Nest Learning thermostat API "OFF" mode - nest-device-access

When using the API to communicate with a Nest Learning Thermostat (in this case using the nest home assistant integration), when a request is made to change the nest thermostat to the "OFF" mode, I can see the mode show as "OFF" on the home.nest.com website, however the thermostat doesn't register it at all and just stays in whatever mode it was already in. Curiously, when I select "OFF" on the home.nest.com site the OFF mode that's displayed on the site has a leaf icon under it, while when I do it via the API it does not. When selecting it on the site the thermostat does switch to "OFF" with a leaf icon displayed under that on the thermostat as well. It seems like the API is sending an "OFF" state that the home.nest.com site can see but that the thermostat itself just doesn't respond to at all for whatever reason. It's like there are two different off commands here and only one of them (whatever the nest.home.com site is using) is working, and whatever the API is using is not. Seems like a bug but I wasn't sure if I'm just doing something wrong here or what. Just wanted to mention it here so that it will hopefully have some visibility from the devs. Thanks.

API bug confirmed, seems to be fixed here: https://github.com/home-assistant/core/issues/60941

If you see the leaf icon on the home.nest.com site, then the thermostat is in Eco, and the ThermostatMode.SetMode command doesn't work when the thermostat is in Eco: https://developers.google.com/nest/device-access/traits/device/thermostat-mode#setmode. You have to use the ThermostatEco trait instead.

Related

GA4 - filter internal traffic - issue

I am the owner and admin of a ga4 property.
My goal is to exclude internal traffic from one or more IP addresses from reporting.
Into settings -> Stream I defined the internal traffic with internal value by inserting IP address.
After that in settings -> data settings -> data filter, I created a filter with value internal_traffic with parameter exclude. The problem is that it only works in test mode and not in active mode.
If I try to activate it, a small square appears in the center of the screen and it doesn't give me a chance to activate it. Do you have any idea how to fix it? Thanks
I was having this same issue and I found a workaround. Simply click on the arrow next to the filter to take you into the filter settings and click the activate from the list of radio buttons at the bottom of the screen. I tested my implementation and it is working as designed. I hope this helps

Add device to nest devices list

I am using sample application control-jquery-master provided on developer.nest.com. I can access first device for e.g. thermostat as written in the code. It shows on the html page http://localhost:8080 with status "INSIDE" and two buttons "UP" arrow and "DOWN" arrow. Now, I want to add my own device instead of "thermostat" something like "mysensor" with different properties that can be set or retrieved. Is it possible to do that? If yes, what are the API, If not does it mean we can only use thermostat, smoke detector sensors which are provided by nest?
My question is how to access and modify the JSON document? Where is it stored?
Best Regards,
Sonal
The only way to add your own sensor(s) to the devices JSON payload is to make use of the Product data read/write permission.
This Nest API doc outlines the steps necessary to reach a working implementation.
The only way to add more physical Nest devices to an account is by doing so on their site or with their app. You can add virtual devices using their Chrome extension: Nest Home Simulator

protecting client from javascript console

I just finished a app with Meteor that was kind of to test the waters and really try to figure Meteor out. My application is a two player game with 64 buttons. Two users enter a single game, whoever presses the most buttons, wins. Everything works well for the most part except for one part, a user in the game can easily cheat by typing some jQuery into the console the most obvious is $('.button').click();. After a while of searching through Meteor Docs and trial and error I am stumped. The buttons are part of a collection specific to the two players. As soon as one player logs in the server side code inserts buttons into a collection called "Games". How can I protect users from modifying code via JavaScript console? I obviously don't want to post 100s of lines of code and I hope I gave you the gist of how my application operates if you want to see specific code please check out my Git Repo. Also heres a link to the actual game : Bubble Popper
You can't control what your clients do on their computers. You best hope is to add some restrictions on the server side. Perhaps it's not possible for any human to click on two buttons within 1 second? If it's not, then add this restriction on the server.
From How does Facebook disable the browser's integrated Developer Tools?
This should only work for chrome.
Object.defineProperty(console, '_commandLineAPI',
{ get : function() { throw 'Nooo!' } })
That being said - this isn't security - just a cosmetic thing / security from ignorance.
Security should happen via your server side Meteor.methods, and from your allow/deny rules in the db.

Changing the order of Facebook Open Graph actions in the auth dialog

Is it possible to select which Facebook Open Graph actions show up on the auth dialog? It defaults to alphabetical and only shows the first two. Our website has 4 actions and our more prominent ones are not showing by default. Could not find a way in the developer settings to change this order. Just seeing if it's possible.
No, it's not possible, you can't configure it in that much detail

How can I stop the Flash privacy popup from occurring twice on a page?

My web-app records users via webcam and microphone. I want to use HTML/JS for the controls and content, so I created two separate Flex modules:
* A "Webcam Setup" module that lets you choose your camera and mic input devices
* A "record" module that lets the user record and submit the recording
When I embed either of these on the page, since they access the user's Camera/Mic object, Flash shows the Privacy dialog that says "[mysite] is requesting access to your camera and microphone. If you click Allow, you may be recorded."
The problem is, if I answer Yes in the Setup module, and later add the Record module to the page using Javascript, it again shows the Privacy dialog.
Is there a way to avoid the second privacy popup?
I would think that saying "Yes" for [mysite] would store that permission for at least that session, but apparently not.
What I've tried
I tried combining them into one SWF, adding it to the page once and moving the DOM element with jQuery's append() function when needed. When I move it, however, it reloads and asks me again.
Imagine if [mysite] was, say, blogger.com or livejournal.com (or, if it were still around, geocities.com). Would you want a "yes" response on that site to be good for every page under that domain?
Rememeber, just because you promise (cross your heart & hope to die) not to abuse the security hole you request, doesn't mean they can allow you to have that security hole.
Eventually, I found a usable workaround, similar to what I originally tried (above).
I combined the setup and record modules into one SWF. I first show the setup screen. When the user hits the Continue button on my page, Javascript calls a function in the SWF to swap to the Record screen.
I then move the <div> containing the Flash object to another location on page using absolute positioning, and resize the object.
Previously, I was trying to use jQuery's append() function to move the div within the DOM, and that was causing the SWF to reload. Just changing position and size does actually work.
You could build the "record" component to simply send and receive signals using an API you've created for your "setup" component (which has already been authorized, meaning one auth & two swfs) by using the LocalConnection class:
http://livedocs.adobe.com/flex/3/langref/flash/net/LocalConnection.html
This seems far closer to best practice than the other implementations mentioned, which smell a bit hacky and would probably confuse anyone who may inherit the codebase in the future.

Resources