uses a compressed Bloom filter or partitioned hash‑prefix index updated via occasional signed downloads
Difficulty Medium
Monetization Hobby

Notes

  • Users argued that “even the first five characters of a SHA‑1 hash is a risk” and desired a solution that keeps data local (see comment: “Only the first 5 characters of a SHA-1 hash go to HIBP… some would consider that a risk”).
  • Offers a practical alternative that could be submitted as a pull request to HA core, sparking debate about balancing security vs. privacy in open‑source projects.

Read Later